How can I determine the add-on that's causing this sketchy pop-up I'm seeing in Firefox on MacOS?

How can I determine the extension that's causing this sketchy pop-up I'm seeing in Firefox? I've determined:

The pop-up appears reliably immediately after Firefox starts with this profile.
It still appears at startup even if I disable all my extensions using the sliders about:addons.
It does not appear when I start Firefox in safe-mode.
It does not appear if I switch to a different profile.

I can reset my profile to get rid of whatever is causing this pop-up, but I'd like to identify the source so I can try to report it.

I'm running Firefox 73.0.1 (64-bit) on Mac OS High Sierra 10.13.6 (17G11023).

Background:

I'm getting this sketchy password prompt twice each time I start FireFox on my Mac:

In that view, it's locked to the Firefox window, however, sometimes it manages to appear as a floating window that seems unconnected to Firefox (this seems to happen more when I sleep my computer):

Important Note: I am NOT seeing a Firefox master password prompt. Here is a genuine master password prompt from Firefox, which is obviously different than what I've posted above:

Kaypro II

Posted 2020-02-27T17:31:52.027

Reputation: 1 359

Answers

Such malware seems not to be documented, it might just be a botched add-on.

The simplest solution might be to create a new profile in Firefox, verify that this does not arrive in it, then install all the add-ons one-by-one, restarting Firefox every time.

If the problem disappears, then this might be just a corrupted profile. Export your bookmarks to the new profile and use it instead.

If the problem appears after the installation of some one add-on, then you have found it.

If the problem appears immediately in the new profile, I would suggest to uninstall Firefox (after saving the bookmarks), scrub all its data from the disk, and reinstall the latest version.

harrymc

Posted 2020-02-27T17:31:52.027

Reputation: 306 093

-1

Many browsers will ask for the password of the user account to before revealing any stored website logins. Firefox has a setting to set your own custom "master password". Firefox doesn't do this by default, but ensure the "Use a master password" setting (see image here) is unchecked in your Preferences/Options. It is found under Privacy & Security in the Logins and Passwords section.

More information about this setting can be found at this Mozilla support article.

iskyfire

Posted 2020-02-27T17:31:52.027

Reputation: 21

I am not seeing the Firefox master password prompt, but rather a prompt from some kind of malware that appears to be imitating it. I had the "User a master password" setting disabled, and I also verified that the real master password prompt uses different wording. – Kaypro II – 2020-02-27T19:44:19.620

Here are the hints that the prompt I'm seeing is not genuine: 1. grammar mistakes "...password for the My Computer...", 2. referencing the Windows-concept of "My Computer" on a Mac, 3. and the general awkwardness (such as the "PIN Required" part). – Kaypro II – 2020-02-27T19:47:39.673

Also, your answer does not answer my question, which was how to identify the source of the fake password prompt. I've already outlined how to disable the prompt in my question comment: "I can reset my profile to get rid of whatever is causing this pop-up..." – Kaypro II – 2020-02-27T19:54:13.993

@DrMoishePippik The original poster has indicated that they are using Mac OS. Because of this, they are not able to use that software from Nirsoft as it is a Windows-only executable. – iskyfire – 2020-02-27T20:28:10.033

@KayproII I wanted to provide information about that setting as a starting point. I know that you reset your profile, and so the setting should the default (off), but I wanted to bring it up because you had not mentioned the setting in your original question. Our next steps would to be to 1) See if the popup still appears if you are not connected to the internet, and if it doesn't appear when you open firefox while offline you may be able to track it using a program that monitors all traffic in and out of your computer. – iskyfire – 2020-02-27T20:35:20.917