The current design (not accessible yet,  bug 605929 ) for importing passwords states that the import should overwrite the stored credentials.

This does not seem like a good idea (1), and it is not what happens (2).

Ad (1): If the origin, username and password are the same in the stored and imported credential, then overwriting it will result just in removing the metadata. This has no positive effect and breaks autofilling. In general, overwriting seems to be a potentially dangerous and unnecessary work.

Ad (2): If one attempts to import an already existing credential (such that the DB unique key of both matches, the DB refuses (according to the logs) to overwrite the data. That's because Chrome uses PasswordStore::AddLogin for that, instead of UpdateLogin.


We should keep the behaviour (of not overwriting the credentials), but do it in a way which does not generate DB errors. We also need to update the design doc.