319897 - T-Online doesn't require password to access emails

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[Hartmut Neubauer]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Build Identifier: http://download.mozilla.org/?product=thunderbird-1.0.7&os=win&lang=de-DE

I am a customer of T-Online (pop3 server pop3.t-online.de, smtp server mailto.t-online.de). When Thunderbird asks me to enter the personal password for the pop3 server, I can enter a wrong password (for instance, "abc" or "xyz"), and I receive my e-mails anyway.
I don't know whether this happens with other providers, too.
T-Online allows different passwords for general and e-mail access. I have chosen the same.

Reproducible: Always

Steps to Reproduce:
1. Create an account using T-Online
2. Write an e-mail to yourself.
3. Re-start Thunderbird. Click on "Abrufen". You are asked for the password. Type in a wrong one.

Actual Results:  
Thunderbird shows the new mail(s) or displays "Keine Nachrichten auf dem Server". 

Expected Results:  
Thunderbird should prevent the user to access the mails.

Comment 1

[Wolfgang Rosenauer [:wolfiR]]

T-Online doesn't check at all for your password. You're authenticated by your IP address or similar while you are dialed in into T-Online.
So this is the expected behaviour.

Comment 2

[Hartmut Neubauer]

(In reply to comment #1)
> T-Online doesn't check at all for your password. You're authenticated by your
> IP address or similar while you are dialed in into T-Online.
> So this is the expected behaviour.

If this is the fact, you may change the state of the bug as <invalid>.

Comment 3

[timeless]

per [e-mail]