338647 - When server-error on start-up, Thunderbird skips asking for password

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[Martin Heffels]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

Normally when I start Thunderbird (v1.5.0.2), it asks to enter for a password to continue, and in the mean time in the background starts searching for e-mails.
However, if it can't find a server during start-up, due to internet-connection nto working properly, it reports that it can't find the server (for every server), and then goes into the program, without asking for a password. So you can simply read someone else's e-mail by temporarily disabling the internet-connection and starting Thunderbird.

Reproducible: Always

Steps to Reproduce:
1. Stop internet-connection
2. Start Thunderbird annd wait for server not available message
3. Read e-mail without password check!

Actual Results:  
Described in details: no internet-connection, means no password check at start-up but after server-error message, jump straight into the e-mail.

Expected Results:  
To see server-error message, and then ask for password to access mail.

Ask for password.

Comment 1

[Daniel Veditz [:dveditz]]

Locally saved mails are not protected by an additional password beyond the protections offered by your operating system: they are saved in text files that anyone with access to your computer can access. Thunderbird prompts for a password only when a server requires it for access.