587649 - Master password is enabled but it NOT required when starting Thunderbird

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[Patrick M. Ryan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.8) Gecko/20100722 (CK-IBM) Firefox/3.6.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.8) Gecko/20100802 Lightning/1.0b2 Thunderbird/3.1.2

  I have enabled the master password because I have several personal certificates in my configuration.  Prior to this build, I would be prompted for the master password as soon as I started Thunderbird.  After upgrading today, I am no longer prompted for the master password.  I can see that "use master password" is still enabled.  I can view my certificates even though I did not enter the master password.

Reproducible: Always

Steps to Reproduce:
1. enable master password
2. start tbird
3. no prompt for master password

Comment 1

[Jo Hermans]

The master password isn't used to protect your mail or your certificates. It's used to protect the password itself, which you need to download or send mail. You can even press cancel, and still read your mail that was already downloaded. There are bug asking to change this, but they would require that all mails were encrypted too, since you can also read the mail-file directly.

The initial query when you start up, even when you don't download your mail, was actually a bug : bug 526820.

Comment 2

[Patrick M. Ryan]

OK.  Thanks for the clarification.  I will close this bug.