1178032 - S/MIME message sent unencrypted after going online

Status: RESOLVED WORKSFORME

(Thunderbird :: Security, defect)

Description

[fuglede]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.6.0
Build ID: 20150331233809

Steps to reproduce:

Hi Thunderbird folks; apologies if this has been posted before -- given its genericity I would have expected it to be, but I could not seem to find it.

The following occured with User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.6.0

- I had composed a long message while Thunderbird was offline and had it set to be encrypted and signed, using S/MIME.
- I then "sent" the message, and relaunched the software to reobtain my lost connection.
- The software prompted me, asking whether or not I wanted to send my unsent message.
- I let Thunderbird do it.


Actual results:

The mail was sent unencrypted and unsigned.


Expected results:

The mail should have been sent encrypted and signed.

Comment 1

[Magnus Melin [:mkmelin]]

My guess is you didn't actually set it to be encrypted + signed to begin with. 

Once the message is put in the outbox (using "Send later"), it already contains the same data that will be sent to the SMTP server, i.e. already encrypted if you opted for that. It would be a very elaborate bug if it actually managed to somehow decrypt the message as non-encrypted before sending. 

I also tried the steps to reproduce, and the message got delivered signed+encrypted as it should.

Comment 2

[fuglede]

I tried it out a few time to make sure I could reproduce it myself back then (and to make sure that it was independent of add-ons).

I no longer have the old version installed though, and I can also not reproduce it on Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.8.0 so that no matter what there's probably no issue here.

Comment 3

[Magnus Melin [:mkmelin]]

Thx for checking! Resolving as WFM then.