1274175 - Thunderbird no longer fetches email from BigCommerce server in V45 because host only supports TLS 1.0

Status: VERIFIED WONTFIX

(Thunderbird :: Untriaged, defect)

Description

[Rich]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20160502172042

Steps to reproduce:

I had Thunderbird set on auto-update. Recently, when 45 was released, I was upgraded from 38.7.2 on a computer restart to 45 automatically. Thunderbird ceased downloading new email from BigCommerce servers. Upon discovering lack of email, I simply reverted back to 38.7.2 and email began populating again. This is all I know.


Actual results:

No email fetched from BigCommerce server in version 45.


Expected results:

Email should have continued fetching.

Comment 1

[Wayne Mery (:wsmwk)]

Have you tried thunderbird startup in in safe mode?
Also see https://support.mozilla.org/en-US/kb/cannot-receive-messages

Comment 2

[Rich]

Hi folks-
I don't have a lot of information to provide. I did not try a safe mode (nor was I aware of that being an option). I'm sorry I did not have time to continue troubleshooting and reverted to 38 after about an hour of trying to get 45 to work.

I'm running OSX 10.10.5 Yosemite. The auto-updater installed Thunderbird 45 on a restart. A few hours later I recognized I was not receiving any mail from our BigCommerce Server. I was receiving email through gmail and hotmail, just not BigCommerce. 

My website runs on BigCommerce, and I connect directly to BigCommerce with Thunderbird. I had made no changes to may password or settings (re: https://support.mozilla.org/en-US/kb/cannot-receive-messages) and I also did try resetting up all of that to no avail. 

I will say that I use a service called SpamDrain which is extremely helpful in helping me manage spam. I mention this because a recent software update from SpamDrain also caused a disruption in service with the spam filter not working with BigCommerce. Once I contacted SpamDrain, I recall them mentioning that it was related to some older security methods being employed by BigCommerce that had not been updated to latest standards. The SpamDrain folks opted to update their software for continued use with BigCommerce. Perhaps, there is some relation here with Thunderbird not working with BigCommerce on the new package because of security standard changes?

I hope this is helpful. I also realize that there may be only a small pool of folks like me that might be using BigCommerce with Thunderbird, so this may not be a high priority.

Comment 3

[Matt]

Interesting that you take such a casual view to security.  Thunderbird has indeed had some updates to allowable encryption platforms,   much of which was in response to the logjam attack https://weakdh.org/  These include only using TLS version 1.2 as version 1.0 is broken

mail1.bigcommerce.com:993  rates an F on security. See https://www.htbridge.com/ssl/?id=06066c31274b7f9ee84a3aefe911180b1b9fe56f6bd8d27041a65259c6dea4be
mail1.bigcommerce.com:995 rates am F on Security. See  https://www.htbridge.com/ssl/?id=40947c964b682f8f092d7e98264fb8c889741dc2466641c41745018ebac710e9
mail1.bigcommerce.com:465 rates am F on Security. See https://www.htbridge.com/ssl/?id=5be9b293b7dc6880bb87c7c51995b3e6e90bdbb933dd0b767782ddec01c2072c

I will leave it with you to address your broken security with your hosting provider.  But if the email security is broken what is the security on the e-commerce side of things like?  I suggest you transfer your account to a host that takes security seriously.

Comment 4

[Jorg K (CEST = GMT+2)]

Sorry to jump in here. In the account settings under "Server Settings" you can reduce the connection security for incoming e-mail. You can also reduce it for outgoing e-mail under "Outgoing server" (end of the list, select the server, click "Edit").

We don't recommend any of that, the connection security should be STARTTLS or SSL/TLS but it would be worth a try to see whether the e-mail comes in like that.

Comment 5

[Jorg K (CEST = GMT+2)]

If you click on the htbridge.com links given above, you can see that your host only supports TLS 1.0.

Try setting the preference security.tls.version.fallback-limit to 1. 1 means TLS 1.0, 2 means TLS 1.1 and 3 means TLS 1.2.

Here's an article on how to change the preference in the config editor:
https://support.mozilla.org/en-US/kb/config-editor

Again, none of this is recommended but might get you going again.

Comment 6

[Wayne Mery (:wsmwk)]

Other recent examples reported in support
https://support.mozilla.org/en-US/questions/1120609
https://support.mozilla.org/en-US/questions/1120453
https://support.mozilla.org/en-US/questions/1120192

Comment 8

[Rich]

Thanks folks! I sincerely appreciate your attention and feedback! ...(with perhaps the exception being the comment regarding my "casual" view of security, Matt...)

Unfortunately, I do not have control over BigCommerce's security updates. I am a bit dissatisfied with their attention to security updates, but as a small business that is struggling to remain open, I have not had the financial bandwidth to consider migrating to a new platform at this time. There are also numerous other factors to consider when making a wholesale change to a new server like that.

I'll have to stay on 38.7.2 until I can confirm BC has updated their service, or until I can consider switching to an alternative solution, etc.

Again, thank you!