1310459 - Don't always store password

Status: RESOLVED INVALID

(Thunderbird :: Security, enhancement)

Description

[Nick Levinson]

I'd like an option to omit my password for my Yahoo email account from permanent storage with Thunderbird. I would rather supply it at the moment of using Thunderbird to log into Yahoo and I would rather have to supply it each time I want to have Thunderbird access Yahoo. It's possible to omit the password when setting up Thunderbird to recognize my Yahoo account, but then when I wanted Thunderbird to access my Yahoo account I had to create a new Thunderbird account for the Yahoo account, this time typing in my password, which it presumably will store forever. The procedure that I should create a new Thunderbird account identical to an account already in Thunderbird (except for the password) is not intuitive and is not explained anywhere that I noticed. Editing an existing account does not include an option to add a password. There also appears no way to edit a password, either to reflect a change in my Yahoo password or in order to conceal it on my hard drive. I was using Thunderbird version 45.3.0 on openSuse 13.2 Linux, which I keep evergreen, so I'm now using TB 45.4.0, with no apparent difference on point.

Solutions possible in Thunderbird include:
* making the password optional and then, if not stored, asking for it at every pass-through login attempt without storing it
* letting users enter a password later, by editing an existing record, for permanent storage
* allowing a permanently-entered password be manually deleted or edited by a user
* telling users to create a new account even though it'll be the same as one already in Thunderbird

The relevant documentation on Thunderbird account creation:
* auto: https://support.mozilla.org/en-US/kb/automatic-account-configuration
* manual: https://support.mozilla.org/en-US/kb/manual-account-configuration

Comment 1

[Wayne Mery (:wsmwk)]

As far as I know you never need to store a normal password.
I'm not sure in the oauth case.
So please describe clearly what you are setting up.

Comment 2

[Matt]

The new account wizard asks if it should remember the password.  If you click yes it remembers it.

If you do not want it to remember the password  go to the password manager and delete the entry.  

This is a support request as far as I can see.  I do not see a bug or an enhancement request.

See also list
https://bugzilla.mozilla.org/show_bug.cgi?id=1310462
https://bugzilla.mozilla.org/show_bug.cgi?id=1310461
https://bugzilla.mozilla.org/show_bug.cgi?id=1310459
https://bugzilla.mozilla.org/show_bug.cgi?id=1310458
https://bugzilla.mozilla.org/show_bug.cgi?id=1310457
https://bugzilla.mozilla.org/show_bug.cgi?id=1310456
https://bugzilla.mozilla.org/show_bug.cgi?id=1310455

Comment 3

[Nick Levinson]

I probably should have combined this with bug 1310457.

I don't remember how I set up my Yahoo account within Thunderbird, and I don't remember the option that is in top-of-window menubar > File > New > Existing Mail Account > Mail Account Setup. I think I would not have used that particular method since I would have wanted to add an account that would have been new to Thunderbird, not existing, and I can't test the method now. (I don't want to test it by deleting the account from Thunderbird and recreating it since I want to keep the saved emails.)

I don't have a password manager in Thunderbird or elsewhere, so I can't delete a password that way. We're discussing that at bug 1310455. If Thunderbird has that functionality and it's hard to find, it shouldn't be, so that would be a usability bug. If Thunderbird lacks that functionality, that would be a security expectations bug, as almost no one would not want a way to update or delete passwords. If a password manager is an add-on or some such, one of them should be chosen and integrated into a preinstallation Thunderbird, because few people would expect to have to find such an add-on later and install it, since the functionality, or some of the functionality, is rather basic to security.

I'm not sure why you wanted to post a list of my other recent Bugzilla filings as see-alsos. They're not the same. Any reporter's filings can always be found by anyone, as far as I know.

I'm not sure what to clarify, although I'd be glad to try. I don't know if OAuth or OAuth2 applies.

Comment 4

[Wayne Mery (:wsmwk)]

Attachment: TB linux preferences passwords.png

Something is wrong with your Thunderbird installation. I reinstalled on my Centos machine and have no trouble seeing the password tab - shown in the attached screen shot.

Did you download/install Thunderbird from a mozilla.com site? If not, from where?
Does the password tab show if you start Thunderbird in safe mode?
 see https://support.mozilla.org/en-US/kb/safe-mode

Comment 5

[Javi Rueda :javirid]

(In reply to Nick Levinson from comment #3)
> I probably should have combined this with bug 1310457.
> 
> I don't remember how I set up my Yahoo account within Thunderbird, and I
> don't remember the option that is in top-of-window menubar > File > New >
> Existing Mail Account > Mail Account Setup. I think I would not have used
> that particular method since I would have wanted to add an account that
> would have been new to Thunderbird, not existing, and I can't test the
> method now. (I don't want to test it by deleting the account from
> Thunderbird and recreating it since I want to keep the saved emails.)
> 
> I don't have a password manager in Thunderbird or elsewhere, so I can't

See the button which says "Saved passwords..." on the screenshoot in attachment 8802447 [details]? THAT'S the Password Manager. Select the incoming server account you wanted to remove and click Remove. That will work. Then, whenever Thunderbird tries to access your server, it will ask you for a password and you just type it in and don't check the "Remember with Password Manager".

That's the way I have to go sometimes when having problems with Yahoo mail servers.

This bug should also be closed as INVALID, I think.

Comment 6

[Nick Levinson]

Attachment: hamburger Preferences menu

Comment 7

[Nick Levinson]

Solved, I think. Thank you very much.

The Preferences item in the burger menu does not have that window but menubar > Edit > Preferences does have it in and out of Safe Mode. (I didn't know the menubar existed until recently (https://support.mozilla.org/en-US/questions/1143244).) I don't want to try to verify that I can log into Thunderbird thence Yahoo until I've secured my offline copy of my Yahoo emails in case it tries to sync them and cause unintended deletions, but for now I'll trust that I can prevent saving the Yahoo password or can delete it after each use. I'll close this issue if I can.

Thank you, again.