1503625 - Authentication fails on office.com from TB 60 with non-ASCII character in password

Status: RESOLVED DUPLICATE of bug 1500772

(Thunderbird :: Untriaged, defect)

Description

[bruno]

Attachment: 2018-10-31_173940_thunderbird.log

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0

Steps to reproduce:

Install Thunderbird 60 on a clean Lubuntu 18.04
Copy my old .thunderbird folder in my home
Open thunderbird
Click "Get messages"
Thunderbird asks for my password. I input the password correctly.


Actual results:

A message about wrong username or password is shown. "Logon failure: unknown user name or bad password"


Expected results:

Email is downloaded

Comment 1

[bruno]

Everything was working fine with the old Ubuntu 16.04 and Thunderbird. Sending also does not work.

Comment 2

[Jorg K (CEST = GMT+2)]

We get problems with Office.com frequently, last one in bug 1498180. Does the password have any non-ASCII characters?

Comment 3

[bruno]

Yes, the password had on non-ASCII character, the pound sign £. I've changed the password, now it only has ASCII characters and it works. Curiously, this is the second time in my life I have problems logging into a mail provider due to the inclusion of a £ character in the password XD
Thanks for your help :)

Comment 4

[Jorg K (CEST = GMT+2)]

The curious thing is that we "fixed" non-ASCII characters in passwords in version 60, see release notes:
  Passwords can now contain non-ASCII characters, like international characters,
  for example áäß, and symbols, for example €§

Technically passwords are now transmitted using (multi-byte) UTF-8 encoding when before only windows-1252/ISO-8859-1 worked. We had another report that with TB 60 non-ASCII stopped working, so I'll dupe this over there.

Comment 5

[Jorg K (CEST = GMT+2)]

Hmm, I wanted to work a bit on bug 1500772, so I went to my Microsoft account and tried to change the password to contain an é and a £. No success, both were rejected. So how did you manage to get a £ in there?

Comment 6

[bruno]

At my company, we have an internal web service changepassword.company.com where I can successfully set a password with £. I then proceeded to successfully use the password to access network shares and the office.com web interface. Only POP3 and SMTP fail

Comment 7

[Jorg K (CEST = GMT+2)]

I think the discussion is best continued in bug 1500772.

You should ask the people in your company which encoding POP3/SMTP use, whether it's windows-1252/ISO-8859-1/ANSI or UTF-8. The POP3 spec https://tools.ietf.org/html/rfc5721 talks about UTF-8 for non-ASCII usernames/passwords.

You will understand that windows-1252 can only encode 256 characters (https://de.wikipedia.org/wiki/Windows-1252), but Chinese/Japanese/Korean (CJK), Thai, Arab, Greek, Hebrew users, just to name a few, also want passwords in their language so UTF-8 is certainly the go.

If you can show me evidence that TB is now infringing any RFC or there is a good case to have an option to switch between UTF-8 and windows-1252, we can consider the case. But we can't just do it for some company legacy system were some non-ASCII passwords work by accident.

If you still have access to a machine with TB 52.x on it, try 안녕하세요 as a password and see how far you get, or closer to home: Καλησπέρα.