1566458 - Optionally protect the startup of Thunderbird using the Primary (Master) Password

Status: NEW

(Thunderbird :: Security, enhancement)

Description

[Kai Engert [:KaiE:]]

I received the following request by email. I'm filing it here for discussion and consideration.

If a Master Password is configured, and if the user sets an optional preference, then require that the user can successfully enter the Master Password, prior to opening the main Thunderbird window.

If the user fails to enter the correct password three times, then Thunderbird shall exit.

No additional protection of the stored data is requested.

The reported motivation is to introduce a small barrier for non-skilled users, preventing them from easily viewing the messages stored in Thunderbird.

Comment 1

[Mark Banner (:standard8)]

In the past, we've pretty much always said we won't support this, and recommended separate logins and use OS profile protections, or use an applications which can sandbox other applications. I still think that's quite reasonable perspective to take, as otherwise you start "going down a rabbit-hole".

The issue here is that if you start providing something that says you can't access Thunderbird without entering this password, people will start believing that Thunderbird is protected and no-one can read their email. Let someone come along who is slightly skilled, and they'll access your profile folder and read your emails there. Then you'll get complaints that Thunderbird isn't doing what it says.

I think explaining this to users easily and clearly - in a way that they'll read, take notice of and understand - is going to be hard. For instance, we've had many reports over the years of users expecting the master password to protect all of Thunderbird, despite preferences clearly saying it only protects passwords.

You could also add encrypting the files on disk, but then you start heading towards what about in-memory scopes, levels of encryption, and impact on performance.

Whilst overall, it could be something that Thunderbird provides, is it really worth the effort to implement and support when there's already existing functionality in the user's own operating system that does the same job for free?

Comment 2

[Magnus Melin [:mkmelin]]

Agreed not worth supporting, and the os will do it so much better. Wouldn't want to encourage anyone to think the MP is really protecting them.

The master password is also often causing a lot of problems for the users who do try to use it.

Comment 3

[Kai Engert [:KaiE:]]

I just discovered that we have a hidden preference: mail.password_protect_local_cache

If set, TB will open, but if not password is set, the cached messages won't be shown.

I don't know if we can promise that this will continue to work, just documenting it here.

Comment 4

[Jorg K (CEST = GMT+2)]

Just as a note: It's not really "hidden" since it's defined in mailnews.js. We have really hidden preferences in the system that aren't defined anywhere like mail.ui.display.dateformat.*:
https://searchfox.org/comm-central/search?q=mail.ui.display.dateformat.&case=false&regexp=false&path=
Of course the internet knows ;-) - http://kb.mozillazine.org/Date_display_format
And the same site knows about your pref, too: http://kb.mozillazine.org/Protecting_the_contents_of_the_profile_-_mail

Comment 5

[Matt]

(In reply to Kai Engert (:KaiE:) from comment #3)

I just discovered that we have a hidden preference: mail.password_protect_local_cache

If set, TB will open, but if not password is set, the cached messages won't be shown.

I don't know if we can promise that this will continue to work, just documenting it here.

I think we should add this to the user interface as an option with text like "Delay showing mail window until master password is entered." We have a use master password tick box one that says to delay showing the user interface is not much of a change and offering it as a delay, not as password protection sort of side steps the while password locking thing. It is also functionality that is available now so only a minor string change is needed to have a V78 feature than has been long requested in user forums.

Comment 6

[Mark Banner (:standard8)]

(In reply to Matt from comment #5)

I think we should add this to the user interface as an option with text like "Delay showing mail window until master password is entered." We have a use master password tick box one that says to delay showing the user interface is not much of a change and offering it as a delay, not as password protection sort of side steps the while password locking thing. It is also functionality that is available now so only a minor string change is needed to have a V78 feature than has been long requested in user forums.

How will you also explain to those users, that since they have access to your computer, they can also trivially read the emails on your disk drive directly without even accessing Thunderbird? They obviously already don't understand that by wanting this option, or think they'll be ok (e.g. other person accessing computer doesn't have that much knowledge). This would be fake security and I think that would be bad to promote.

Comment 7

[Matt]

(In reply to Mark Banner (:standard8) from comment #6)

How will you also explain to those users, that since they have access to your computer, they can also trivially read the emails on your disk drive directly without even accessing Thunderbird? They obviously already don't understand that by wanting this option, or think they'll be ok (e.g. other person accessing computer doesn't have that much knowledge). This would be fake security and I think that would be bad to promote.

Probably the same way I have explained it in the support article. https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-master-password

We make no claim at all that we are doing anything but delaying the display of the main mail window until a password is entered in my suggested approach. As you assert some folks will assume the wrong thing, but I have spent 10 years trying to explain compacting to that same audience without any appreciable change. That does not mean we don't compact! Nor should we not offer this because folks make a stupid assumption because it is what they want to believe.

If you want we link to the support article that explains it is trivial security. I have also spent 10 years explaining that to those requesting it and then pointing them to the relevant addon that does what they want. They want something that stops their workmates opening their mail when they leave the desk, that email is stored in plain text on their device is not of consequence to those asking/demanding as the access would take much longer to glean useful information. Just opening a 2Gb text file in windows notepad would see most casual snoops caught. Or crash windows.

Comment 8

[Mark Banner (:standard8)]

I'm not going to continue to argue here. To offer something that is fake security is never advisable. We know users don't read or understand the master password dialog, applying it here would be even more dangerous.

Comment 9

[Alex Ihrig [:Thunderbird_Mail_DE]]

This is a frequently requested feature in our support forums. In the discussions in the forum, people say that they are aware that asking for the master password at startup is not a real security. Still, people want the feature to avoid multiple requests for the master password (which are still caused by some add-ons), and often in-store to rudimentarily prevent employees (accidentally?) from viewing the profiles of colleagues to access. The affected users or "admins" deliberately do not want to use completely separate OS accounts, as this is impractical in small business.

As a developer, you should also listen to your users / customers and not always think that you know everything better than people. People agree to compromise. But I am aware that afterwards there can and will be inquiries and complaints the other way around.

You could offer it as an option that shows a text hint that indicates the only apparent security.

Comment 10

[Alex Ihrig [:Thunderbird_Mail_DE]]

Duplicate Bug 1361838

Comment 11

[Matt]

Not a duplicate Alex, it is asking for a preference. It might be invalid as we already have mail.password_protect_local_cache as discussed in the support article. I, however, would not like to make that call as mail.password_protect_local_cache is not apparently officially supported so might o away.

Comment 17

[Martin Jost]

bug 1688470 Is marked as duplicate of this here.

I STRONGLY disagree.
bug 1688470 talks about PGP/GPG encryption, which is (at least for me and seemingly others as well, see below) a different thing, than the mast password or how to secure TB itself on start-up.

See the discussion here: https://support.mozilla.org/de/questions/1304363#answer-1393533

PLEASE reconsider this "duplicate"

Comment 18

[Peter Stimpel]

After a more or less forced update, thunderbird exposed all my keys and mail content, just by importing PGP keys, and voiding the PGP "standards". OK, reading a faq, applying a masterpassword - which I did not need in the past since all my mails are encrypted and kleopatra was asking me for the passphrases in short intervals. From a security point of view: great behavior of Kleopatra.

Please reconsider an option to make thunderbird asking for pgp key passphrases, as it is kind of an industrial standard since years. There could be a "break security for convenience" tickbox, but it should be the users decision to tick it or not. Please stay away from breaking security features for the sake of convenience.

Another serious issue is not to call the user to set a master password after migrating PGP stuff. If you want to provide convenience, please make it convenient.

You rendered Thunderbird unusable for high security demand. And please do not put this down to be a duplicate, it is clearly NOT.

Thanks for considering

Comment 19

[bugzilla]

I gave up on the new Thunderbird team listening to security concerns.

I've been using "Interlink" https://binaryoutcast.com/projects/interlink/ for about 3 months now. It's a Thunderbird fork that still uses Enigmail.

There have been claims on Thunderbird forums that Interlink is unsupported, but this is not true, it's a current product with supported security updates.

Comment 20

[Ron OHara]

I am pretty sure that PGP itself is a very difficult target for intelligence agencies. So they would normally attack with some other vector.

Open Source projects are rightly considered fairly safe from trojan code ... the code is visible. However they are not safe from trojan design or feature changes.

This approach of grabbing and storing the PGP passphrase in an unencrypted database is either a truly inept change by the Thunderbird team, or the project has been compromised in some way to deliberately favour wrecking the security that PGP provides.

Doing this by default, and not warning that creating a master password is essential if you want to retain some sort of PGP security is even worse.

Ok - so assume you have 'upgraded' and do not realise that this risk has been created. What is the risk and when does it come into play.

For Windows users - oh forget it - if you expect PGP to protect you on Windows you are deluded.

For Linux/Mac users. Unless you get 'phished' you probably will not lose your PGP passphrase to Internet hackers. But if law enforcement seize your system and it was not powered off / full disk encrypted, they will be able to see that you use Thunderbird, know where to look, and voila - all your encrypted emails are exposed.

For all users, if you take unencrypted backups of your home directory to the cloud and rely on the PGP encryption to protect some of your emails/files - you are compromised.

I have rolled back to using Enigmail - unless the Thunderbird team removes this breach of security, the newer releases have to be seen as unsafe.

Comment 28

[pedrib]

I was able to un**** this mess by doing the following:

• if you have imported any secret keys, use OpenPGP manager to delete all of them (make sure you really do delete all, TB will give you a warning), close Thunderbird
• delete key4.db cert9.db logins.json (NOTE you will have to enter all your passwords again after this...)
• start Thunderbird, set a strong Primary Password

Follow the guide here to enable external use of gpg and assign the secret keys manually to the accounts you want to use:
https://blog.nicohood.de/use-thunderbird-78-with-system-gnupg-keyring

Mozilla, you make great products and I love the new TB, but this is a serious security problem.

Comment 29

[Matt]

(In reply to pedrib from comment #28)

I was able to un**** this mess by doing the following:

I would assume you followed the support article. https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-primary-password#w_removing-your-primary-password
The processes clears all passwords and I assume all keys with PGP. As I just don't use PGP I can't test it, but if it does not, that is a separate bug.

I see this bug as a request to close the program if the incorrect primary password is entered. Nothing to do with changing or removing it and most importantly nothing at all about encrypting the message store.

If a close down on the wrong password were to be implemented, there would need to be a reset option offered before the close. Otherwise there is no method to remove the primary password. That would see the brute force method described in comment 28 become a reality.

For those vocal about security. Just consider, more than 95% of Thunderbird's users use windows. Less than 1% use PGP. So while these things are important to you. They are not so interesting to the majority of users.

Comment 30

[Peter Stimpel]

Just a remark on "less than 1% use PGP". If this should be an excuse for forcing security breaking updates, it is a bad excuse. Sorry, Matt.

Comment 31

[pedrib]

(In reply to Matt from comment #29)

(In reply to pedrib from comment #28)

I was able to un**** this mess by doing the following:

I would assume you followed the support article. https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-primary-password#w_removing-your-primary-password
The processes clears all passwords and I assume all keys with PGP. As I just don't use PGP I can't test it, but if it does not, that is a separate bug.

"I assume" is not a great idea when it comes to security. Since the page you linked doesn't specify it, I prefer to play it safe, and follow my method of deleting the databases.

I see this bug as a request to close the program if the incorrect primary password is entered. Nothing to do with changing or removing it and most importantly nothing at all about encrypting the message store.

That's because the devs have been closing LOTS of bugs related to PGP encryption, saying it's a duplicate of this. Just have a look at the above comments with duplicate bugs.

For those vocal about security. Just consider, more than 95% of Thunderbird's users use windows. Less than 1% use PGP. So while these things are important to you. They are not so interesting to the majority of users.

I understand perfectly that PGP is used by less than 1% of Mozilla users.
But there's a something clearly contradictory here.
If PGP is not a priority for Mozilla (given so few users use it), then why did they bother to DUPLICATE PGP functionality that already existed in gpg????
It doesn't make any sense, if Mozilla doesn't want to spend the resources on this, then revert to the behaviour of using the system gpg by default, and drop the pretense of having PGP integrated into Thunderbird with their own special implementation.

And I don't understand why the devs are so defensive about this. Clearly, this is an incorrect / insecure behaviour, it breaks security assurances and it is completely different than the previous behaviour, which is obviously what users expect (because it was the previous behaviour).
On top of that, as the article I linked above shows, there's already a workaround in place to use the system's gpg instead of Mozilla's implementation!
So why not make it clear for everyone in a blog post or support article, since clearly lots of your PGP users prefer to use the system's gpg?

If the article I linked (https://blog.nicohood.de/use-thunderbird-78-with-system-gnupg-keyring) gets deleted, here is how to do it:

• go to the config settings and enable "mail.openpgp.allow_external_gnupg"
• import your public key into the OpenPGP Key Manager
• for each email account, click Add Key in the End to End Encryption tab and add the ID of the public key in the previous step

Comment 32

[Wayne Mery (:wsmwk)]

And I don't understand why the devs are so defensive about this. Clearly, this is an incorrect / insecure behaviour, it breaks security assurances and it is completely different than the previous behaviour, which is obviously what users expect (because it was the previous behaviour).

Explaining is not being defensive. Yes, it may be insecure in the eyes of users, and completely nonsensical to their expectations - we agree that this is the case.

But for reasons which have been provided, enforcing a startup password for viewing messages is absolutely not protecting the user's data - from the moment the user is logged in to the computer, the user's entire file system is open for business.

However, with PGP keys and related encryption information, what reasonable protections or warnings should be given about the storage of those keys?

(Note, none of this has anything to do with Mozilla - Mozilla doesn't develop THunderbird )

Comment 33

[pedrib]

(In reply to Wayne Mery (:wsmwk) from comment #32)

But for reasons which have been provided, enforcing a startup password for viewing messages is absolutely not protecting the user's data - from the moment the user is logged in to the computer, the user's entire file system is open for business.

It's important to have security in layers. For example I run Thunderbird under a software jail, so it's much more difficult to break out of that, and have access to the file system underneath (except the part that is exposed by the jail).

Therefore in my opinion, a master password is indeed a step in the right direction, as it keeps the mail passwords encrypted in the file system, with no way to decrypt it except to guess the password.

However, with PGP keys and related encryption information, what reasonable protections or warnings should be given about the storage of those keys?

I believe the problem here is the disconnection between what was the problem before, and what is the default now. I do understand that you don't want to spend much time on PGP since it's such a small slice of the user base, but it's worth having all the information discussed here written in an official support document for PGP usage in Thunderbird.

As for reasonable protections / warnings, ideally users should be given an option when they use PGP encryption for the first time in Thunderbird (and migrate from Enigmail):
A) use the system's gpg, as it was the default in Enigmail and most other mail clients
B) use Thunderbird's built-in PGP, informing the user of the trade-offs (it's easier to use, but less secure as all keys)

Option B), when enabled, should attempt to force the user to set a primary password. If the user chooses not to have a primary password, they should be made well aware of the security implications of such.

Actually, in my opinion, even without using PGP, users should be asked upon first "boot" of Thunderbird if they want to set a Primary Password, with the security implications of such clearly stated. This is the default for almost every modern browser out there, so it is a prompt that even "normal" users should be familiar with.

Comment 34

[Matt]

You might also want to read the FAQ. https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq
and the introduction to e2ee https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption

In this case you also probably need to read https://wiki.mozilla.org/Thunderbird:OpenPGP:Migration-From-Enigmail and https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards Where the use of GnugPG and how it is not had enough testing so is disabled by default is discussed.

Most of what has been discussed here is actually included in the two support documents and associated links (the wiki is linked from the suport documents). Have you actually read them?

Comment 35

[pedrib]

(In reply to Matt from comment #34)

You might also want to read the FAQ. https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq
and the introduction to e2ee https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption

In this case you also probably need to read https://wiki.mozilla.org/Thunderbird:OpenPGP:Migration-From-Enigmail and https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards Where the use of GnugPG and how it is not had enough testing so is disabled by default is discussed.

Actually, in the documents that you linked, it's pretty clear the reason for disabling gpg:

Thunderbird wants to offer a fully integrated solution, and is no longer using GnuPG by default to avoid licensing issues.

... licensing issues ...

PGP users are security conscious by nature (that's why they use PGP). Therefore, with PGP, the default should be maximum security. This doesn't really apply to non PGP users, where usability should be a priority.

If you don't want to implement this in the most secure way and / or go your own way, that's fine. But it's clearly not irrational for users to complain, since it breaks with previous (expected) behaviour, and it is the contrary of what every other mail application in Linux does.

And look, it's not such a big deal, since there is actually a workaround built into Thunderbird (the one I described above)! So all that is needed is a clarification in the docs that you linked, which tells users how to enable the use of gpg with the workaround.

Although I really think you should enforce a primary password at "first boot", and do the same (if it wasn't set before) when a user enables PGP in Thunderbird...

Comment 36

[Matt]

Actually, in my opinion, even without using PGP, users should be asked upon first "boot" of Thunderbird if they want to set a Primary Password, with the security implications of such clearly stated. This is the default for almost every modern browser out there, so it is a prompt that even "normal" users should be familiar with.

In your opinion. In mine that would simply alienate users that really are not interested in a primary password. That includes me.
I have a password protected user account and windows does a reasonable job protecting, and encrypting when asked, user account data. My device is vulnerable to law enforcement, but having a master password is not really going to make a difference, it only protects passwords and keys. Not mail data. None of mine is encrypted.

Let's look at a first start. There is no open PGP configured, so what is the real security implication, until I configure an email account, Zero. There is nothing there.
After I configure my account. Someone with physical access to my computer may be able to access my mail with or without a primary password as mail is stored on the local drive in plain text. Passwords are not displayed until I enter the system user account password. So the real security implications of not having a primary password at this point are still zero. No one can access my passwords without my user account password and mail is still plain text.

The only real implication here is PGP keys. Really I have little interest here, but they are the only actual security risk because they can decrypt encrypted mail. But I see bugs requesting permanent decryption, so I have to wonder exactly what it is people are asking for. My understanding is these are removed when the primary password is reset. And have the same level of default encryption as passwords without a master password. As the key file is available, that is really only a small speed hump. So the real security implications for those not using OpenPGP and no primary password is in my estimation still Zero.

BTW I have installed Chrome, Firefox and Edge in recent months and none of they poked me about a primary or master password. Perhaps your assumptions about what happens might be coloured by your operating system choice, I am not seeing what you describe as all modern browsers doing actually occurring.

A) use the system's gpg, as it was the default in Enigmail and most other mail clients
And does not exist on Windows. I need to search for relevant tar balls, installers and something to open the tarballs with. Not much of an option to be offered really.
B) use Thunderbird's built-in PGP,
Really the only option for the majority of users.

Option B), when enabled, should attempt to force the user to set a primary password.
Really, linking to the FAQ I can cop, informed choices are sometimes better choices. Offering to set a primary password if the user so chooses, also acceptable, but only at the conclusion of configuring openPGP for the account. Trying to force any decision on the user is not acceptable. Personally, I have some pgp keys stored apparently, the key manager shows them,but I would not consider a primary password, even if the programs offer to set one for me.

Comment 37

[Matt]

So all that is needed is a clarification in the docs that you linked, which tells users how to enable the use of gpg with the workaround.

This is an open source project. You are most welcome to edit the support documentation to include such, but I would suggest you only offer it to Linux users because few windows users even know that GPG is, let alone know how to download it and install it.

Comment 38

[pedrib]

(In reply to Matt from comment #36)

In your opinion. In mine that would simply alienate users that really are not interested in a primary password. That includes me.
I have a password protected user account and windows does a reasonable job protecting, and encrypting when asked, user account data. My device is vulnerable to law enforcement, but having a master password is not really going to make a difference, it only protects passwords and keys. Not mail data. None of mine is encrypted.

That's why I said "in my opinion".
And would it really annoy you that much that a SINGLE pop-up appears when you do a "first boot" asking "would you like to setup a primary password"?

Let's look at a first start. There is no open PGP configured, so what is the real security implication, until I configure an email account, Zero. There is nothing there.
After I configure my account. Someone with physical access to my computer may be able to access my mail with or without a primary password as mail is stored on the local drive in plain text. Passwords are not displayed until I enter the system user account password. So the real security implications of not having a primary password at this point are still zero. No one can access my passwords without my user account password and mail is still plain text.
The only real implication here is PGP keys. Really I have little interest here, but they are the only actual security risk because they can decrypt encrypted mail. But I see bugs requesting permanent decryption, so I have to wonder exactly what it is people are asking for. My understanding is these are removed when the primary password is reset. And have the same level of default encryption as passwords without a master password. As the key file is available, that is really only a small speed hump. So the real security implications for those not using OpenPGP and no primary password is in my estimation still Zero.

Actually it's not that simple. For example, if someone is using the same password in their email for their online banking, the additional primary password offers a bit more protection. Security should be applied in layers. It's all a question of achieving a balancing between security and usability, and again, a SINGLE pop-up a boot is inconsequential for most users, yet could afford them extra protection.
Understandable if you don't want to do this, but I think it's easy to see why it offers additional protection.

Really, linking to the FAQ I can cop, informed choices are sometimes better choices. Offering to set a primary password if the user so chooses, also acceptable, but only at the conclusion of configuring openPGP for the account. Trying to force any decision on the user is not acceptable.

Forcing was the wrong wording on my part. I meant more "Strongly suggesting", as in, another pop-up like the one that would appear at "first boot", so we're in agreement here.

Comment 39

[Alessandro Castellani [:aleca]]

I'm sorry but I'm confused with this bug.
Wasn't the original request of this bug to allow users to enable a Master Password prompt on startup?
I understand that doing that will only prevent users from using Thunderbird to read emails, but all those emails are plainly accessible in the user profile folder.

What does that have to do with PGP?
How did this bug got hijacked and turned into a PGP discussion?
It seems that all started when bug 1688470 was marked as duplicate of this one, which indeed seems wrong.

Am I missing something?

Comment 41

[Jet]

After posting https://bugzilla.mozilla.org/show_bug.cgi?id=1766150 and given the responses here, it seems that Thunderbird's mission doesn't include any security or privacy concerns whatsoever except for the CVE's that are patched as a matter of course.

The alternatives here are to dump convenience for being able to access different mail accounts with one client and just use the different services online to read your emails or use a email client that actually features basic security and privacy oriented feature that locks and encrypts and prevents anyone without a access passwords from reading your emails with what is a 0-day hack, just press cancel on the only protection mechanism of client and profit.

Comment 42

[Andrei [:sancus]]

Bugzilla is not a discussion forum. This bug is a request to delay startup until the Primary Password is entered.

Bug 1688470 isn't really a duplicate and any associated PGP issues aren't related to this bug at all. Lock-out behaviour options for OpenPGP are being addressed in Bug 1741042.

Comment 43

[Jet]

(In reply to Andrei Hajdukewycz [:sancus] from comment #42)

Bugzilla is not a discussion forum. This bug is a request to delay startup until the Primary Password is entered.

Bug 1688470 isn't really a duplicate and any associated PGP issues aren't related to this bug at all. Lock-out behaviour options for OpenPGP are being addressed in Bug 1741042.

This bug request is about and I quote from OP.

If a Master Password is configured, and if the user sets an optional preference, then require that the user can successfully enter the Master Password, prior to opening the main Thunderbird window.

If the user fails to enter the correct password three times, then Thunderbird shall exit.

It's clearly about if a user has master password set and enters wrong or cancels the password prompt then Thunderbird exits.

That is better than allowing access to reading emails and poking about the settings,

Perhaps there should actually be one password to protect the application/settings/profile that a user can set independently from master password when failed then thunderbird could encrypt the related folders in OS, thus adding extra layer of security.

Please dont ignore users privacy and security. Even though the OS can protect login into itself, this is easily bypassed Linux side by doing single user login and Windows side only requires basic tools that are wacked into a USB drive and booting from it, to remove or alter said passwords in less than a minute.

Not everyone encrypts their OS, but perhaps 2022 is the year to start.

Comment 44

[Jet]

Consider this a complaint, hiding valid posts as some arbitrary advocacy only enforces the view that Thunderbird doesnt care about its users. There is nothing on my previous comment that warrants such. Just ignoring what the actual issue reported in OP is about, and mis-interpreting the information is 100% bad form to begin with.

Comment 45

[Andrei [:sancus]]

(In reply to Jet from comment #44)

Consider this a complaint, hiding valid posts as some arbitrary advocacy only enforces the view that Thunderbird doesnt care about its users.

Thunderbird certainly cares about its users. This bug hasn't been WONTFIXed which means that we haven't made any permanent decision to fix or not fix it. But currently it's not a priority. My comment and changes were to disentangle this bug from PGP issues -- which have nothing to do with it, that's all.

Bugzilla is NOT a discussion forum, it's a place where we do work. It's not a place for you to rant about how Thunderbird is ignoring this, that, or anything really. See: Bugzilla Etiquette particularly the "no obligation" rule and "no pointless comments" rule. If you post a comment on a bug then it should be adding material information that would help a developer reproduce or fix it.

There is no other valid reason to post a comment on a bug. If you want to support fixing it, there is a "vote" functionality for that.

Comment 47

[pedrib]

(In reply to pedrib from comment #28)

I was able to un**** this mess by doing the following:

• if you have imported any secret keys, use OpenPGP manager to delete all of them (make sure you really do delete all, TB will give you a warning), close Thunderbird
• delete key4.db cert9.db logins.json (NOTE you will have to enter all your passwords again after this...)
• start Thunderbird, set a strong Primary Password

Follow the guide here to enable external use of gpg and assign the secret keys manually to the accounts you want to use:
https://blog.nicohood.de/use-thunderbird-78-with-system-gnupg-keyring

Mozilla, you make great products and I love the new TB, but this is a serious security problem.

For anyone is following this problem (since they keep closing other bugs related to this), here's another workaround that I just discovered, which is better than the one in my previous comment - sequoia-octopus-librnp.

Full description of its functionality:

The Octopus is a drop-in replacement for RNP, the OpenPGP library shipped with Thunderbird 78. In addition to providing all of the RNP functionality that Thunderbird uses, the Octopus also includes a number of enhancements. These fall into several categories. The Octopus restores some functionality that was present in Enigmail, but removed or has not yet been reimplemented in Thunderbird’s OpenPGP integration. In particular, the Octopus uses GnuPG’s keystore, interacts with gpg-agent, integrates GnuPG’s web of trust information, and updates certificates in the background. The Octopus includes a number of security fixes and improvements. For instance, it fixes Thunderbird’s insecure message composition, and automatically encrypts in-memory secret key material at rest. The Octopus adds a few performance improvements, such as, parsing the keyring in the background and using multiple threads. And, the Octopus has better support for parsing less usual, but not necessarily esoteric, certificates and keys.

Comment 48

[Nicolas Mandil (:NicolasWeb)]

This bug is a duplicate of bug 1780683 ?

Comment 54

[Thunichgud]

How stupid is that ? The password is only designed to protect the passwords ? And I shall use full disk encryption ? More ignorance isn't possible.
Thunderbird is absolutely unsafe !!! Shame on Thunderbird !
Everybody can read all my emails, when I leave my computer for five minutes without a shut down - and I never make a shut down when I leave it for five minutes.
The solution will be very easy: After the third wrong attempt of entering the password, close the login dialog and don't start Thunderbird. So easy!
It is a real bug. No, it is a real huge bug. It is since 4 years unresolved. And bug 1797297 is unresolved, too. Thunderbird is absolutely unsafe and nobody should use it.

Comment 55

[Kai Engert [:KaiE:]]

Attachment: WIP: Bug 1566458 - Add a Thunderbird specific pref to quit if primary password isn't entered on startup.

Comment 56

[Kai Engert [:KaiE:]]

Attachment: WIP: Bug 1566458 - Add default value for security.require_master_password_on_startup (false).

Comment 57

[Kai Engert [:KaiE:]]

I have attached two patches that could be used to "quit application if primary password is set, but isn't entered correctly on startup", if a new pref value is manually set.

This won't give any protection to unencrypted files stored locally by Thunderbird, but would give non-expert users a barrier to access those files with Thunderbird.
(Users with understanding could easily change file prefs.js in the profile folder to disable this soft barrier.)

While this doesn't give any real protection by itself, maybe there are scenarios in which it could help users anyway.

Comment 71

[david]

My proposal: This has been in discussion for four years with no beneficial results to users. There is no perfect solution, but Kai Engert has a patch that will shut down Thunderbird if incorrect password entered. That, in itself, would address 98% of what users have indicated. That prevents others from the ability to view messages or addressbook, and would require an aggressive move of copying message folders for viewing elsewhere. Adding a line in privacy&security pane, such as, “This prevents viewing of messages in Thunderbird without the password.” might help as well. Please, just do something here. Kai Engert’s patch is the best solution for now. Thank you.

Comment 72

[Kai Engert [:KaiE:]]

Magnus, do you support adding these? Cannot hurt I think?

The patches as is will not change default behavior, rather they give users an optional choice to prevent startup without PP.

Comment 73

[Magnus Melin [:mkmelin]]

I guess it wouldn't hurt yeah. Wouldn't think we need yet another pref for it though

Comment 74

[bugzilla]

Totally agree with david here. Almost every software with sensitive data has 2FA or Master Password to prevent opening the software. You should also be able to set a "Forget Access Password" (or how ever it will be called), so Thunderbird closes automatically after set minutes or is not accessible until you enter the "Access Password" again.

Comment 75

[Matt]

If the application does not start, how do you reset the master password to blank. It is not as if there is access to the error console if it just shuts down.
https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-primary-password#w_removing-your-primary-password

Personally, I think that there needs to be a reset GUI for all reset instances, and in this case it will need to be accessible from the password request GUI. The password request is all those that do not know the password will be seeing, so recovery options need to start right there.

Comment 77

[Kai Engert [:KaiE:]]

Good point about resetting the master password.
So it isn't as simple as suggested.

Comment 78

[david]

If I may comment, in five years there has never been a statement of the problem. At best, there is a proposed solution to what was never defined as a problem. My suggestion is to first define the problem. My perception, having received this from a few SUMO posts is this:
“ When the primary password is not entered correctly, access to previously downloaded messages is available for viewing in Thunderbird.” A proposed, simple, solution is “When the primary password is not entered correctly, simply close Thunderbird. This prevents the casual user from being able to easily browse content.” Doing this one small thing would be a meaningful improvement, not one that protects hackers from accessing messages, but that hasn’t been defined as the problem. Thank you for listening.

Comment 79

[Matt]

(In reply to david from comment #78)

If I may comment, in five years there has never been a statement of the problem. At best, there is a proposed solution to what was never defined as a problem. My suggestion is to first define the problem. My perception, having received this from a few SUMO posts is this:
“ When the primary password is not entered correctly, access to previously downloaded messages is available for viewing in Thunderbird.” A proposed, simple, solution is “When the primary password is not entered correctly, simply close Thunderbird. This prevents the casual user from being able to easily browse content.” Doing this one small thing would be a meaningful improvement, not one that protects hackers from accessing messages, but that hasn’t been defined as the problem. Thank you for listening.

How do you propose to reset the primary password? There is no interface presented at the moment, or proposed, to allow the user to reset the primary password.

If we put in a reset on the request for the password, something I actually support as requiring the user to enter JavaScript in the error console is so 1980, what happens then. The user restarts with the primary password removed and the product just loads. The same as it does now when you press Esc or cancel the password request.

Comment 80

[Wayne Mery (:wsmwk)]

Some random thoughts:

• If any proposal is to go forward, I think it should first go through a very careful Thunderbird UX review.
• If we implement a change, then we are deviating from Firefox behavior. My gut feeling is that would not be a good thing. (Yes, I know we do in some areas. And it would be the path of least resistance. But that likely doesn't end up as an ideal implementation.)
• IMO this absolutely won't stop at a hidden pref. The next logical step will be that it must be exposed in the UI.

Comment 82

[david]

Okay, I am repeating myself, I'm sure. You keep redefining the objective, and that never leads to a solution. The issue was NEVER about PGP or resetting the password. The original intent was to prevent people from being able to view messages in Thunderbird when the primary password is not entered. The simple solution is to just close Thunderbird if the password is incorrect. This issue surfaced again today on SUMO and it's embarrassing that, after five years, this is still being discussed. I agree that persons can still access the underlying mbox files and use other means to view them, but the primary password's function was to just prevent access via the installed Thunderbird. A decision on whether to provide 100% protection for the data should be made at a higher level than in Bugzilla. Thank you.

Comment 83

[soeren_runow]

Whenever the logic or underlying purpose of a function in software is neither obvious nor comprehensible, it is commonly referred to as poor design. And that's what we have here, which is why the discussion about it has been going on for years.

One should ask oneself who the target group of Thunderbird is, what benefit this target group or part of the target group derives from the way this function was integrated and whether it is worth holding on to a function in the way it is if this function is constantly misunderstood.

In some cases where the behavior of this function is criticized, it is pointed out by others that the function should work exactly this way and that this is also described in the documentation. However, whenever I have to open documentation for a function that is unambiguous in name, I feel like I'm back in the 80s. In my view, the core problem is that there is a fixed understanding of what password protection is supposed to offer. A certain kind of protection is offered here, but nowhere near the kind that is generally expected. Constantly pointing out that this function is not understood is probably only the second best way.

Translated with DeepL.com (free version)

Comment 84

[david]

That view is what has kept the discussion going for five years with no solution in sight. A bug, in my understanding, is where software does not perform as documented. The documentation for the primary password is that it protects account passwords. Nothing more. What you are proposing is to debate the documentation, and that is not, as I understand it, the role of Bugzilla. Shutting Thunderbird down when the wrong password is entered provides significantly more protection to the user while decision makers mull over a more thorough solution, such as encrypting everything. But that should be a followup activity. The approach of discussing bugs to a perfect solution when an interim solution addresses the short term is not serving the user well. The shortfall that users have reported is only that messages already retrieved may still be viewed. Shutting Thunderbird down addresses that. Okay, I have vented my frustration here several times. I am here stopping and will stay to the sidelines. Thanks for at least reading my concerns.

Comment 85

[Thunichgud]

I totally agree with david !!
Thunderbird is since more than five years unsafe and the developers has got many many hints in this five years. But they deny the simplest solution:
Close the app, when the password is wrong and also close the app, when I click on the Windows X-button and also close the app, when I click on the "Close"-button in the small login window of Thunderbird.
A very simple solution !! Every beginner in software development can solve this strange behavior of Thunderbird. But the developers of Thunderbird don't want to solve this simple problem.
My insistence: Fire the developers from the team of Thunderbird developers, which deny the simplest solution. Five years of stupid development are enough. Fire soeren_runow and the other opponents of a smart solution.

When I accidentally click on the icon of Thunderbird the login Windows opens. When I after that click on the Windows X-button or the "Close"-button in the small login window of Thunderbird to stop the loading of Thunderbird, it still continues to load itself. Thunderbird imposes itself to the user. Why ? It is so stupid !!

Comment 87

[Wayne Mery (:wsmwk)]

I think it is fair to say that public sentiment is understood, and that future progress now depends on technical decisions. So comments are now restricted.

https://connect.mozilla.org/t5/ideas/master-password/idi-p/25967 is a good place to vote for this idea (it currently has 27 kudos).

Comment 101

[Anje]

If people are concerned about prying eyes having access to view emails (not stored passwords because that can be done with Primary Password), why are they allowing others access to their computer User Account which can be protected by a password.

It does not seem very logical to allow others access to their User Account and thus anything stored therein not just emails and including copying any email files, but want to shut down Thunderbird program if a Primary Password is wrong after x attempts.

If others do share a computer User Account - so know it's password or no password has been set, they may need to start up Thunderbird to use a separate profile name. So if locking out Thunderbird for a period of time, due to a wrong Primary Password, it should not prevent an immediate Thunderbird restart on another profile using Profile Manager.

The Primary Password does a good job - it stops prying eyes seeing any stored password.

Comment 103

[Magnus Melin [:mkmelin]]

I think most people are not actually concerned. It's just that people get the impression it's a bug, so they report it. Probably some alert "continue without access to passwords?" alert would reasonably fix he issue for most.

Comment 109

[Anje]

If someone forgets a Primary Password and then discovers they cannot start Thunderbird, they will be more annoyed because then they need a route to kill the Primary Password just to restart Thunderbird.

The various complaints about the 'Primary Password' seem to imply the person using a Primary Password has made erroneous assumptions rather than based on information supplied in a help article.

I would like to suggest a solution which may help users to make a more informed decision regarding the use and expectation of the Primary Password.
In the 'Settings' > 'Privacy & Security' > 'Passwords' section
Include a text link to the Help Article : https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-primary-password

At the moment, that link to information does not exist. It seems a quick solution to direct users to information.