1655436 - 78.0.1 not compatible with livemail.co.uk because server is using outdated SSLv3 and TLSv1

Status: RESOLVED INVALID

(Thunderbird :: Untriaged, defect)

Description

[derek]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36

Steps to reproduce:

upgrade to 78.0.1

Actual results:

With the exception of livemail.co.uk all my other emails work send and receive.
Livemail.co.uk sends but not receives and some folders do not show.

Expected results:

It should have upgraded as it has done for many years!

Comment 1

[Anje]

I would like to report that I manually installed version 78.0.1 onto another drive, so I could still run both 68.11.0 and 78.0.1 and I have an email address with webhost using livemail.co.uk and I'm not experiencing any issues in either version. Each version is running on a seaprate, but identical profile.
Currently Thunderbird is not auto updating to any version of 78.
I am noticing that virtually all issues in support forum seem to occur after an auto update from 68 to 78 which was performed by Updater Software on the users computer.

Comment 2

[derek]

By changing Imap port to 143 and security to STARTTLS the issue has been resolved. The smtp setting remain the same.

Comment 3

[Anje]

Interesting developement.....I've updated to 78.1.0 and not getting anything downloading from mail.livemail.co.uk
Continues to Work perfectly ok in version 68.11.0, so it cannot be the server.

Sending smtp works perfectly ok.

I'm using pop with setting to leave mesage on server.
port 995
connection Security: SSL/TLS
Authentication method: normal password.

Activity Manager shows no checking nor download.
Activity Manager: Account is not checked on start up nor every 10 minues.

When selected to 'Get Messages' :
Bottom status bar says: email address: Connected to mail.livemail.co.uk
It remains in this state until a different account checks another server then message changes.
There is no error message and no Activity Manager log.

Another person in Support Forum has also posted a sudden failure after update on same server.
https://support.mozilla.org/en-US/questions/1297461

But, there has been a sudden increase in not getting access from server, but only in 78 not 68.
https://support.mozilla.org/en-US/questions/1296565
https://support.mozilla.org/en-US/questions/1297273

Telling people to suddenly use insecure connections in version 78 which is not required in version 68 sounds like something is amiss.

Comment 4

[derek]

78.0.1 now working fine by changing incoming IMAP settings to
Port 143
Connection security: STARTTLS
Authentication method: NORMAL PASSWORD

Outgoing SMTP remain same on Port 465

Comment 5

[Anje]

What is causing the necessity in version 78.1.0 to change pop server settings for pop to:
port 110
Connection Security STARTTLS

when in 68.11.0 I'm using perfectly ok - and should be using according to Fasthosts -
port 995
connection Security: SSL/TLS

Comment 6

[Anje]

OK, I think I've found the reason, so if I'm wrong - please advise.

I have a 'Fasthost' account using server name 'mail.livemail.co.uk'

I have a pop account and it fails to function in Thunderbird 78.1.0.
I had to change the some of the server settings.
Pop account
Port: 110
Connection Security: STARTTLS

Other with Imap account had to change:
Port: 143
Connection Security: STARTTLS

But I believe I know the reason for this.
Thunderbird 78 has stopped out of date use of SSLv3 and TLSv1

I checked settings for 'mail.livemail.co.uk:995' at this website https://www.immuniweb.com
Results say:
The server has TLS 1.0 enabled. It is non-compliant with NIST since SP 800-52 REV. 2 and non-compliant with PCI DSS since the 30th of June 2018.
Non-compliant with PCI DSS and NIST
The TLS engine does not support a TLS version newer than TLSv1.0 and is outdated.
Non-compliant with HIPAA and NIST

So actually, Thunderbird is not really to blame as it is keeping up with security standards.
I have sent an email to Fasthosts asking them what is going on and why they are not using up to date standard.

Conclusion: I do not think this is actually a bug if the reason is because Thunderbird has disabled out of date use of SSLv3 and TLSv1.

Comment 7

[derek]

I am way out of my depth! I too have passed this information to Fasthosts.

Comment 8

[Wayne Mery (:wsmwk)]

Thanks for the analysis.

Comment 9

[Anje]

The issues for many people not being able to download emails due to Thunderbird 78 changing the minimum level of TLS to TLS1.2 can be resolved.
I have recently realised there is an option in the preferences which can fix the entire problem.
So for anyone who finds this bug looking for information then try the following. It resolved my issue with 'livemail' and many others with similar issues on other servers.

Using the correct original servre setting as per advised by users servers.

In Menu app icon > Options > General
Scroll forever to the bottom and click on 'Config Editor'
accept the risk
In search type: tls.version
look for this line : security.tls.version.min
Double click on line to open an edit window and enter the number 1
click on OK.
Exit window - top right x

This will set that preference back to the same level as used automatically in version 68*.