1676617 - Add an option to automatically logout password protecting keys

Status: RESOLVED WONTFIX

(MailNews Core :: Security: OpenPGP, enhancement)

Description

[g.messineo]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0

Steps to reproduce:

I migrated my enigmail setup to OpenPgp. The migration was done succesfully and all my keys were imported in the new version of thunderbird

Actual results:

I have no more the possibility to protect my encrypted mail with a password DIFFERENT from thunderbird master password: once I am logged in to thunderbird, there is no way to make my encrypted mail not automatically decrypted and visible to anyone using my pc. I have to close Thunderbird

Expected results:

I expected to be able to set a passprhase for encrypted mail different from the thunderbird master password, so that my encrypted mails remain protected even if I am logged in to look at the other mail and I do not close Thunderbird every time I leave for a minute my pc.

Comment 1

[Thomas D. (:thomas8)]

I don't think this is feasible. Instead of closing TB, why can't you just lock your OS account when you walk away ? Win+L on Windows 10.
To achieve your purpose, Thunderbird would have to automatically hide decrypted messages currently shown on screen after a fixed period of time, which is still no guarantee that they remain unseen - what if the intruder comes one second after you left.
I don't think we'd want to complicate things even more when you can just lock your OS account.

Comment 2

[g.messineo]

This does not solve all my issues. If someone works on my pc and thunderbird is open for some purpose, this person can look in my encrypted mails anyway.
There was Master Password which used to give the possibility to lock at least thunderbird, but it does not work anymore.
The passphrase feature of enigmail was very useful in these cases.
Thank you anyway, I hope that some extension developer solves the issue, as in my case it is a big problem.

Comment 3

[g.messineo]

One more thing: enigmail gave the possibility to never save the password, preventing anyone except me to look into the encypted mails at any time.

Comment 4

[Magnus Melin [:mkmelin]]

Master password still exists and works.
But, like Thomas I'd recommend just using the OS lock when you're away from the computer. If you let other people have access to your computer, create own OS accounts for them - you can't really both have security and let people do whatever they feel like on that system.

Comment 5

[g.messineo]

The status of the bug I reported was changed to whiteboard: can you please tell me what this means?

Comment 6

[Thomas D. (:thomas8)]

Attachment: Screenshot: whiteboard entry `[wontfix?]` cleared

(In reply to g.messineo from comment #5)

The status of the bug I reported was changed to whiteboard: can you please tell me what this means?

I removed temporary flag [wontfix?] from whiteboard, which was used to mark this bug as a wontfix candidate. The whiteboard entry was no longer needed because in the meantime the bug was marked wontfix, which is the current bug status, and it hasn't changed.