Master Password should protect / prevent access to mail when starting thunderbird
Categories
(Thunderbird :: Security, defect)
Tracking
(Not tracked)
People
(Reporter: 4tech, Unassigned)
Details
When you start Thunderbird 115.3.1 or 115.8.4 instead of entering a master password you can press "cancel" repeatedly and not only the "Password Required" dialog goes away but the entire GUI is loaded and you gain full access to the emails already present in your mailbox(es). Totally NOT secure.
Tested on Windows 10 and Windows 11.
Name Thunderbird
Version 115.8.0
Build ID 20240216174500
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Thunderbird/115.8.0
OS Windows_NT 10.0 19045
See below older bug 318697 closed but NOT resolved.
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8) Gecko/20051111 Firefox/1.5
When starting thunderbird my password for retrieving new mail is asked. When I push the 'cancel'-button I (and everyone else) can acces and read my already downloaded e-mails. The program should NOT start up if this password is incorrect !!
Reproducible: Always
Actual Results:
When cancelling the program starts up and I (and everyone else) can acces already downloaded e-mails.
Expected Results:
Program should not start up.
|
||
Comment 1•1 year ago
|
||
It's only designed to protect access to passwords, not local cache.
Description
•