1928232 - Missing Windows account password request in "Export for Mobile" feature

Status: VERIFIED FIXED

(Thunderbird :: Account Manager, enhancement)

Description

[Alex Ihrig [:Thunderbird_Mail_DE]]

This bug is related to the new feature "Export for Mobile". There are security concerns about this new feature:

On the one hand Thunderbird asks for the master password, but on the other hand, it does not ask for the Windows user account password, if no master password is set. This is inconsistent and a "negligent" omission compared to just displaying the saved passwords, where the Windows password is asked. This should also be handled in the same way for the export feature.

I'm not sure, but as a precaution I mark this as security risk for now.

Comment 1

[Alex Ihrig [:Thunderbird_Mail_DE]]

When exporting account data, either the main password or the Windows account password should be requested (again). You should not be satisfied with the fact that these were previously requested when starting the Thunderbird session.

Strictly speaking, also the user names (not just the passwords) of the accounts are private data that may only be transferred via QR code after the main password or Windows account password has been re-entered.

Comment 2

[Magnus Melin [:mkmelin]]

On this note: OS-reauthentication (asking windows password) is not implemented at all on linux unfortunately.

Maybe passwords shouldn't be transferred at all.
(I don't think usernames are private in this context, they are not super sensitive in them selves.)

Comment 3

[Alex Ihrig [:Thunderbird_Mail_DE]]

The usernames are only a secondary aspect that I became aware of. The main problem that bothers people is the lack of a main password or alternatively a user account password.

The usernames are often based on the email address and are therefore hardly private. But some mail servers actually use completely freely defined and therefore actually private usernames.

Comment 4

[Toby Pilling [:tobyp]]

Thanks very much for this Alex.

We'll patch this ASAP but as we have a similar insecure report in bug 1928317 and the functionality is in plain sight, I'll also de-secure this so that we can get things out to users quicker.

FYI, in case you are an administrator and wanting to disable this for your users, you can also set this line in Thunderbird.cfg:
lockPref(“pref.privacy.disable_button.view_passwords”, true);

Comment 5

[Alex Ihrig [:Thunderbird_Mail_DE]]

(In reply to Toby Pilling [:tobyp] from comment #4)

FYI, in case you are an administrator and wanting to disable this for your users, you can also set this line in Thunderbird.cfg:
lockPref(“pref.privacy.disable_button.view_passwords”, true);

Does this work for account export, too? It sound as this would only disable the password view button in saved passwords dialog.

(In reply to Magnus Melin [:mkmelin] from comment #2)

On this note: OS-reauthentication (asking windows password) is not implemented at all on linux unfortunately.

If possible, this should still be done.

Maybe passwords shouldn't be transferred at all.

This would be a lack of comfort. IMHO to request the main password / user account password would be the best compromise.

Comment 6

[Martin Giger [:freaktechnik]]

Attachment: Bug 1928232 - Apply same rules as for viewing passwords to export. r=tobyp,mkmelin

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/cfa98175cec5
Apply same rules as for viewing passwords to export. r=tobyp

Comment 8

[Martin Giger [:freaktechnik]]

Attachment: Bug 1928232 - [ESR 128] Apply same rules as for viewing passwords to export. r=tobyp

Comment 9

[Martin Giger [:freaktechnik]]

Comment on attachment 9434580 [details]
Bug 1928232 - Apply same rules as for viewing passwords to export. r=tobyp,mkmelin

[Approval Request Comment]
Regression caused by (bug #): -
User impact if declined: Can show passwords (although in machine-readable and not human readable form) in UI with lower requirements.
Testing completed (on c-c, etc.): Tested on c-c, includes extended automated test coverage.
Risk to taking this patch (and alternatives if risky): Worst case users can't export passwords via QR code. The alternative would be to disable exporting passwords by QR code altogether.

[Approval Request Comment]
Regression caused by (bug #):
User impact if declined:
Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky):

Comment 10

[Martin Giger [:freaktechnik]]

Comment on attachment 9434713 [details]
Bug 1928232 - [ESR 128] Apply same rules as for viewing passwords to export. r=tobyp

(putting these requests in already because I'm off next week)

This patch was made for ESR 128, but also applies to comm-release.

[Approval Request Comment]
Regression caused by (bug #): -
User impact if declined: Can show passwords (although in machine-readable and not human readable form) in UI with lower requirements.
Testing completed (on c-c, etc.): Tested on c-c, includes extended automated test coverage.
Risk to taking this patch (and alternatives if risky): Worst case users can't export passwords via QR code. The alternative would be to disable exporting passwords by QR code altogether.

Comment 11

[Corey Bryant]

Comment on attachment 9434580 [details]
Bug 1928232 - Apply same rules as for viewing passwords to export. r=tobyp,mkmelin

[Triage Comment]
Approved for beta

Comment 12

[Corey Bryant]

Comment on attachment 9434713 [details]
Bug 1928232 - [ESR 128] Apply same rules as for viewing passwords to export. r=tobyp

[Triage Comment]
Approved for esr128

[Triage Comment]
Approved for release

Comment 13

[Daniel Darnell [:dandarnell]]

Thunderbird 133.0b2:
https://hg.mozilla.org/releases/comm-beta/rev/dcd6a226c88e

Comment 14

[Daniel Darnell [:dandarnell]]

Thunderbird 128.4.2esr:
https://hg.mozilla.org/releases/comm-esr128/rev/8b81bb45fc5f

Comment 15

[Vlad Lucaci, Thunderbird QA (:vlucaci)]

Hello,

Confirming this issue as verified fixed with 133.0b2(20241105205547) and 128.4.2esr(20241105224936) using macOS 14, Ubuntu 22 and Windows 10.

Passwords are now excluded from the Export process.

Comment 16

[Daniel Darnell [:dandarnell]]

Thunderbird 132.0.1:
https://hg.mozilla.org/releases/comm-release/rev/6c162e9b7f26