Closed
Bug 364180
Opened 19 years ago
Closed 18 years ago
Emails signed with S/MIME certificate when saved as draft
Categories
(Thunderbird :: Message Compose Window, defect)
Tracking
(Not tracked)
RESOLVED
DUPLICATE
of bug 287294
People
(Reporter: fishbert, Assigned: mscott)
Details
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Thunderbird 2.0b1 (Windows/20061206)
When composing an email message to be signed with an S/MIME certificate, the security device password request windows keeps popping up at regular intervals asking for the password to the security device. When canceled, an error message displays, informing the user that Thunderbird was unable to save a draft of the message.
Messages should not require security device access when being saved as drafts. Signing of an email message should only occur if and when the message is actually sent (or queued to send, as in offline mode).
Reproducible: Always
Steps to Reproduce:
1. Begin composing an email which is to be signed with an S/MIME certificate.
2. Take a little time composing the message.
Actual Results:
The security device password request window interrupts your composition process as a draft is being auto-saved.
Expected Results:
No interruption should occur, as a draft should be saved without requiring any certificate queries (i.e., without requiring a security device password prompt).
Comment 1•18 years ago
|
||
I will confirm this problem, since it is still listed as unconfirmed...
Updated•18 years ago
|
Status: UNCONFIRMED → RESOLVED
Closed: 18 years ago
Resolution: --- → DUPLICATE
Comment 3•18 years ago
|
||
We constantly separate the Signature functionality (providing absolute authenticity and in line with International Standards) without considering the encryption aspect. Functionally the two should not be seperated
This is a very nice fix around however the beauty if having Draft Messages Signed AND encrypted to self is not available if we do this.
In countless number of times any one in a .MIL or .GOV or .IT and many .COM industries is required to encrypt all messages either in draft or sent is Mandatory.
There are far too many stories of laptops being left at Airport Lounges with unencrypted/unsigned drafts and where encryption of the HDD has not been undertaken that have made front page stories, especially when they are left behind by ANY person that uses a Laptop and who work demand encryption of ALL Emails.
This is not a nice to have, feature.
Whilst you continue to ignore full S/MIME functionality your marketplace acceptance is insurmountably depleted.
In the above situation AS the message is mealy being saved to oneself AND S/MIME signing and subsequent encryption is required to either autosave or Save or Save As - all this is required is that the code be altered not to prompt for the master password. However upon retrieval of such a signed AND encrypted message the password MUST be requested.
This should NOT really be difficult code surely a few IF THEN statements could provide the above
Comment 4•18 years ago
|
||
Resources:
http://www.verisign.com/products-services/security-services/pki/index.html
http://iase.disa.mil/pki/dod-cp-v90-final-9-feb-05-signed.pdf
(Contact Author secure@aphofis.com if unable to view above)I will make it available. Scott
http://www.ietf.org/html.charters/pkix-charter.html
http://www.semper.org/sirene/outsideworld/standard.html
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0.pdf
http://www.oasis-open.org/committees/download.php/16788/wss-v1.1-spec-os-KerberosTokenProfile.pdf
http://java.sun.com/j2se/1.3/docs/guide/security/cert3.html
You need to log in
before you can comment on or make changes to this bug.
Description
•