375355 - can still read mail without a password when password to access app is enabled

Status: RESOLVED DUPLICATE of bug 318697

(Thunderbird :: Security, defect)

Description

[lucas w]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3
Build Identifier: 1.5.0.21 (20070221)

when the password screen pops up for you to enter the program you can just keep clicking cancel and it will go away then you can still read the mail in the mailboxes (can't retrieve mail but can still read old mail).  a useless feature unless you can prevent access like that too.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Samuel Sidler (old account; do not CC)]

I could be wrong, but I'm fairly sure the password that appears is for logging into your email account. It's a password required by your server, not by your local machine. If you don't want someone to be able to read your emails, the best thing you can do is keep your messages on the server and not allow them to be downloaded, preferably using an IMAP account and making sure you don't have any messages available whilst offline. It's the job of the OS to keep your user account protected.

In any case, this isn't a security sensitive bug, but I'll let a Thunderbird triager look it over.

Comment 2

[Carsten Book [:Tomcat]]

lucas: i agree with sam, please see http://kb.mozillazine.org/Protecting_the_contents_of_the_profile_-_mail 

Comment 3

[David :Bienvenu]

yes, agreed.

Comment 4

[Daniel Veditz [:dveditz]]

See bug 16489, bug 35308 and many others