451685 - PASSSWORD SECURITY

Status: VERIFIED DUPLICATE of bug 16489

(Thunderbird :: Security, defect)

Description

[[e-mail]]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
Build Identifier: version 2.0.0.14 (20080421

Whith a general password in Thundirbird, ANYONE CAN OPEN this softwarae WHITHOUT THE PASSWORD !!!!

1 if there is an copy of an e-mail (.eml) on the destop or in a folder !

2) If there is a problem whiyth internet connection (non connection for ecemple)

THE PASWORD IS NOT A VERY a GOD PROTECTION for THE PRIVACY !!!
Can you make some test aBout this problem ?
Thank you,
Pat
Best Regards

Reproducible: Always

Steps to Reproduce:
1. créate a general password in thunderbird
2. make a copy of a mais on your desktop (in .eml)
3. close thunderbird
4) opent the mail (.eml) on your desktop
5 and thunderbir in opening WHITHOUT the pzssworf !
___
1) Close tue Internet connection
2) Open tHendirbird
3 and thunderbir in opening WHITHOUT the pzssworf !

That's all, but it' a ery god software !
Actual Results:  
I have no find the solution !

Excuse me for my bad englsish... I'm french.

Expected Results:  
It's  all time the same bug

no other information because I'm not a hreat specialist

Comment 1

[[e-mail]]

I hope that you can find the solution, can uot telle me the result of your test, Thank'.

Comment 2

[Samuel Sidler (old account; do not CC)]

Not security sensitive.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

What would you like to do here? I don't think you can use Thunderbird to password-lock your existing local emails.

Comment 4

[Samuel Sidler (old account; do not CC)]

Really, if I'm understanding the report correctly, the only real way to secure your email is by encrypting them all, individually using something like Enigmail (extension) and OpenPGP. I think most clients do this.

Comment 5

[Mark Banner (:standard8)]

I think patoti has misunderstood the implementation of the Master Password. The master password is intended to protect your passwords, not protect your mail.

Comment 6

[Matthias Versen [:Matti]]

As Mark already told you, the master passwords encrypts the saved password for the Account on the Mailservers.
The stored emails are of course not proteced, they are stored as text files and can be read with notepad if you locate the files on your hdd.
Your Windows Account protects your whole Account including your mails.

marking as dupe of bug 16489

Comment 7

[Wayne Mery (:wsmwk)]

it's not useful protection, but I would add that .eml files won't display in thunderbird unless one signs in with the master password. (at least, that's what I found)