458552 - Login exposes email before logging in

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[Edward Lipchus]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3
Build Identifier: 2.0.0.17 (20080914)

When starting Thunderbird, the login screen comes up. However, my email folders and the headings from my most recent emails are visible behind the login window. Here's the worst part - if I cancel the login screen (red X at top right of login window), the user has complete access to all my stored emails! omg!

Reproducible: Always

Steps to Reproduce:
1. Launch Thunderbird
2. Click red X at top right of login window without logging in.
3. Observe emails and folders.
4. Double-click any email - it opens up.
Actual Results:  
Just what I said.

Expected Results:  
Just what I said

The login window should appear without the Thunderbird application open behind it. A Thunderbird splash screen would be ok.
Users should not be able to see email folders, headers, or actual emails without being successfully signed in.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Users do not login to Thunderbird itself.  They login to the email servers
to which Thunderbird connects.  The login is necessary to connect to the 
servers, but not necessary to access locally stored files.  

This is hardly news.  It's been this way for, oh, about 10 years now.

Comment 2

[:Gavin Sharp [email: [e-mail]]]

Indeed, Nelson is correct. The master password only protects saved login information for the mail servers you use. It does not protect using Thunderbird itself, including accessing already downloaded email.

Bug 231261 covers implementing a true "master password" that protects not only your credentials, but also access to any part of the Thunderbird profile.

Comment 3

[Daniel Veditz [:dveditz]]

If you're not using encrypted mail (and who does?) then your mail is sitting on your disk in a text file that anyone could read. Is your computer secure? If so then this doesn't matter. Is it a shared computer? Then you should use the OS password features to separate user accounts and then your locally saved mail is secure (except from the admin, who could install spy software anyway if you don't trust them).

I believe the Thunderbird default is to fetch mail when you start it up. You can adjust your account settings so it doesn't try to get mail until you hit the "Get Mail" button, and then you'll see that the password prompt does not come up until you make Thunderbird talk to the server.

Comment 4

[Edward Lipchus]

Since this is a "functions as designed" situation, you can close it as a bug. I'd love to make it an RFE, however. Yes, in a corporate world I would be more scrupulous about requiring other people to log in as themselves, but in my home that's more difficult. Even in a business environment though, both Lotus Notes and MS Outlook don't show anything until you have successfully logged on. That would be my RFE - that T'Bird open to a connect page (or default to a specific connection) and then give a login window before it displays any of your existing email.

Thanks for looking into this.

- Ed Lipchus