585696 - Allowed to read all mail without ever entering a password

Status: RESOLVED DUPLICATE of bug 318697

(Thunderbird :: Security, defect)

Description

[Ryan Nail]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.19) Gecko/2010031422 Firefox/3.0.19 ( .NET CLR 3.5.30729; .NET4.0E)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.8) Gecko/20100802 Thunderbird/3.1.2

Whenever I open Mozilla Thunderbird, it automatically opens to my inbox or last looked at  folder and asks for a password. If I click cancel, I am still able to click and read each e-mail that has previously been read. Very important e-mails are stored here and can be read by anyone without my password.

Reproducible: Always

Steps to Reproduce:
1.Open Thunderbird
2.Click cancel when prompted for password
3.Click an e-mail located in that folder or click on other folders and repeat
Actual Results:  
I was able to read any e-mail in any folder that was on the server without entering a password.

Expected Results:  
It should continue to prompt for password before the message can be opened and read.

Comment 1

[Mark Banner (:standard8)]

Passwords are only designed to protect your access to the server; master passwords are only designed to protect access to your stored passwords and hence the servers.

We do not attempt to protect your mail because they could still be read via the stored files - you should use operating system protection to prevent access to Thunderbird and its data (i.e. user acounts).