Master password is enabled but it NOT required when starting Thunderbird

RESOLVED INVALID

Status

Thunderbird
Security
--
major
RESOLVED INVALID
8 years ago
8 years ago

People

(Reporter: Patrick M. Ryan, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

8 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.8) Gecko/20100722 (CK-IBM) Firefox/3.6.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.8) Gecko/20100802 Lightning/1.0b2 Thunderbird/3.1.2

  I have enabled the master password because I have several personal certificates in my configuration.  Prior to this build, I would be prompted for the master password as soon as I started Thunderbird.  After upgrading today, I am no longer prompted for the master password.  I can see that "use master password" is still enabled.  I can view my certificates even though I did not enter the master password.

Reproducible: Always

Steps to Reproduce:
1. enable master password
2. start tbird
3. no prompt for master password

Comment 1

8 years ago
The master password isn't used to protect your mail or your certificates. It's used to protect the password itself, which you need to download or send mail. You can even press cancel, and still read your mail that was already downloaded. There are bug asking to change this, but they would require that all mails were encrypted too, since you can also read the mail-file directly.

The initial query when you start up, even when you don't download your mail, was actually a bug : bug 526820.
(Reporter)

Comment 2

8 years ago
OK.  Thanks for the clarification.  I will close this bug.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.