There are password risk on current design
Curerntly, anybody could view my password by clicking on 'preference' - 'security' - 'password' - 'stored password'(I don't know its exact English name, as I'm using Chinese version) - 'view password', then all my passords were leaked. I do know that I could prevent them by defining a 'master password', but if the master password is set, I would be prompted to enter it every time I launch thunderbird, which is not what I want. I think it's better to add an option to allow users define defferent security levels: Level 1: password required when launch the client. This will prevent other people viewing your emails. Level 2: password requred before viewing stored passwords. This option allow users to view emails freely, which is convinent for me.
Chosen solution
Encryption requires a key. You master password is that key. Thunderbird does not store that key anywhere, so there is Zero chance of the encrypted data being reverse engineered as the encryption key is simply not present. This is also exactly how Firefox works.
Your suggested method would require the key to be stored somewhere so reverse engineering becomes a fairly simple process. Ask Microsoft how having a known key worked for Word document passwords up to about version 2003. They could be opened and the password bypassed in about 2 second on a 386 computer.
As to a password manager. Netscape built it in when they were writing code, long before the other specialist products that you mention were ever developed. Kwallet is KDE only. Not much use on Windows or a MAC Keyring is apparently the Gnome equivalent.
Mozilla runs on OSX, Linux and Windows. It has a password manager that works identically on all platforms. You Linux centric view of password management is not of any use to 80 or 90 percent of Thunderbird users.
These guys do not list Thunderbird or Firefox. http://www.lostpassword.com/recovery-options-basic.htm
But they sure list a lot of software that business would like to think was securing their data.
Read this answer in context 👍 1All Replies (10)
Security level one... Password required to start operating system. Problem with email in plain text, password in the password manager and all your document accessible solved in one step.
Security Level two Set a master password then your passwords are encrypted.
What I'm not satisfied is that setting a 'master password' will force me to enter that password everytime I launch Thunderbird, which is very inconvinent. In fact, I don't see any necessity to design a password manager in an email software. managing password is a dedicated job normally took care of by kwallet or key-ring, or something like that. And maintaining password is the deal between users and email service providers. An email client should just take and encrypt users' passwords, use those passwords to communicate with email servers, and never show them to human in plain text. Personal opinions, though.
Thunderbird is only a community supported project now so it probably will not get the enhancement you suggest.
Even the Mozilla Browser Firefox; which is fully supported; only uses a master password in a similar manner to T.bird, whereas the competing browser Google Chrome does not even bother with a master password, considering it an unnecessary feature that adds a false sense of security.
John99 said
Thunderbird is only a community supported project now so it probably will not get the enhancement you suggest. Even the Mozilla Browser Firefox; which is fully supported; only uses a master password in a similar manner to T.bird, whereas the competing browser Google Chrome does not even bother with a master password, considering it an unnecessary feature that adds a false sense of security.
You are right! Firefox also has an 'stored password' and password manager. But setting a master password in firefox won't force you to key in that password everytime you launch it, right? So, even though it is still an issue in firefox, but it's not that terrible. Why not act the same way like firefox - master password doesn't required during launch?
Oops, I just found that firefox will also prompt for that little password (you can deny it by click on 'Cancel', continue surfing websites, but still annoying)... So said. Maybe I should post this issue to the firefox forum/community
Chosen Solution
Encryption requires a key. You master password is that key. Thunderbird does not store that key anywhere, so there is Zero chance of the encrypted data being reverse engineered as the encryption key is simply not present. This is also exactly how Firefox works.
Your suggested method would require the key to be stored somewhere so reverse engineering becomes a fairly simple process. Ask Microsoft how having a known key worked for Word document passwords up to about version 2003. They could be opened and the password bypassed in about 2 second on a 386 computer.
As to a password manager. Netscape built it in when they were writing code, long before the other specialist products that you mention were ever developed. Kwallet is KDE only. Not much use on Windows or a MAC Keyring is apparently the Gnome equivalent.
Mozilla runs on OSX, Linux and Windows. It has a password manager that works identically on all platforms. You Linux centric view of password management is not of any use to 80 or 90 percent of Thunderbird users.
These guys do not list Thunderbird or Firefox. http://www.lostpassword.com/recovery-options-basic.htm
But they sure list a lot of software that business would like to think was securing their data.
Thanks for replying me so carefully. But I'm not talking about preventing someone cracking my passwords by reverse engineering. Since setting a master password force me to enter it again and again, I'm not going to do it this way. So I'd be posed to the risk of any guy come up with my computer, which I left unlocked (short leaving), could easily see all my passwords - no tool required. It's about the way people use thunderbird. I don't know how many people would set the master password, I bet there are not too much, many of them never know that if they don't set that little trick password, they are in risk. It is the responsibility of software designer to let every user know that there is a potential risk of password leak if they don't do something. You could do a simple survey, ask those people you know who use thunderbird (and firefox as well), see if they had set the master password. And ask if they would lock their computer everytime they leave it. FINAL WORDS: HAVING A PASSWORD MANAGER IS GOOD, DISPLAY IT IN PLAIN TEXT IS TERRIBLE!
Modified by victl
Even service provider themselves won't show users passwords in plain text to their loged-in users. In fact, showing password in plain text is a bad design in any software! I have never seen any software doing like this, except firefox and thunderbird! So far as I can remember (my macbook has broken, so I can't verify it), Keyring in Mac OS X won't show passwords in plain text to any user. It just encrypt them, and fill them automatically for user when needed (not in plain text either). Mac's Keyring is the best password manager I have ever met. Do I make sense to you? after such a long explaining.
Modified by victl
Use the password prote3ction of your operating system to secure data, use password encrypted screen saves for short departures from your desk.
I went through all this in Government IT 20 years ago. I heard all the same comments your making. Security is your concern, yet you want it without interruption or any change to your poor computing habits.
You make a choice to not use a master password. That is fine. It is your choice. I do not use it either But I don't ask for changes to the program based on my refusal to do so.
Security is important, but your barking up the wrong tree. That your passwords are visible to the duly authorized user of that PC is a good thing, not a security problem. Secure your account on the machine.
If you feel strongly enough file a request for enhancement in bugzilla. https://bugzilla.mozilla.org/ But do not expect them to be all that receptive.
well I just tried drag and drop and it appeared as an attachment with the name attached message.