When you install an extension into Thunderbird, you may be presented with a message similar to this one:
This is an extension asking your permission to tap into Thunderbird’s inner framework (via APIs) to alter its behavior. These APIs might ask to access your configured mail accounts, your messages, your contacts and your calendar data or alter settings in your profile. If you don't see one of these messages that means the extension won't try to access any of your data or change any of your settings.
This article provides details about each of the messages, to help you understand the practical impact on your data and the behaviour of Thunderbird.
(You are also encouraged to check out Mozilla’s Tips for assessing the safety of an extension for further guidance on evaluating extensions. It refers to the Firefox add-on portal at addons.mozilla.org, but the article applies to addons.thunderbird.net as well)
Table of Contents
- 1 Have full, unrestricted access to Thunderbird, and your computer
- 2 See your mail accounts and their folders
- 3 Create, rename, or delete your mail account folders
- 4 Read and modify your address books and contacts
- 5 Read and modify your email messages as you compose and send them
- 6 Read your email messages and mark or tag them
- 7 Read and modify your email messages as they are displayed to you
- 8 Move, copy, or delete your email messages
- 9 Access your data for all websites
- 10 Access your data for sites in the “named” domain
- 11 Access your data in # other domains
- 12 Access your data for “named site”
- 13 Access your data on # other sites
- 14 Exchange messages with programs other than Thunderbird
- 15 Read and modify profile settings
- 16 Clear recent browsing history, cookies, and related data
- 17 Get data from the clipboard
- 18 Input data to the clipboard
- 19 Access IP address and hostname information
- 20 Download files and read and modify Thunderbird’s download history
- 21 Open files downloaded to your computer
- 22 Access your location
- 23 Monitor extension usage and manage themes
- 24 Display notifications to you
- 25 Provide cryptographic authentication services
- 26 Read and modify privacy settings
- 27 Control Thunderbird’s proxy settings
- 28 Access browser tabs
- 29 Store unlimited amount of client-side data
- 30 Access browser activity during navigation
Have full, unrestricted access to Thunderbird, and your computer
The extension is using an older technology and has full access to Thunderbird’s internal APIs and does not need to request individual permissions. Up to Thunderbird 68 almost every add-on had this unrestricted access without specifically asking for it. Add-ons request this permission, as long as the new permission based API system does not yet offer the functionality they need.
Extensions requesting this permission might:
- Change every aspect of Thunderbird’s user interface
- Read and modify all your data (messages, contacts, calendars, web content and passwords)
- Read, modify and execute any file on your computer
Add-ons published to addons.thunderbird.net (ATN) are subject to human review. If you install extensions from other locations, you have to be sure that you can trust the source.
See your mail accounts and their folders
This extension can list all mail accounts configured in your Thunderbird profile and all of their folders.
Extensions requesting this permission might:
- Add colored elements to the message compose window as a visual indication of the used account.
Create, rename, or delete your mail account folders
This extension can add, rename or delete a folder within one of your configured mail accounts.
Extensions requesting this permission might:
- Offer ways to help users organizing their messages by automatically managing their folders
Read and modify your address books and contacts
This extension can read and modify all address books configured in your Thunderbird profile and all of their contacts.
Extensions requesting this permission might:
- Offer ways to synchronize address books and contacts with remote servers
Read and modify your email messages as you compose and send them
This extension has access to the content of the message compose window while a new message is being created and can modify its appearance and all related information including the typed message, the recipient addresses, the subject and the attachments.
Extensions requesting this permission might:
- Remove all images from the reply body
- Offer ways to insert predefined blocks of text
Read your email messages and mark or tag them
This extension can read all messages stored in Thunderbird. This also includes any related information like sender, recipient and attachments.
Extensions requesting this permission might:
- Evaluate sender information
- Offer ways to store additional notes per message
Read and modify your email messages as they are displayed to you
This extension can modify the content and the appearance of a message as it is displayed to you. The message is not permanently modified.
Extensions requesting this permission might:
- Add thumbnails into the message identifying the sender
- Change links in the message to be pre-processed by a proxy server
Move, copy, or delete your email messages
This extension can delete your messages. If this extension also has permission to see your mail accounts and their folders, it can also move or copy your messages to other folders.
Extensions requesting this permission might:
- Offer ways to help users organizing their messages by moving them into folders
Access your data for all websites
The extension can read the content of any web page you visit as well as data you enter into those web pages, such as usernames and passwords.
Extensions requesting this permission might:
- Read product and price information from a page to help find you the best price on items you are shopping for
- Offer a password manager that reads and writes details of your username and password
Access your data for sites in the “named” domain
The extension could read the content of web pages you visit in the specified domain, as well as data you enter into those web pages, such as usernames and passwords.
Extensions requesting this permission might:
- Update the look of some or all pages within the domain
- Block content, such as advertising or content using certain tags, from a domain’s content feed
Access your data in # other domains
Used in conjunction with the named domain message (above) when the extension is requesting access to five or more domains; the first three are listed and the other domain requests counted.
Access your data for “named site”
The extension could read the content of any web pages you visit at the specified website, as well as any data you enter into those web pages, such as usernames and passwords.
Extensions requesting this permission might:
- Update the look of some or all pages within the website
- Block content, such as advertising or content labeled with certain tags
Access your data on # other sites
Used in conjunction with the named website message (above) when the extension is requesting access to five or more websites—the first three are listed and the other website requests counted.
Exchange messages with programs other than Thunderbird
The extension could send messages to and receive them from a complementary native app on your computer.
The complementary app needs to be installed on your computer independently of the extension. This usually happens in one of two ways:
- The extension will provide a guide to the steps you should follow to install the app
- You would have installed an app that then suggests you install an extension in Thunderbird
Please note that the Thunderbird Team has not vetted or reviewed the complementary app. You should approach the installation of the complementary app with the same caution you would apply when installing any third party software from the internet.
Extensions requesting this permission might:
- Use a complementary app to communicate with hardware attached to your computer
- Store usernames and passwords using a secure method not available to Thunderbird
- Perform extensive computations in a complimentary app
Read and modify profile settings
The extension could do one or more of the following:
- Enable or disable the display of popups
- Enable or disable the caching of web pages
- Disable notifications
- Prompt for all new requests to display notifications
- Read the URL used in new tabs
- Determine how the Thunderbird displays animated images—plays as normal, once, or not at all
Clear recent browsing history, cookies, and related data
Extensions requesting this permission might offer enhanced features to clean up your browsing history.
The extension could clear any or all of:
- Browser cache
- Cookies
- Downloads
- History
- Local storage
- Saved form data
- Saved passwords
Get data from the clipboard
The extension could retrieve data from the clipboard: The equivalent of "paste".
Extensions requesting this permission might:
- Let you submit copied text into a translation tool
- Use a copied image to perform a lookup in a visual search engine
Input data to the clipboard
The extension could write data to the clipboard: The equivalent of “copy” or “cut”.
Extensions requesting this permission might add content to the clipboard so you can use it elsewhere in Thunderbird or on your computer.
Access IP address and hostname information
When you visit a website, you generally see or entered the hostname (e.g. amazon.com). A service called DNS transforms the hostname into an IP address, a number that identifies the device connecting to the network. This is also true for devices in your local work or home network. This permission enables the extension to transform hostnames into IP addresses.
Extensions requesting this permission might:
- Use information about your current location
- Determine if you are on a local network, and gather information about it
Download files and read and modify Thunderbird’s download history
The extension could save a file from the web or one created in the extension using Thunderbird’s download manager. The extension could also access and update details of downloaded files stored in the download manager.
Note: The extension has to obey the settings in the download manager, putting you in control of where the files are saved.
Extensions requesting this permission might:
- Save data from the extension to your computer (extensions are not allowed to write directly to your computer’s file system)
- Save files from a website or remote server
- Provide a feature to manage download history
Open files downloaded to your computer
The extension could request that the application on your computer that handles files of a specific type opens a downloaded file. For example, if you have Microsoft Word installed on your computer, the extension could request it to open file with ".docx".
Extensions requesting this permission might:
- Open audio files in your computer’s music player
- Open documents, images, or other files in an editor
Access your location
The extension could obtain your location from your computer, GPS, the location associated with your IP address, or some other method.
Extensions requesting this permission might:
- Provide information about your current location
- Record your location with data maintained in the extension
Monitor extension usage and manage themes
The extension could:
- Get information about installed add-ons (extensions and themes)
- Enable and disable themes
- Uninstall itself
- Get notifications of add-ons being installed, uninstalled, enabled, or disabled
Extensions requesting this permission might:
- Monitor add-on installation to check for any potential conflicts
- Change or manage themes
Display notifications to you
The extension could issue notifications through the standard notifications system offered by your computer’s operating systems.
Extensions requesting this permission might:
- Alert you to the completion of background or long-running tasks in the extension
- Aggregate messages from one or more web services
Provide cryptographic authentication services
The extension could access software on your computer for generating and validating security keys and certificates using the PKCS #11 standard. (Note the extension cannot install the PKCS #11 software on your computer; you will be prompted to install the software separately.)
Extensions requesting this permission might:
- Offer features to use securely encrypted single sign-on mechanisms
- Provide a smartcard reader
Read and modify privacy settings
The extension could change privacy related settings controlling:
- Network behavior
- Whether passwords are stored in Thunderbird’s password manager
- The way Thunderbird interacts with websites
Extensions requesting this permission might:
- Disable Thunderbird’s storage of passwords as part of an enhanced password manager
- Help protect your privacy by managing the information made available in real-time chat and video applications
- Offer additional tracking protection features
Control Thunderbird’s proxy settings
The extension could direct some or all of Thunderbird’s web traffic to another computer (a proxy) on the internet.
Extensions requesting this permission might:
- Block access to certain websites or domains
- Provide access to certain websites and domains through proxy servers, for example, to access services which might otherwise be blocked by geography
Access browser tabs
The extension could obtain the URL, title, and icon from any tab.
Extensions requesting this permission might:
- Order and group tabs
- Move tabs between windows
- Provide an alternative way of listing tabs
Store unlimited amount of client-side data
The extension could store an unlimited amount of data using Thunderbird’s data storage features.
Extensions requesting this permission might:
- Store large files, such as images, locally in Thunderbird
- Offer an extensive local database of information
Access browser activity during navigation
The extension could listen for the steps Thunderbird takes to navigate from a link to another page. The extension could then provide new features for the content on the page.
Extensions requesting this permission might:
- Detect when streamed videos are about to play and provide a download feature
- Look for and prevent ad pop-ups from opening