Thunderbird Support Forum

April 15, 2024 Thunderbird is Insecure There is missing functionality issues

1. How to Disable the "SHOW PASSWORD" Button in Security Settings 2. Either implement with a Password Password option, only to show the Passwords or 3. Allow the ability to Disable the Button

back in 1916-18 the ability to disable the "SHOW PASSWORD" Button worked with with a variation of the following at that time user_pref("pref.privacy.disable_button.view_passwords", true); I believe I created and used chrome.css or chrome.js

At some point this functionality ceased to work.

Now, I have scoured the Net to figure out a Solution simply setting the value to True, gets reset by Thunderbird, TB does not save it. it always reverts back to False and the button remains available and does not disable

I have tried everything, adding it in user.js, settings.js, userChrome.js I put it in every directory, nothing seems to work

Do I have to Lock it? - How? confusing and disappointing.

Please provide a simple step by step Solution to the problem

Thank you

Hello, I got a tale of two computers with Thunderbird on both. First, I will start with my HP Laptop, its my primary computer due to its speed. I went to check my emails this morning. I double click on the TBird icon on my desktop. It does not open. Waited a few seconds, tried again and again. Finally, a folder containing pictures opened up. Then, I went to open FireFox, and that same folder with pictures opened. I tried this like five times and the same thing happened. Then I got to thinkin, when I went to shut it down the other day, it said "update and shut down", so I did. Now that I remembered the update, I decided to go back in time to when the laptop was running real good. So I did that recovery, in doing so, it wiped out some of the applications I had on my computer, such as FoxFire, Thunderbird, Adobe, HP printer, CCleaner, and probably others that I seldom used. Somehow, I got to the point where I reinstalled Thunderbird. The only thing is, it would not let me in. When double clicking on the icon, it took me to a page that just wanted my name, email address and password. I enter the info, that page stayed open and added a few more items to the page, such as IMAP and POP3 stuff. IMAP was already selected by Tbird. I then had the option to click "done" . In doing that, it said "Unable to log into server. Probably wrong configuration, username or password" So there's that. Cannot even see the email program. Second part of the mystery, I have an old Gateway desktop. Its slower than slow. I only use it in emergencies, as the above scenario. I fire it up, wait about 5 minutes before I open Thunderbird on that. Guess what, it wants a password. Whats different about this deal is that the email opens, and I can see all my previous emails, but cannot receive or send. I have no Idea whats going on, unless its my deceased wife coming back to haunt me...I don't know.

Hi, I am not sure how it happened, I am now in a position where I can't use my Thunderbird properly. Every time I open TB, it asks for "please enter your Primary Password" which I don't have/deleted? If a try to remove the tick from "Use a Primary Password" it opens a box requesting my Current Password, I have tried the last one and the one before, none are accepted. When I search in Saved logins, it seems to me to be empty. in short I seem to need a current password to change my password. It is a vicious loop. Can any one help sort this out, Please Thank you from Ilio Pieroni

I wrote an email without putting in anyone for the 'TO:' or 'CC:' fields. The BCC: field only had my own email address in it.

I accidentally sent this email before I had sorted out the TO: and CC: fields properly.

In my sent email and it had 'undisclosed-recipients' in the To: field.

I found this disconcerting, since I wasn't SURE if I hadn't put anything in the CC: or TO: fields. I worried I may have sent a rough, poorly worded email to someone and that could backfilre.

Am I right that whenever 'undisclosed-recipients' is shown in the To: field and I sent the email, I can check in that sent email who was in the BCC: field and that should re-assure me who had actually recieved a copy of that email.

Clarity in this area would be VERY helpful.

Regards

   Mark

I sent an email with multiple BCCs and no CCs or TOs, I put myself as one of the BCCs.

I did not receive it and I do not think anybody else did as well since I asked a few people.

The email is in the sent folder. I tried forwarding the email from my sent folder to myself as CC, and that worked. I also tried fowarding as BCC, and that worked.

So what is going on? Is BCC working? How can I know for certain? Do I need to foward the email as BCCs to all my BCCs to get this to work?

Thanks for your help.

R

Gmail is going to require OAuth 2.0 sign-in SFAIK, that means I will no longer be able to access gmail with Thunderbird. Are there plans for Thunderbird to meet the OAuth 2.0 requirement?

I have upgraded to the Microsoft 365 Business Professional email service which should allow me to continue with Thunderbird, now that basic authentication is no longer supported.

I have enabled Exchange settings. Also, POP/IMAP and SMTP are authorized in the MS 365 account, and those setting are correct in T-Bird. From within Thunderbird, a login screen for the MS 365 email account is generated when T-Bird attempts to log in to the server, but the log in just takes me to the server page in the browser.

This help article https://support.mozilla.org/en-US/kb/microsoft-oauth-authentication-and-thunderbird-202 advises that Thunderbird may need to be authorized. I followed the link, but was not able to make it work.

Given the following provided link, what is to be used for {tenant-id} ? https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id=9e5f94bc-e8a4-4e73-b8be-63364c29d753

Any other advice? Thank you very much!

Network Solutions upgraded their email, and I multiply-checked all my settings in Thunderbird (102.3.2) and can retrieve mail but the outgoing mail hangs and time out with an error. I just discovered it's not my settings, but there's no password listed for the default outgoing SMTP server (my own domain). (I have 2 email accounts, and listed in the "Saved Passwords" are 2 passwords for incoming IMAP plus one the other account outgoing SMTP, 3 total.)

Is there any way to add a password without deleting the default server and then adding it back in, or some other solution?

Thanks

Hello, I received a Yubikey 5 and all is working fine using GPG with it, except integration with Thunderbird on Windows.

I followed this guide: https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards including 64 windows section

I was able to successfully send mail to myself, but then thunderbird failed at decrypting this message: Thunderbird is indicating that key is not available and I see no prompt from gpg-agent. Key is correctly declared as GPG external.

If I try to decrypt tis email by storing it on file and using gpg in command line, it works fine: agent is asking for Yubikey PIN and gpg is decrypting the message. But this is an awful workaround, not user friendly at all.

I also did sanity check by sending to myself a message encrypted with a key generated by Thunderbird: all is working fine, the message is decrypted within Thunderbird.

=> How do you make Thunderbird decrypt message encrypted with key stored in Yubikey? How do you make the gpg-agent called by thunderbird?

I received the following from my e-mail provider, and as a total dumbo about this, want to ask if I need to do anything about this in Thunderbird (Linux). As far as I can see, my e-mail account in Thunderbird is set to POP3, encrypted using SSL/TLs, normal password - can anyone tell me if this is OK - Thanks.

Quote: "We are contacting you because one or more of your devices or programs uses the TLS 1.0 and/or TLS 1.1 encryption protocols to connect to our mail.com email servers, or is using an unencrypted connection. This involves either access via SMTP (sending emails) or retrieval via POP3/IMAP (receiving emails).

Unfortunately, the TLS 1.0 and TLS 1.1 encryption protocols are outdated and no longer meet current security standards. To protect your email communications, soon we will no longer allow access to our mail.com servers with these outdated protocols. Unencrypted access will also no longer be possible.

After the protocols have been deactivated, the transfer of emails between your affected device or program and our mail.com servers will no longer work; i.e. no emails will be transmitted to or from your mail.com email account using TLS 1.0 and TLS 1.1. Furthermore, unencrypted SMTP/IMAP/POP3 connections will no longer function. In other words, as of Oct. 5, 2022, it will only be possible to connect if TLS 1.2 or TLS 1.3 encryption is in place." Unquote

Hi

I'm trying to set up another email account but the Confirm Security Exception dialogue is preventing it. The exception is already stored but still keeps asking and when I reconfirm the dialogue flashes off/on and doesn't not disappear preventing the set up of the account. I have other emails from the same host and have not had this issue before. Anything I maybe doing wrong or bug? I've added a screenshot.

Many thanks Alan

Hi,

I used to use Thunderbird to access Gmail, Yahoo mail and normal email account (all POP3).

I have updated (not reinstall) Thunderbird to the latest version since Gmail disabled non secure apps access.

I have changed the Authentication to OAuth by follow the instruction from your page, but the system keep asking me to login (I have grant access in Gmail).

This happens not only Gmail as well as my Yahoo mail and normal POP3 account. I am sure the password is correct and still cannot get my emails from all of my accounts.

I also notice the token/password has not been saved to the system in Saved Password session. ( I have tried to run as administrator but still doesn't work.)

What have I missed? Can still using POP3 method to get email if problem solved?

My current system is Win7 with Thunderbird 32bit installed.

Thanks!!

Hello,

I am using the latest stable release of Thunderbird client on Windows 11 and just today it's been asking me multiple times for a password to my Outlook account. I have kept adding a one time app password through the official Microsoft website under account management but it's been asking a few times that it needs a password.

Do you know if there's been any outages to the Microsoft servers or what this issue could be related to? Is there a way I can send any logs directly to you that might help find the issue?

Thank you for your time.

Outgoing email includes the user-agent header. I would like to disable or modify the string for better security.

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.8.0

Thanks...

I've been using Outlook Express (from XP) for years, even into the Windows 10 era with a patched version of XP. Since GMail will no longer support it after May 2022 I decided to migrate to Thunderbird Portable.

Since 91.8.1 doesn't import from Outlook Express, I first used Thunderbird Portable 52.9.1 x86 (last version that supports XP) to import mails, accounts and whatever else it imports. I then set up a Primary Password, and painstakingly manually added all rules from Outlook Express to Thunderbird's "filters". After everything was up and running, I upgraded to Thunderbird Portable 91.8.1 x86.

For some reason, when I try to login to any GMail account, after the login, pass, allow Thunderbird as email client, a popup window appears asking me to "Change Password", but whatever password I put, it always says "Unable to change password". If I go to "Privacy & Security", "Use a Primary Password" is disabled, and if I check it, it asks me to enter and re-enter a new password, but it also says "Unable to change Primary Password".

II tried both commands listed in the link below, both seem to work by pressing the Reset button, but the error console seems to output a uncaught exception. https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-master-password#w_resetting-your-master-password-if-you-have-forgotten-it

Any more suggestions?

Hello,

All of a sudden, this morning, my Thunderbird (102.12.0) will not sync my Office365 account's inbox via IMAP. I get the error message that

The current command did not succeed. The mail server for account [my university account] responded: User is authenticated but not connected.

A couple of seconds later, the above message is replaced by:

Server outlook.office365.com has disconnected. The server may have gone down or there may be a network problem.

The problem occurs on my laptop and on my desktop. I am sure all my settings are correct. I have read the entire thread here: https://answers.microsoft.com/en-us/outlook_com/forum/all/thunderbird-imap-responded-user-is-authenticated/062a82f6-e678-4462-88b7-dd6cc318386f

I have disabled IPV6 as instructed in the preferred answer: advanced config > network.dns.disableIPv6 = true.

I have also added network.dns.ipv4OnlyDomains = office365.com (I also tried outlook.office365.com).

I am using Kaspersky One antivirus. When I installed it, I had to add Outlook in the trusted addresses, as it wouldn't let me send email, but after I did, Thunderbird was again working as expected (this was two months ago). I am adding this detail just in case it is somehow relevant.

I am not sure when Thunderbird updated to 102.12.0 or if this is in any way related to the problem.

Meanwhile, I can sync incoming mail in my Gmail app on Android. I saw that the IMAP setting there uses port 443 instead of 993. When I tried setting 443 in Thunderbird, it simply took too long to connect to the server and timed out.

I don't know what else to try. Hopefully, you can think of a solution.

I have been getting this message since January and am starting to be concerned

Secure connection failed start.thunderbird.net uses an invalid security certificate. The certificate is not trusted because the issuer certificate has expired. Error code: <a id="errorCode" title="SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE">SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE</a>

  This could be a problem with the server's configuration, or it could be someone trying to impersonate the server.
  If you have connected to this server successfully in the past, the error may be temporary, and you can try again later.

Or you can add an exception… When I click on add an exception nothing happens. I tried closing Thunderbird, deleting my cert8.db file and restarting Thunderbird - no change - same message. I am running Windows 10, Thunderbird version 45.8.0

Help, please ! Thanks, Sarah

I have been using Thunderbird for several years for my GMail accounts, and have always preferred to download my messages using the POP and SMTP protocols, rather than use the IMAP protocol which leaves them all on the web. Google now inform me that "To help keep your account secure, Google will no longer support the use of third-party apps or devices which ask you to sign in to your Google Account using only your username and password. Instead, you’ll need to sign in using Sign in with Google or other more secure technologies, like OAuth 2.0. What do you need to do? Email software, like Outlook 2016 or earlier, has less secure access to your Gmail. Switch to Office 365, Outlook 2019 or newer, or any other email software where you can sign in using Sign in with Google." These changes are due to take effect from May 30th. How can I prepare for them and still use the POP and SMTP protocols after that date? Is OAuth 2.0 appropriate?