X
Thinta lapha ukuze uye kuveshini yamakhalekhukhwini kusayithi.

Isithangami Sabeseki

Master password easily bypassed to read email when no internet connection

Kuphostiwe

Have been trying to read about this issue for years off and on, but never found anything, so finally thought I'd ask a question.

I've used master password for years as a basic security to stop people reading emails on my machine. However, it can be completely bypassed if you just remove the internet connection and start thunderbird, the master password dialog never appears, allowing you to freely read any mail from any account within thunderbird.

Now I appreciate those mails may be accessible on the machine *IF YOU KNOW* where to look and read the raw files, but that is not something I am concerned about, more so the type of person who not have the knowledge to go that, would just open thunderbird and have a snoop around.

Sure that user couldn't send / receive mails (not internet) until the connection came back in which case the dialog is shown (eventually), but still, seems strange it doesn't stop people using thunderbird.

Have been trying to read about this issue for years off and on, but never found anything, so finally thought I'd ask a question. I've used master password for years as a basic security to stop people reading emails on my machine. However, it can be completely bypassed if you just remove the internet connection and start thunderbird, the master password dialog never appears, allowing you to freely read any mail from any account within thunderbird. Now I appreciate those mails may be accessible on the machine *IF YOU KNOW* where to look and read the raw files, but that is not something I am concerned about, more so the type of person who not have the knowledge to go that, would just open thunderbird and have a snoop around. Sure that user couldn't send / receive mails (not internet) until the connection came back in which case the dialog is shown (eventually), but still, seems strange it doesn't stop people using thunderbird.
Isicaphuno

Eminye Imininingwane Yohlelo

Isisebenziso

  • I-ejenti Engumsebenzisi: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Eminye Imininingwane

Toad-Hall
  • Top 10 Contributor
1769 izisombululo 11905 izimpendulo
Kuphostiwe

Impendulo Ewusizo

re :I've used master password for years as a basic security to stop people reading emails on my machine. I'm afraid you have not understood what the Master Password does or have forgotten since applying it.

When you created the 'Master Password' you did it in this location. Menu icon > Options > Security > 'Passwords' tab It says 'A Master Password protects all your passwords, but you must enter it once per session'. Below this is the checkbox to 'Use a Master Password'.

The 'Master Password' is designed to stop people from having access to viewing your saved passwords if anyone should have access to your desktop.

It is not designed to stop people from read emails, you would use the basic security as supplied by your computer and create a 'User Account' for yourself. You can apply a password to gain access to your User Account desktop. Then no one can access any of your documents if they do not know the User Account password. Good info here:

re :''I've used master password for years as a basic security to stop people reading emails on my machine. '' I'm afraid you have not understood what the Master Password does or have forgotten since applying it. When you created the 'Master Password' you did it in this location. Menu icon > Options > Security > 'Passwords' tab It says '''A Master Password protects all your passwords, but you must enter it once per session'.'' Below this is the checkbox to 'Use a Master Password'. The 'Master Password' is designed to stop people from having access to viewing your saved passwords if anyone should have access to your desktop. It is not designed to stop people from read emails, you would use the basic security as supplied by your computer and create a 'User Account' for yourself. You can apply a password to gain access to your User Account desktop. Then no one can access any of your documents if they do not know the User Account password. Good info here: * https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-master-password
Ingabe lokhu kube usizo kuwena? 1
Isicaphuno

Umnikazi wombuzo

Thanks for your quick reply

That makes sense, I did think it was probably my understanding that was a miss.

Thanks for your quick reply That makes sense, I did think it was probably my understanding that was a miss.
Ingabe lokhu kube usizo kuwena?
Isicaphuno
Matt
  • Top 10 Contributor
  • Moderator
3253 izisombululo 22416 izimpendulo
Kuphostiwe

I think the issue with a Thunderbird password is that all the data is plain text. Not much point trying to block folks out of Thunderbird when they can read your mail with notepad from the windows file manager.

I think the issue with a Thunderbird password is that all the data is plain text. Not much point trying to block folks out of Thunderbird when they can read your mail with notepad from the windows file manager.
Ingabe lokhu kube usizo kuwena?
Isicaphuno

Umnikazi wombuzo

> Not much point trying to block folks out of Thunderbird when they can read your mail with notepad from the windows file manager.

Well I disagree there. 95% of people don't know how to do that. But do now how to open thunderbird and read mail.

The keeping honest people honest argument. I still lock my car / house although 5% of people know how to pick the lock..

But as have internet connection most of the time, master passwords well enough :)

> Not much point trying to block folks out of Thunderbird when they can read your mail with notepad from the windows file manager. Well I disagree there. 95% of people don't know how to do that. But do now how to open thunderbird and read mail. The keeping honest people honest argument. I still lock my car / house although 5% of people know how to pick the lock.. But as have internet connection most of the time, master passwords well enough :)
Ingabe lokhu kube usizo kuwena?
Isicaphuno
Buza umbuzo

Kufanele ulogele ukungena ku-akhawunti yakho ukuze uphendule amaphosti. Uyacelwauqale umbuzo omusha, uma ungekabi nayo i-akhawunti namanje.