Thunderbird Mail Security Problem

**SVEN1** · August 22nd, 2012

Just found that when I open up Thunderbird, you can easily break in.
When the password box comes up, if you do not enter a password and hit cancel on the next three login boxes that come up it automatically logs you in.

Anyone else notice this yet?

**CharlesA** · August 22nd, 2012

It doesn't 'log you in' if just bypasses the checking of mail unless you enter your password. If you have it set up like that you would have to enter your password to send mail too.

If you are worried about someone using your computer without your permission, lock the screen when you are not at the machine.

Otherwise physical access = root access.

**HtmlGifted** · August 23rd, 2012

Yah I have this set up the same way. I also have google calendar plugin and it pops up two times one for the email checking and one for the google calendar....

I also seem to have an issue with an rss feed duplicating it self. then when I delete it from my list. it re appears and will not let me delete fully and suggestions on how to fix this would be great...

As you can see from the picture the Password pops up when opened and you can see the rss feed list and the one that is highlighted is the one I have issues with.

**ottosykora** · August 23rd, 2012

Did you read what the message says? ..software security device..

This is the password needed for unlocking the key store of the 509 key system. It just means that at some time you have used or still use some software keys based on 509 key system.
It does not have any impact on normal function of mail or access to messages etc.

**SVEN1** · August 23rd, 2012

Hitting cancel will bypass needing to use a master password to access any mail already loaded on Thunderbird. So anyone that does it cancel more than 4x get in and is able to read anything there.But, will not download new messages. When you hit the GET Mail button, it asks for your Master Password again. Here hitting cancel more than 3-4x does not work. You will need to manually enter your password for the button to work. Then new messages will download to Thunderbird

**CharlesA** · August 23rd, 2012

How is this a security problem? Someone would need to be physically at the machine in order to read your mail.

**SVEN1** · August 23rd, 2012

Originally Posted by CharlesA

How is this a security problem? Someone would need to be physically at the machine in order to read your mail.

Guess it's only an issue if others in the home and or if the entire family shares your computer and manages to hit cancel 4x, they can now read any existing mail you have saved and not trashed or that are in your sent and inbox folders.

Not a concern for me, because it's only my wife and myself. But, some folks don't want others looking at their mail. Good to remind folks to close out the last email they looked at and close up any profile folders opened and or the sub folders, before logging out.

Guess to avoid all this is not to have any Thunderbird shortcut icons on your desktop........

**CharlesA** · August 23rd, 2012

Or lock the screen when you step away from your computer.

**ottosykora** · August 23rd, 2012

Originally Posted by SVEN1

Hitting cancel will bypass needing to use a master password to access any mail already loaded on Thunderbird. So anyone that does it cancel more than 4x get in and is able to read anything there.But, will not download new messages. When you hit the GET Mail button, it asks for your Master Password again. Here hitting cancel more than 3-4x does not work. You will need to manually enter your password for the button to work. Then new messages will download to Thunderbird

appart from that this pop up at begining, asking for password has little to do with Thunderbird, it has to do with 509 key subsystem of thunderbird. Nothing to do with normal mails or access to them. It is just here to enable the use of encryption, but if you do not use encryption, all has no function for you.

**cariboo** · August 24th, 2012

If you are really worried about family members/others reading your personal documents/email, set up separate accounts for them. Linux was designed as a multi-user system from the start, it is possible to set things up so that others don't have access to each others home directory. Simply set user home directories permissions to 700, and the only user that can access all home directories is the system administrator.

Of course you have to remember to log out, when you leave the computer.