Primary Password (was Master Password) to block access to Thunderbird UI

[GwydionBowydd]

My copy of Thunderbird is protected by a Master password, which ensures that you enter your password before Thunderbird launches.   However if you "CANCEL" at that point and do not enter your password Thunderbird STILL launches and existing e-mails can still be read.  If you try and send an e-mail the password will be required, but existing e-mails can still be read without entering the password.  This seems bizarre.
It would be better if Thunderbird doesn't launch at all if you press "CANCEL" at the password stage.  Thank you

[wsmwk]

> Have a great day, and thank you for contributing to the Open Source software community!

You are welcome. Thank you for contributing.

> Is giving the impression that this feature is not tested internally really a good idea for establishing the feature is secure and for example there are again no backdoors present bypassing the security feature?

[multiple instances of the primary password request on Mac] Is just a known bug which hasn't been gotten to. There is no security exposure.

[WrongIsland]

using 118.0b1, clicking Cancel 3 times makes the dialog go away but the program window opens giving full read and write access!

please advise, and thanks

[Loneck]

I agree with the OP when Cancel option is selected for master password it should not open the application for anyone to view the mailbox. What is the point of master password when it lets you in to the application? I thought this is supposed to be security feature.

[Loneck]

Agreed with OP, I have no idea who designed it this way. As it is now, master password is basically useless feature. Mozilla devs please correct this issue.

[Loneck]

Yes, please correct the master password feature to function properly. It should not be possible to access already downloaded emails to inbox when you click on Cancel button in password prompt.

[Dgener]

Agree. It would be nice to not be able to open “stay logged in” websites not just passwords or remembered sites will need a master password. The other cached pages can auto delete when closing the page. 

[wsmwk]

Thank you for the votes.  Moving the votes to https://connect.mozilla.org/t5/ideas/master-password/idi-p/25967 which describes the same idea.

[wsmwk]

https://connect.mozilla.org/t5/ideas/master-password/idi-p/25967 describes the same idea, so we are merging this idea into there, where you can vote.

[Ernie32-FR]

I totally agree on the misleading part of having a password that does not block totall access to the program. Especially because this is the general idea behind it everywhere, a user should be at least warned that this is a different kind of password protection. Use of another word (admin-pwd or whatever) and the warning that cancelling will still show your emails, because that was my assumption too for years untill I accidentally canceled. Which made me feel stupid, to say the least, thinking all this time my emails were safe from unwanted eyes...

[GoVeg]

Some thoughts can be also found here, in one of the many bug reports raised describing the same issue in bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=1872542 

[moz_samri]

Moz has a problem in that Master PW and Passphrase are used in multiple contexts.

In FFox, the Passphrase is use to access SYNC storage.

In TBird, the phrase seems to be the concept of preventing read/write of the messages.

For TBird, one might implement a per message, or "all" button/status setting which would allow selective hide/encrypt... 

My primary point is:
FFox and TBird are using same words with conflicting meanings, and should be resolved, if both projects wish to take advantage of pre-existing code/ or improve the mutual code base.  Keeping siloed meanings will turn off people, and taint the Mozilla brand.

[wenbor]

Thunderbird > Tools: Privacy&Safety > Master Password.
When we setup down with the master password and close the program.
Then click the program again which will show up the window to enter the
master password.
But if the password without enter or enter the worng.
The client still pop up the window with retry and the main program will
continue go on with the next steps.
The final of the status is that still can read the mail in the program.
The status should be that is the password with the wrong times and
should closed the program with the exit. If it is correct will continue
to the normal.

[wenbor]

Thunderbird version is 128.5.2esr (64 位元)

[DebraB]

Occasionally I will get distracted between starting Thunderbird and entering the primary/master password. This is usually due to not having my password manager open, and/or problems with the PW manager, or getting an important phone call.

Thunderbird asks for the PW, but if I don't enter it "in time" it will go ahead and try to access my email accounts online, but without having access to the application passwords/tokens. This causes a slew of errors, requests for authorizations and other problems. I usually end up canceling the task by way of the operating system - because just closing Thunderbird doesn't stop the insanity.

If I have a primary/master PW, Thunderbird should WAIT, and not try to do anything, until that password is correctly entered. That would solve a bunch of issues.

Thunderbird: 128.5.2esr (64-bit) Release notes Thunderbird for Linux Mintmint-001 - 1.0 Updates disabled by your system administrator

System:

 Kernel: 6.8.0-51-generic arch: x86_64 bits: 64 compiler: v: 1.30.0 ...
   Dist: Linux Mint 22 Wilma base: Ubuntu 24.04 noble