5 ms·

Thunderbird has, or had, a plain text mode and a "Simple HTML" mode (other than only recognizing a subset of HTML, I don't know what it does) for displaying mes

Thunderbird has, or had, a plain text mode and a "Simple HTML" mode (other than only recognizing a subset of HTML, I don't know what it does) for displaying messages. You can leave it in plain text mode and, in the event you really need to view HTML, switch it to "Simple" or full HTML. It also can block remote images and, I think, all JavaScript. The wonderful Nostalgy add-on provides a very responsive keyboard interface. https://addons.mozilla.org/en-US/thunderbird/addon/nostalgy/ https://addons.mozilla.org/en-US/thunderbird/addon/nostalgy/ I don't know if current Thunderbird versions include all that, however.

JohnTHaller 11y ago
I use Thunderbird and keep it set as text only for sending and remote images loading is disabled by default (as it should be). JavaScript in emails is not loaded or run.
- hackuser 11y ago
  Thanks. > I use Thunderbird and keep it set as text only for sending Is that an option for viewing messages? That's where the security risk mostly exists.
  - JohnTHaller 11y ago
    View - Message Body As - and then your options are Original HTML, Simple HTML, and plaintext. Loading of external images is fully disabled by default. You can enable it per-email by clicking as well as per-sender (which I don't personally do or recommend). Showing as text is mostly unnecessary, though, as Thunderbird does not allow Javascript or any plugins within messages. As a result, the attack surface is significantly reduced compared to a browser as most browser-based attacks are via Flash, PDF, Java, Javascript, etc in decreasing order of popularity. That wipes out the vulnerabilities used in the vast majority of attacks right off the bat. Thunderbird uses the Gecko engine underneath which is up to date and version tied to Firefox ESR, so the engine gets security updates basically same-day as Firefox itself, which is another big point in its favor.
- deleted 11y ago
  [deleted]
purpleorange 11y ago
thunderbird is love, thunderbird is life

JohnTHaller 11y ago

I use Thunderbird and keep it set as text only for sending and remote images loading is disabled by default (as it should be). JavaScript in emails is not loaded or run.

hackuser 11y ago
Thanks. > I use Thunderbird and keep it set as text only for sending Is that an option for viewing messages? That's where the security risk mostly exists.
- JohnTHaller 11y ago
  View - Message Body As - and then your options are Original HTML, Simple HTML, and plaintext. Loading of external images is fully disabled by default. You can enable it per-email by clicking as well as per-sender (which I don't personally do or recommend). Showing as text is mostly unnecessary, though, as Thunderbird does not allow Javascript or any plugins within messages. As a result, the attack surface is significantly reduced compared to a browser as most browser-based attacks are via Flash, PDF, Java, Javascript, etc in decreasing order of popularity. That wipes out the vulnerabilities used in the vast majority of attacks right off the bat. Thunderbird uses the Gecko engine underneath which is up to date and version tied to Firefox ESR, so the engine gets security updates basically same-day as Firefox itself, which is another big point in its favor.
deleted 11y ago
[deleted]

purpleorange 11y ago

thunderbird is love, thunderbird is life