3 ms·

If memory serves correctly, in the Thunderbird 1.0 era, all of the passwords would have been saved via encryption via NSS's secret decoder ring methods. So if y

If memory serves correctly, in the Thunderbird 1.0 era, all of the passwords would have been saved via encryption via NSS's secret decoder ring methods. So if you set up a master password, then the contents would be encrypted on-disk. (Even if you didn't, they're still not stored in plaintext--I just think it's encrypted with something like an empty password instead, but I'm not certain.) Additionally, I'm pretty sure even 20 years ago, Thunderbird would have still thrown up resistance at trying to connect to an email server without using STARTTLS or SSL.

yjftsjthsd-h 4y ago
I wouldn't worry too much about encryption at rest, if nothing else then because it's only being stored on a local device that you control. What I would worry about is that those credentials are then going to be sent to a server and a system of that age probably doesn't speak any modern version of TLS.
TakeBlaster16 4y ago
I wouldn't be worried about encryption. I'd be worried about any of the hundreds of widely-known vulnerabilities that were patched between 2002 and today. https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.html?vendor_id=452 https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.... https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.html?vendor_id=26 https://www.cvedetails.com/product/739/Microsoft-Windows-Xp....
- badsectoracula 4y ago
  Yes but there is a difference between possibility and probability: it is technically possible to hit these vulnerabilities, but the chances are practically zero, especially in the context here where someone might try it once like mentioned in the article. It isn't like there are many malware authors out there trying to infect people running 20 year old software (outside of targeted attacks). I think you are more likely to be affected by a vulnerability bug in some random modern macOS application with its own autoupdater than a vulnerability in a 20 year old Windows program. Remember that these issues existed when that software was actually mainstream and yet the overwhelming majority of people wasn't affected by them during the peak of their popularity.
  - TakeBlaster16 4y ago
    The difference is back then, the vulnerabilities weren't even discovered yet. Today, metasploit scanners are running 24/7 scanning the entire IPv4 address space for thousands of vulnerabilities at a time - including automated chaining of exploits through e.g. routers with misconfigured UPnP. You don't need to be targeted. As mentioned above, you can be exploited with no user action merely by plugging in an ethernet cable. But then again, I'm not your mom. If you really want to do this I can't stop you. Go ahead.
  - deleted 4y ago
    [deleted]

yjftsjthsd-h 4y ago

I wouldn't worry too much about encryption at rest, if nothing else then because it's only being stored on a local device that you control. What I would worry about is that those credentials are then going to be sent to a server and a system of that age probably doesn't speak any modern version of TLS.

TakeBlaster16 4y ago

I wouldn't be worried about encryption. I'd be worried about any of the hundreds of widely-known vulnerabilities that were patched between 2002 and today. https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.html?vendor_id=452 https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.... https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.html?vendor_id=26 https://www.cvedetails.com/product/739/Microsoft-Windows-Xp....

badsectoracula 4y ago
Yes but there is a difference between possibility and probability: it is technically possible to hit these vulnerabilities, but the chances are practically zero, especially in the context here where someone might try it once like mentioned in the article. It isn't like there are many malware authors out there trying to infect people running 20 year old software (outside of targeted attacks). I think you are more likely to be affected by a vulnerability bug in some random modern macOS application with its own autoupdater than a vulnerability in a 20 year old Windows program. Remember that these issues existed when that software was actually mainstream and yet the overwhelming majority of people wasn't affected by them during the peak of their popularity.
- TakeBlaster16 4y ago
  The difference is back then, the vulnerabilities weren't even discovered yet. Today, metasploit scanners are running 24/7 scanning the entire IPv4 address space for thousands of vulnerabilities at a time - including automated chaining of exploits through e.g. routers with misconfigured UPnP. You don't need to be targeted. As mentioned above, you can be exploited with no user action merely by plugging in an ethernet cable. But then again, I'm not your mom. If you really want to do this I can't stop you. Go ahead.
- deleted 4y ago
  [deleted]