#363803 mozilla-thunderbird: password is remembered and send associated to hostname only

#363803#5
Date:
2004-03-25 13:10:37 UTC
From:
To:
With an ssh tunnel to an IMAP server on mking@localhost:14341
Thunderbird will not allow me to create the new account to the local
IMAP server on mking@localhost[:143] because it ignores the port number.

If the hostname is different (even as basically as 127.0.0.1)
Thunderbird is fine.

These two accounts were on different servers but if I want two identical
entries to a mailserver should the client really stop me? Ideally the
fix would be simply to remove this check, perhaps informing the user of
what they may be about to do but not stopping them from actually doing it.

The message, assuming it's still needed, is "A mail or newsgroup account
with the same user name and server name already exists. Click Back and
enter a different server name, or click Cancel."

Matthew

#363803#10
Date:
2004-04-05 18:08:51 UTC
From:
To:
severity 240034 minor
thanks


OK,

I agree that this could be improved. But it is really a minor issue, for
usually you won't have 2 imap servers on the same hostname.

Thx for using tbird


Matthew King wrote:

#363803#15
Date:
2004-11-12 16:48:29 UTC
From:
To:
If you already received this message, because you had an important
bug open, just ignore it.
<<<<<

Hi,

you receive this mail because you submitted a bug report
to the mozilla-thunderbird package.

If you already received this message, because you had an important
bug open, just ignore it.

Mozilla Thunderbird is quiet popular and thus has lots of bugs open.
Verifying one by one with each release on my own would be a really
hard task, so I heavily depend on the testing and quality feedback
of the package users.

As you might have noticed Thunderbird 0.9 has been released about a
week ago. Finally I have uploaded a package for that version to my
preview and backports repository. The apt lines can be found at [1].

In addition to testing the upgrade path I ask you for help to verify
if your bug is still present. So please take a minute or two and
install the preview package to look if everything is fine and if your
bug is still present. The preview package is currently build for
sarge, so if you encounter any problems installing them in unstable,
let me know! I might build another version for the current sid too!

And remember, please drop a note to your bug report mentioning the
outcome of your test.

Note: If you encounter any new bugs or upgrade bugs in the new
package, please don't post them to the debian BTS by now, since I
will try to fix as many as possible before I upload it to the debian
archives. Just send them to me with the subject line starting with
'[previewbug]'.

Thanks for all your help testing and improving and actually caring
for this package.

Cheers,

Alexander

[1] http://www.jwsdot.com/debian/install.html

#363803#20
Date:
2005-02-06 11:17:32 UTC
From:
To:
Hi,

I'm trying to reduce the number of times that my password is broadcast
in cleartext across the air, so I'd like to tunnel my POP accesses
through SSH (well, I'd *really* like to use IMAP-SSL, but my ISPs don't
do that).  The problem is that I have two accounts with two different
passwords, and thunderbird thinks it's connecting to the same host
twice, so it sends the same password.  So for the moment I need to come
up with something else - using 127.0.0.1 for one will work for now (but
how would I make three servers work?).

Andrew

#363803#25
Date:
2005-02-07 20:14:09 UTC
From:
To:
Andrew Archibald wrote:

Yes, in the mean time try some none existent hosts ... e.g. nohost1 nohost2
nohost3 nohost4 etc.

#363803#30
Date:
2005-02-07 22:29:49 UTC
From:
To:
Alexander Sack wrote:

Right now I'm using "localhost" and "127.0.0.1" but I guess what you
mean is put, in /etc/hosts, "localhost2", "localhost3", etc. pointing to
me?  Fortunately I have root access...

(incidentally, exim4 has a similar problem which can't be defeated quite
so easily).

Andrew

#363803#35
Date:
2005-02-07 22:52:59 UTC
From:
To:
Andrew Archibald wrote:
Ah, I think my answer was too short ... sorry. I mean you can create an
account with some host that does not exist and then change the server
settings in the account settings to point to your real imap server and
turn on ssl at once. In this way you can stop thunderbird sending
unencrypted at all.

Thanks

#363803#40
Date:
2005-02-07 23:36:07 UTC
From:
To:
Alexander Sack wrote:

I think you're responding to a different bug...  (the one about the
default being unencrypted)  I'm trying to deal with the fact that
thunderbird stores one password per host, not per host:port pair.  Alas,
neither of my servers supports any kind of sensible protocol at all.

Thanks,
Andrew

#363803#45
Date:
2005-02-08 08:05:13 UTC
From:
To:
Andrew Archibald wrote:
Please open a new bug for this issue. This bug is that it is impossible
to create a new account with the same hostname. The workaround provided
by me is valid for that problem. The problem that thunderbird stores the
password for a host and not for an account is still unknown to me. So if
you are sure this is the case, please open a new bug.

#363803#50
Date:
2005-02-08 09:35:32 UTC
From:
To:
Alexander Sack wrote:
mail servers on the same host and thunderbird could not cope.  I think
there are two symptoms:

* Thunderbird will refuse to create a second account on the same host.
I did not encounter this as I already had two servers created, and I
just changed their "server name" fields (which is what you suggest, and
which does work around the problem).

* Thunderbird only stores one password for the both of them, indexed by
the server name.  Since I have different passwords, I had to pick one to
log in to.  This can be worked around by giving each server a different
name, which nevertheless resolves to the same name in practice (for
example, localhost and 127.0.0.1, or creating a bunch of dummy entries
in /etc/hosts).  Neither is entirely satisfactory for logging into two
different servers running on the same DNS-sharing cluster of hosts, and
this feature of Thunderbird could result in your password being sent to
the wrong host, which may log it.

I can formally report the second behaviour as a bug if you like, either
at this bug report or in an entirely new bug. It's a little cumbersome
to trigger (requires me to temporarily break my email).

Sorry for the confusion,
Andrew