Om de ûnderfining foar jo te ferbetterjen is tydlik de funksjonaliteit dan dizze website troch ûnderhâldswurk beheind. Wannear in artikel jo probleem net oplost en jo in fraach stelle wolle, kin ús stipemienskip jo helpe yn @FirefoxSupport op Twitter en /r/firefox op Reddit.

Sykje yn Support

Mij stipescams. Wy sille jo nea freegje in telefoannûmer te beljen, der in sms nei ta te stjoeren of persoanlike gegevens te dielen. Meld fertochte aktiviteit mei de opsje ‘Misbrûk melde’.

Mear ynfo

Dizze konversaasje is argivearre. Stel in nije fraach as jo help nedich hawwe.

Big security concen by using thunderbird email client

more options

Hi Team,

We just found a flaw in Thunderbird where any user can send an email to anyone using name/identity of anyone.

Steps:-

1. Navigate to Accounts Settings. 2. Change your Name to Any Name(say my subordinate name) 3. Change Email address to any email address(say my subordinate name) 4. Save the changes and send any email.

Now email will be sent 'from' Subordinate email address to anyone Hence A person can send email to B person from C person identity.

Please look into this and find any solution so that any misuse of others email id can be avoided.

Thanks, Amar

Hi Team, We just found a flaw in Thunderbird where any user can send an email to anyone using name/identity of anyone. Steps:- 1. Navigate to Accounts Settings. 2. Change your Name to Any Name(say my subordinate name) 3. Change Email address to any email address(say my subordinate name) 4. Save the changes and send any email. Now email will be sent 'from' Subordinate email address to anyone Hence A person can send email to B person from C person identity. Please look into this and find any solution so that any misuse of others email id can be avoided. Thanks, Amar

Alle antwurden (2)

more options

I doubt it would be that simple. In any case, you can avoid such a scenario by using different Windows user accounts for different people using the same computer.

more options

Hi Amar, how would you suggest that Thunderbird verify the "true" email address of the sender?

For example, Thunderbird might prohibit the "from" name/address to be different from the account login credentials. However, there are people who receive and send email for multiple identities (aliases) with a single account, and this would create a problem for those users.

I think if this is a major concern for your organization, you should try to enforce it on the server side. For example, the SMTP server software might be configured to reject messages where the from name/address do not match the account login credentials, or it might rewrite them to the from name/address of the account so that forging is impossible. I don't know which mail servers can do this.


Also, if you are concerned about security, it's very strange that your browser identified itself to the forum as Firefox 18. Is that correct?!

Version 18 is not secure; Mozilla discloses security flaws after each new release. If something is holding you back from upgrading to Firefox 40 (or for ESR users, 38.2), please start a new question so we can suggest solutions or workarounds: https://support.mozilla.org/questions/new/desktop (scroll down past suggested articles if they are not relevant to continue submitting your question)

If Help > About Firefox shows Firefox 40.0.2, you may need to clear the preference that is misreporting your version number. See: How to reset the default user agent on Firefox.