We're calling on all EU-based Mozillians with iOS or iPadOS devices to help us monitor Apple’s new browser choice screens. Join the effort to hold Big Tech to account!

This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Echekwara usoro a. Biko jụọ ajụjụ ọhụrụ ma ọ bụrụ na ị chọrọ enyemaka.

Why can I still download new emails after changing my pword via the web site of my email provider, but have not yet changed it in Thunderbird?

  • 4
  • 1 nwere nsogbu anwere nsogbu a
  • 1 view
  • Nzaghachi ikpeazụ nke Dashour

Dashour
Dashour
more options

Normally, when I change my email password, I do it on the email providers web site. Once the password is changed that way, I cannot download email into thunderbird until I have also changed the password that Thunderbird uses to access my email account. This is usually done via a pop up window in thunderbird that asks me for the password.

However, I have just changed my email password as normal, but thunderbird can still download my email from that account without asking at all the new password, and when I checked in "saved passwords" the OLD password is still listed (but not, of course, the new one)

I have repeated tested out the new password on my providers web site, and indeed the new password now works, and the old password does not work - except in Thunderbird, where it continues to work. Why?

Normally, when I change my email password, I do it on the email providers web site. Once the password is changed that way, I cannot download email into thunderbird until I have also changed the password that Thunderbird uses to access my email account. This is usually done via a pop up window in thunderbird that asks me for the password. However, I have just changed my email password as normal, but thunderbird can still download my email from that account without asking at all the new password, and when I checked in "saved passwords" the OLD password is still listed (but not, of course, the new one) I have repeated tested out the new password on my providers web site, and indeed the new password now works, and the old password does not work - except in Thunderbird, where it continues to work. Why?

Asịsa ahọpụtara

dashour said

Ok Matt many thanks for that answer. Uhm, is this something I should be concerned about?

No.

My main concern was that my old password could still be used by somebody - but this sounds like that's not the case, right?

Right.

Gụọ azịza a na nghọta 👍 1

All Replies (4)

Matt
Matt
  • Moderator
  • Top 10 Contributor
more options

My guess is you are using Oauth2.0 to authenticate. It uses token created when you enter your password the first time and will continue to work until the provider revokes them in some cases for ever.

The Oauth folks have information on their web site https://www.oauth.com/oauth2-servers/access-tokens/access-token-lifetime/

Exactly what "model" is in use in your case I have no idea.

Google discuss their implementation here https://developers.google.com/identity/protocols/OAuth2UserAgent#validate-access-token As that is the main use of Oauth in Thunderbird I am assuming it is their implementation.

Dashour
Dashour Jụọ onye nwe ya ajụjụ
more options

Ok Matt many thanks for that answer. Uhm, is this something I should be concerned about? My main concern was that my old password could still be used by somebody - but this sounds like that's not the case, right? Thanks.

Matt
Matt
  • Moderator
  • Top 10 Contributor
more options

Asịsa Ahọpụtara

dashour said

Ok Matt many thanks for that answer. Uhm, is this something I should be concerned about?

No.

My main concern was that my old password could still be used by somebody - but this sounds like that's not the case, right?

Right.

Edeziri site na Matt

Dashour
Dashour Jụọ onye nwe ya ajụjụ
more options

Many thanks Matt. A quick reply, for free, it doesn't get better than that. Cheers.