Profile Corruption - Login Failures - Security - Email Account Blocked
I use the latest version of Thunderbird on MacOS Sonoma 14.6.1. I have had a strange login/security issue twice in the past two weeks.
First activity in the morning about 10 days ago I noticed Thunderbird displaying many "Unable to get email, password incorrect messages" stacked on top of each other. Other native email clients on my other Apple devices were also unable to retrieve email. I contacted the email provider and they said the account was sending spam and they had blocked the account. They could offer no other information, such as whether the account had been hacked or password changed. After going through their security protocols they were able to restore the account and I changed the account password, from a reasonably strong 6 random characters to very strong 16 random characters with multifactor authentication enabled. After restarting Thunderbird, it was not possible to set the client password and get the client to function. I restored the profile from an older backup, copied the current mail folders into it, started Thunderbird, set the email password, and it started functioning again.
Today, about ten days later, first activity in the morning again found Thunderbird in the above state with numerous stacked password incorrect messages. However, this time email is functioning on my other devices, and I was able to login normally to my email provider's administration system. Perhaps the timing was such that the provider had not yet detected an issue and frozen the account.
This would lead me to believe that something on my Mac or associated with Thunderbird was responsible for the issues I am having. Multiple scans of the computer with Malewarebytes finds no viruses on the system. All help is appreciated.
All Replies (4)
This is for an account using oauth? Who is the mail provider/account domain?
Wayne, thanks for your reply. The account is a POP3 account with earthlink.net. The first time the issue occurred the authorization was "Password, sent unsecurely". When I recovered the account I changed the ports and used SSL/TTLS, and the issue occurred again about 10 days later. If it is of any value in understanding the problem, my machine was connected to the Internet via VPN.
I would guess you have identified the issue. The VPN!
Contrary to popular beliefs, a VPN only hides your apparent point of connection to the internet. Something many US based ISPs require before they will allow you to send mail or in some cases receive mail.
I have no idea what the policy at earthlink is, but issue with email where a VPN is used are very common.
Next you speak about two factor authentication. Thunderbird does not support that. At all! You will need to use an app password if you have 2FA enabled with your host. See this page about how to do that https://www.bitrecover.com/imap-settings/earthlink-webmail/
As far as I can figure from the scant information published by earthlink on the subject (see https://help.earthlink.net/portal/en/kb/articles/email-server-settings) they require a normal password (that is sent insecurely with SSL/TLS connection encryption for incoming mail and STARTTLS encryption for outgoing mail. Generally deviating from the information the provide sets results in a rather less than optimal result as they only oblige themselves in their terms of service to provide a service using the settings they supply.
Matt,
Thanks for your reply. I think I misspoke in the reply above. I have always had the POP3 account configured as recommended by Earthlink. Originally, it was configured with their then recommended port configuration and no encryption or security. It worked fine this way for very many years. Then I had the issue in my original post. When I recovered the account I again checked the email server settings at link you provided and configured it as suggested. Where I misspoke was saying SSL/TLS instead of STARTTLS as you noted. In any case it was configured as suggested when the second event occurred. Perhaps the wild card is the VPN use. In both cases my computer was connected via a VPN when the events occurred. This was my choice rather than an Earthlink requirement, but again I have been using the VPN for quite some time without issue. I can eliminate the VPN from the equation and see what happens. My biggest concern was that somehow the account had been hacked/stolen. There has been no other activity that would suggest that is the case. Any further information is welcome.
You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.