-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Accessing an email server via IMAP may leak data by saving a draft on the remote server.
Using Thunderbird+Enigmail+Torbirdy.
While writing a message on Thunderbird, it is automatically saved as a draft, which by default is sent to the IMAP server. So the server will be able to read that message.
That's a big problem when the message should be encrypted before sent. So the email provider will be able to read sensitive data on those drafts in cleartext and the user probably won't notice.
To solve this the user need to manually set the account drafts settings (in Copies & Folders) to keep drafts on Local Folders.
I think Torbirdy should do it by default.
This info should be added to known issues on Torbirdy wiki.
I know Torbirdy developers recommend POP over IMAP, but as a mailtor.net user I don't have any other option.
- -- arkmd DeepBlog | A verdade nua crua e distorcida http://xzzpowtjlobho6kd.onion/
OpenPGP Public Key: http://xzzpowtjlobho6kd.onion/arkmd.asc 4096R: 0461 DF2C B6B7 6059 7529 77E0 04CD FE83 766B 8DA6
It doesn't have anything to do with TorBirdy. All you really have to do, is to have Encryption on by default in Enigmail.
Your drafts are now going to be encrypted. Problem solved!
Bests,
Amusingly, I've had this happen myself. Even though my default was set to encrypt outgoing messages, it still sent several unencrypted drafts to ioerror (of all people).[1] *However*, I was not using TorBirdy -- just the combination of Thunderbird and Enigmail.
Now Thunderbird is set to *not* automatically create/save drafts. Works like a charm. =)
~Griffin
[1] http://i.imgur.com/HWzAiJ3.gif
Il 06.12.2013 05:10 Nima Fatemi ha scritto:
It doesn't have anything to do with TorBirdy. All you really have to do, is to have Encryption on by default in Enigmail.
Your drafts are now going to be encrypted. Problem solved!
Bests,
Nima 0XC009DB191C92A77B | mrphs - https://anarchy.io
"I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
I've checked it again. Write, wait it to be saved, close and open your email via web-mail. And thats my draft in cleartext on mailtor.net server:
Testing draft.
Icedove 17.0.10 Enigmail 1.6 TorBirdy 0.1.2
That's it.
Nima Fatemi:
It doesn't have anything to do with TorBirdy.
I did not say it is TorBirdy fault.
But yes it has everything to do with TorBirdy. It is an anonymity and security tool and tries avoid leaks. Maybe you just don't see it as a leak.
Anyway the users must know it may happen.
All you really have to do, is to have Encryption on by default in Enigmail. Your drafts are now going to be encrypted. Problem solved!
Sukhbir Singh:
By default, Enigmail saves an encrypted copy of the message. This is the default setting [1] and I think it also confirms this when it saves an encrypted message for the first time. TorBirdy does not modify this setting so it should be enabled by default for Enigmail.
Enigmail asks to save an encrypted draft *only when you enable encryption* to that message. If you forget to set the encryption and write it will be saved in cleartext without asking anything.
When you are sending the email Enigmail asks if you really wanna send unencrypted, but the draft already have been sent unencrypted on the IMAP server.
Enigmail should ask *always* when saving a draft remotely. Even locally it should.
And TorBirdy should help prevent this to happen.
griffin@cryptolab.net:
Now Thunderbird is set to *not* automatically create/save drafts. Works like a charm. =)
That should be default set by both Enigmail and TorBirdy. Also should set to save locally, instead of remotely, if the user wants to save a draft.
- -- arkmd DeepBlog | A verdade nua crua e distorcida http://xzzpowtjlobho6kd.onion/
OpenPGP Public Key: http://xzzpowtjlobho6kd.onion/arkmd.asc 4096R: 0461 DF2C B6B7 6059 7529 77E0 04CD FE83 766B 8DA6
arkmd has opened a ticket #10309 [https://trac.torproject.org/projects/tor/ticket/10309] for this issue. Let's continue the discussion there.
Hi,
Using Thunderbird+Enigmail+Torbirdy.
To solve this the user need to manually set the account drafts settings (in Copies & Folders) to keep drafts on Local Folders.
I think Torbirdy should do it by default.
This info should be added to known issues on Torbirdy wiki.
(If I recall correctly, this issue was discussed before also but I can't seem to find the thread/ticket.)
By default, Enigmail saves an encrypted copy of the message. This is the default setting [1] and I think it also confirms this when it saves an encrypted message for the first time. TorBirdy does not modify this setting so it should be enabled by default for Enigmail.
If you did not change this setting but still observed this behavior, please open a bug report [2] with all the relevant information (version of Thunderbird, TorBirdy, Enigmail, etc.) so that I can check this.
Come to think of it, perhaps we should disable the automatic save feature altogether (#6337). Suggestions welcome.
[1] - https://www.enigmail.net/documentation/userprefs.php (see saveEncrypted) [2] - https://trac.torproject.org/projects/tor/wiki/torbirdy/dev
Sukhbir Singh wrote (06 Dec 2013 05:49:26 GMT) :
(If I recall correctly, this issue was discussed before also but I can't seem to find the thread/ticket.)
IIRC it was discussed recently on libtech.
Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc
-
arkmd -
griffin＠cryptolab.net -
intrigeri -
Nima Fatemi -
Sukhbir Singh