-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Accessing an email server via IMAP may leak data by saving a draft on the remote server. Using Thunderbird+Enigmail+Torbirdy. While writing a message on Thunderbird, it is automatically saved as a draft, which by default is sent to the IMAP server. So the server will be able to read that message. That's a big problem when the message should be encrypted before sent. So the email provider will be able to read sensitive data on those drafts in cleartext and the user probably won't notice. To solve this the user need to manually set the account drafts settings (in Copies & Folders) to keep drafts on Local Folders. I think Torbirdy should do it by default. This info should be added to known issues on Torbirdy wiki. I know Torbirdy developers recommend POP over IMAP, but as a mailtor.net user I don't have any other option. - -- arkmd DeepBlog | A verdade nua crua e distorcida http://xzzpowtjlobho6kd.onion/ OpenPGP Public Key: http://xzzpowtjlobho6kd.onion/arkmd.asc 4096R: 0461 DF2C B6B7 6059 7529 77E0 04CD FE83 766B 8DA6 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJSoUwEAAoJEATN/oN2a42mW/AQAI7IITFPTZEe4X2UBNS3kovK UHJIe9j/K9FA63ubGxu8TotdkIK5TvnkPP/DGDg6NrnILIx/KeK6XAWTDhv6vfgY hIBA+v+9mjAW64fQ31tTSXEVKUofKUyazN984QnVcb/Qyj297GujgrI0vdDFU0c9 KIS7z15Lk3QRx+Qtb+VboXH3ES59oRPuutTSQ+z0RyLToMmFs41BDei01WtLfy/i aLcIYTWUZb+yVmspkOuOKAe9enlGNTXeFGaR6uspA8ImedsCUYq5iySBhm5CVs0B 0sF6Mq18rXTVDF4jwoNLYqkgyANSI9IzgDbxlzgBaJwJjnN9OAeF8vJI+qkZUElS 56pVIzayyEMJXhvsqotuBYH+X+aRt2+Hw2prIxuUcRDFP3iOrupElARpqvDqYa4U IrQ/8lUl5jEnPNNJFklBwTjzHOVtxmCymEDh+zSXlIzL4WQJwYPDj1+uqwOenwO4 FCy1ADFXyMDQso3bXwPqD3VSGdYGqmMc+34vIVA28vTSFYyxiBwjHZLF16Us+uD/ sMbMGEOg+za8MSrgLVwcBAkbRG14fE50litW+bnSWl3QltGOt0rV9INKLKSGvEy4 DMCL2mc9aU9Rago1j/FJlXAOCctuFlTOS9MkCzF+iSJIoa3IxwUmnrvWwOuEuFxa zrSdjkyzMJKgnd+b+Vm4 =oF2B -----END PGP SIGNATURE-----
It doesn't have anything to do with TorBirdy. All you really have to do, is to have Encryption on by default in Enigmail. Your drafts are now going to be encrypted. Problem solved! Bests, -- Nima 0XC009DB191C92A77B | mrphs - https://anarchy.io "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall arkmd:
Accessing an email server via IMAP may leak data by saving a draft on the remote server.
Using Thunderbird+Enigmail+Torbirdy.
While writing a message on Thunderbird, it is automatically saved as a draft, which by default is sent to the IMAP server. So the server will be able to read that message.
That's a big problem when the message should be encrypted before sent. So the email provider will be able to read sensitive data on those drafts in cleartext and the user probably won't notice.
To solve this the user need to manually set the account drafts settings (in Copies & Folders) to keep drafts on Local Folders.
I think Torbirdy should do it by default.
This info should be added to known issues on Torbirdy wiki.
I know Torbirdy developers recommend POP over IMAP, but as a mailtor.net user I don't have any other option.
Amusingly, I've had this happen myself. Even though my default was set to encrypt outgoing messages, it still sent several unencrypted drafts to ioerror (of all people).[1] *However*, I was not using TorBirdy -- just the combination of Thunderbird and Enigmail. Now Thunderbird is set to *not* automatically create/save drafts. Works like a charm. =) ~Griffin [1] http://i.imgur.com/HWzAiJ3.gif Il 06.12.2013 05:10 Nima Fatemi ha scritto:
It doesn't have anything to do with TorBirdy. All you really have to do, is to have Encryption on by default in Enigmail.
Your drafts are now going to be encrypted. Problem solved!
Bests, -- Nima 0XC009DB191C92A77B | mrphs - https://anarchy.io
"I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I've checked it again. Write, wait it to be saved, close and open your email via web-mail. And thats my draft in cleartext on mailtor.net server:
Testing draft.
Icedove 17.0.10 Enigmail 1.6 TorBirdy 0.1.2
That's it.
Nima Fatemi:
It doesn't have anything to do with TorBirdy.
I did not say it is TorBirdy fault. But yes it has everything to do with TorBirdy. It is an anonymity and security tool and tries avoid leaks. Maybe you just don't see it as a leak. Anyway the users must know it may happen.
All you really have to do, is to have Encryption on by default in Enigmail. Your drafts are now going to be encrypted. Problem solved!
Sukhbir Singh:
By default, Enigmail saves an encrypted copy of the message. This is the default setting [1] and I think it also confirms this when it saves an encrypted message for the first time. TorBirdy does not modify this setting so it should be enabled by default for Enigmail.
Enigmail asks to save an encrypted draft *only when you enable encryption* to that message. If you forget to set the encryption and write it will be saved in cleartext without asking anything. When you are sending the email Enigmail asks if you really wanna send unencrypted, but the draft already have been sent unencrypted on the IMAP server. Enigmail should ask *always* when saving a draft remotely. Even locally it should. And TorBirdy should help prevent this to happen. griffin@cryptolab.net:
Now Thunderbird is set to *not* automatically create/save drafts. Works like a charm. =)
That should be default set by both Enigmail and TorBirdy. Also should set to save locally, instead of remotely, if the user wants to save a draft. - -- arkmd DeepBlog | A verdade nua crua e distorcida http://xzzpowtjlobho6kd.onion/ OpenPGP Public Key: http://xzzpowtjlobho6kd.onion/arkmd.asc 4096R: 0461 DF2C B6B7 6059 7529 77E0 04CD FE83 766B 8DA6 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJSokkNAAoJEATN/oN2a42m89UP/2E48vY3596pIhIFHZMJWvVk MGhrJpJUCsBP7R/B0AiYLQS6/7mEIEo2AEexusaFjza12Lc9Q4qh+AOll/JQOKLi a2cEAVEgwma0CSUTRweKXK3qVl4A5Uybp9bFbxrErmW7siGKcS5yhH4ldqXGCw9V jYifzydey0rKKv7C7nXcO5X2ZnRfDYmO/FoaQIS9iSf8IDnPpPedtwQTVYUFPkRo AD1eYPbaDpLQe5eG+rtxP0+VsCbQj3z3BykKTVtzGEzMPADwjTh0OpHk1WrQI0ux WKBZK0afMeX2EIsLjNc8FcNVN5w+llONCkTEjoWM1+Ftrlut6WMhSAu1LrW9CCIz eBnGZLtdkLh67dulRUM1Vf+kekmf0hjvSWWw+37a1q9+6lpckYDH4CJ7s7lMX0Ov h4DZOQiLMnPYhGazI6nF15kbmtGWQRSBO7wcTkLGszRGA+OKPlmhV4o3bnyPIvUH Do+TpOVSn+WHidZnei9aICN1Q689pHAfjohs7ZsMS+ydXQQR7LFz5P1N8EYXbbeC kweOYWE+2hdw9uAHoloH8DeF0urk2ykhiRp62PhkspF8Ks6eO18yqrLvI28n0mo7 LSHVlnXEPn+qVU7rLQhWc+oo6f2OWvQYWj718/xVKogH/nmIANk1ofpeF9cZ9yYj U2utYkh3lqR94715XHmJ =kUz/ -----END PGP SIGNATURE-----
arkmd has opened a ticket #10309 [https://trac.torproject.org/projects/tor/ticket/10309] for this issue. Let's continue the discussion there. -- Sukhbir
Hi,
Using Thunderbird+Enigmail+Torbirdy.
To solve this the user need to manually set the account drafts settings (in Copies & Folders) to keep drafts on Local Folders.
I think Torbirdy should do it by default.
This info should be added to known issues on Torbirdy wiki.
(If I recall correctly, this issue was discussed before also but I can't seem to find the thread/ticket.) By default, Enigmail saves an encrypted copy of the message. This is the default setting [1] and I think it also confirms this when it saves an encrypted message for the first time. TorBirdy does not modify this setting so it should be enabled by default for Enigmail. If you did not change this setting but still observed this behavior, please open a bug report [2] with all the relevant information (version of Thunderbird, TorBirdy, Enigmail, etc.) so that I can check this. Come to think of it, perhaps we should disable the automatic save feature altogether (#6337). Suggestions welcome. [1] - https://www.enigmail.net/documentation/userprefs.php (see saveEncrypted) [2] - https://trac.torproject.org/projects/tor/wiki/torbirdy/dev -- Sukhbir
Sukhbir Singh wrote (06 Dec 2013 05:49:26 GMT) :
(If I recall correctly, this issue was discussed before also but I can't seem to find the thread/ticket.)
IIRC it was discussed recently on libtech. Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc
participants (5)
-
arkmd -
griffin＠cryptolab.net -
intrigeri -
Nima Fatemi -
Sukhbir Singh