Concern of email client (thunderbird) automatic opening next message

Discussion in 'other software & services' started by phkhgh, Jul 16, 2010.

Thread Status:
Not open for further replies.
  1. phkhgh

    phkhgh Registered Member

    Joined:
    Aug 17, 2007
    Posts:
    186
    I know it's not THE biggest security threat, but I've become more concerned about how Thunderbird jumps to & opens the next message in line after you delete one.

    From reading & listening, there appears to be legitimate concerns about infections by just opening a msg, if it has the 'right' malware. Besides, maybe I just don't want to look at the next msg.

    Way back, seems Outlook / Express had option setting of not jumping to next msg. Thunderbird never has had such an option AFAIK. An addon, Mail Tweak, was mentioned that might allow tweaking this, but no stable release.

    I get more & more spam to accts that I'm very careful about where I use them.

    Any thoughts or suggestions? Thanks.
     
  2. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,010
    Location:
    U.S.A.
  3. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,978
    @phkhgh

    Well it could be if you got the right, err wrong nasty :D

    I havn't used Thunderbird and don't use Outlook/Express. But i know webmail, like hotmail for eg, has a bad habit of also doing that I think there is a topic or two about this somewhere on here.
    You're right to be concerned :thumb: as are lots of other people. The default should be, return to inbox. Very bad practice by ALL concerned :thumbd: this really should have been addressed and sorted out ages ago.
     
  4. phkhgh

    phkhgh Registered Member

    Joined:
    Aug 17, 2007
    Posts:
    186
    Thanks all VERY much for replies. I've been trying to get people / mods on Mozillazine forum interested in this issue for yrs. Mostly, people are ignorant about the risks (no offense). Some scoffed at the idea. Most well meaning, if not incorrect replies, were ~ "Thunderbird won't let anything bad happen just by viewing a msg." According to security experts, that's not true. Now thanks to you folks, I'm getting more info / ammo.

    Even IF it's a smaller risk than opening unknown attachments, it's A RISK that could be avoided easily by simple change in code. As mentioned, I believe OE used to have option to NOT advance to next msg. Mozilla & others sometimes focus more on eye candy.

    JRViejo
    , 1st link you gave lead to this bug report:
    https://bugzilla.mozilla.org/show_bug.cgi?id=573045 that says you can "hide" (question on implications later) by View>Layout> then UNcheck "Message Pane." The "bug" reported is that if don't shut TB before shutting Windows, that pref doesn't stick (so close TB 1st - for now, I guess).

    BUT... someone very knowledgable - possibly only TB developers - would have to VERIFY that by hiding the pane (thus, TB not ** VISIBLY ** jumping to AND DISPLAYING next msg) that it's NOT still OPENING the message out of view.

    IOW, it could be opening the msg, you just can't see it. If that's true, hiding the msg pane provides NO ADDED SECURITY. This is important - like the fine print on a credit card agreement. Just because user can't SEE the msg opening, doesn't tell what's happening in background.

    THAT is a question I've never seen addressed anywhere & probably something even very advanced users may not know for SURE. How could WE find a reliable explanation?

    CloneRanger,
    I agree w/ you & have gotten NOWHERE on this for several yrs. Hackers are becoming very sophisticated.
     
  5. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,010
    Location:
    U.S.A.
    That's a very good question, phkhgh.

    I have to take it at Mozilla's face value that when I tweak the message pane not to show up, that behind the scenes the messages are not being opened. However, if we know that any attachment to those messages can't be opened and embedded message links can't be clicked, until visually seen, besides receiving messages in plain text, then security has not been lowered IMO.

    At the very least, I know that my Portable version does keep whatever settings I tweak. Small comfort, for sure. I'll leave your question open for more advanced users to dissect and explain.
     
  6. MikeBCda

    MikeBCda Registered Member

    Joined:
    Jan 5, 2004
    Posts:
    1,627
    Location:
    southern Ont. Canada
    I've got my TB display options set to "open message in new window" and "close message window after delete", since I want to always return to the inbox after reading a message (in case I want to move that message to another mailbox, f'rinstance). That way I don't have to worry about anything opening automatically.
     
  7. phkhgh

    phkhgh Registered Member

    Joined:
    Aug 17, 2007
    Posts:
    186
    I tried the settings "open message in new window" and "close message window after delete."

    Now, I do still have a display pane showing under the inbox msg list.
    It's true, if I click on the inbox folder, no msgs are displayed (may have been same behavior before). BUT, w/ the settings u mentioned, when double click to open msg in new window, for a fraction of a sec, it displays the msg in the 1st / front display pane, then new window opens.

    IF - - I just CLOSE that new window, it goes back to inbox & same msg is displayed in main msg pane (that's fine).

    IF - - I DELETE the msg opened in a new window (w/ your settings), it goes back to inbox AND DISPLAYS the next msg (not so good). Is this the way it works for you?

    So I don't see a way to delete a msg w/o TB displaying the next msg in line (so far, w/ any settings suggested or I've tried).
    I'm fairly certain that is NOT correct, based on playing around w/ it. No, you can't open an attachment or click on a link if can't see the msg, and those are the biggest risks, but not the ONLY risk of opening a msg. The default behavior is not good, given today's sophisticated hackers. At least need an option to change if next msg is displayed.
     
  8. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,010
    Location:
    U.S.A.
    phkhgh, are you saying that even tweaking the Message Pane not to show (via View > Layout > Message Pane), you are still seeing the Message Pane, when using MikeBCda's suggestion?
     
  9. phkhgh

    phkhgh Registered Member

    Joined:
    Aug 17, 2007
    Posts:
    186
    No. But that doesn't mean much (I'll explain). It's complicated & maybe I didn't explain it well.

    1) Going thru View > layout, does hide the pane... unless grab bottom line w/ mouse & drag the pane back up. Half inch, 3 in - whatever. Which means, the pane isn't really disabled, just hidden and any msg you click on is opened in background, out or sight (out of mind:D). Try it.

    2) One of my main concerns is I can't find a way (regardless of settings) to delete a msg I'm viewing w/o TB auto displaying next msg below it.

    At this point, only way I see to del a msg that you DON'T want DISPLAYED 1st) is
    A) R click the msg & select delete. TB will still advance & open the next msg (out of sight or not, I believe).
    B) DON'T view & del the msg just before the next "spam" msg in line, if you don't want the spam msg opened.

    Appears to be no way to select multiple msg (ctrl + click) w/o one of those being opened - probably 1st one clicked.

    BIG part of prob is before opening the 1st in a list of new msgs, I & lots 'o folks don't study every new msg subj & sender name in the list to deduce if it might be (harmful) spam. So if one reads the 1st msg from a friend, then deletes it, next msg pops up.

    If I'm wrong & there's a sensible way around this, I'm all ears.

    My point is some of the security fixes Mozilla (& others) rush out ASAP have so MANY unlikely conditions, that all must be met at once, that the likely hood of hackers being able to exploit them is essentially non existent. Yet billions of emails are opened each day & methods exist (so I've heard / read experts say) that there's a real possibility of getting infected by OPENING the msg, if your AV doesn't catch it. (Not 5 conditions that all have to be met at once)

    People have been complaining about the "next msg auto - displaying" issue for yrs & they've done nothing. It'd be such a simple fix.
     
  10. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,010
    Location:
    U.S.A.
    OK, I see what you mean now. :thumb: I hide the Message Pane via the Menu and can visually confirm that it's no longer selected, plus the Message Pane is not visible on screen. However, when I drag the bottom line up with the mouse, the Message Pane is activated again (confirmed via View > Layout > Message Pane). Interesting!

    Now I understand why you think that the Pane is still active, yet, I believe it is the action of the mouse gesture that activates the Pane once more. You should explain this mouse action in your MozillaZine thread and why this leads you to believe that the Message Pane is never gone, to see what answer you get.

    In the meantime, I'll try to dig something on my end about this and also why you can't delete a message without auto displaying the next message. Perhaps there is a setting in the Config Editor that can be tweaked. We'll see.
     
  11. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,010
    Location:
    U.S.A.
    phkhgh, found this Change the Advance to Next Unread Message behavior. Although it talks about advancing to the next folder, I read somewhere (saw so many posts that I can't find it now!) that a person changed the default value from ( 1 ) to ( 0 ), via the Config Editor, and it stopped the auto advance when deleting a message. Worth a try.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.