<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Matt,<br>
I agree with you that using add-on to implement that feature is not
the good way BUT I really think that asking that password in the
core process would be useful in term of security and in other
ergonomic aspects: if you don't submit the master password in time,
the mail server gives you a time out diagnostic: "not able to
connect, type again your password or re-try" and this is also
frustrating for the user.<br>
I also think that this could be responsible if it is properly
implemented. There are a lot of users who ask that feature, soon or
late, this will be offered with an add-on and just saying "it is
irresponsible" will not prevent from the so called "security breach"<br>
Jacques <br>
<br>
<div class="moz-cite-prefix">Le 10/03/2020 à 13:08, Matt Harris a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:%3Ccd41a2df-1dc6-f5e6-eddc-14012adbdfa0@gmail.com%3E">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="moz-cite-prefix">I have been listening to people
purport that having a password on startup offers some sort of
security benefit for as long as I have been associated with
Thunderbird. I have seen more than one add-on used to try and
enforce such a regime, and listened to the spurious complaints
about how security has now been broken because mail is displayed
now even with a master password set. The fact two escape presses
bypassed a master password prompt appears to be lost on almost
everyone.<br>
<br>
For the life of me I can not understand what benefit this
offers. All I see is a group of people that want user software
to start offering features they are reluctant to use in their
operating systems. (user authentication and password protected
screen savers.) They want this replaced with a box that asks a
password. Nothing else, just a password that stops the
program loading. No data encryption, no password required to
return from say a blanked screen, just a startup password that
does nothing, except slow startup.<br>
<br>
This is a "feature" that has <a moz-do-not-send="true"
href="https://bugzilla.mozilla.org/show_bug.cgi?id=16489">been
in bugzilla</a> for over 20 years and a decision was made 9
years ago that it would not be implemented. Yet here we are
still listening to folks suggesting if users needs were being
met it would be in the product. I think to implement this,
would be irresponsible. <br>
<br>
Matt<br>
<br>
</div>
</blockquote>
<br>
</body>
</html>