<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Re asking for a master password on startup: This was actually
implemented in core on trunk (bug 1610390), but there's a problem
on Mac (bug 1612456) so not enabled by default yet. With this pref
set you'll be asked for master password on startup, if you have
one set.</p>
<p> -Magnus<br>
</p>
<div class="moz-cite-prefix">On 2020-03-12 16:38, Jacques Angevelle
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4ab17d6d-018c-d282-5855-2ba18f0f34e7@free.fr">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
Matt,<br>
I agree with you that using add-on to implement that feature is
not the good way BUT I really think that asking that password in
the core process would be useful in term of security and in other
ergonomic aspects: if you don't submit the master password in
time, the mail server gives you a time out diagnostic: "not able
to connect, type again your password or re-try" and this is also
frustrating for the user.<br>
I also think that this could be responsible if it is properly
implemented. There are a lot of users who ask that feature, soon
or late, this will be offered with an add-on and just saying "it
is irresponsible" will not prevent from the so called "security
breach"<br>
Jacques <br>
<br>
<div class="moz-cite-prefix">Le 10/03/2020 à 13:08, Matt Harris a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:%3Ccd41a2df-1dc6-f5e6-eddc-14012adbdfa0@gmail.com%3E">
<div class="moz-cite-prefix">I have been listening to people
purport that having a password on startup offers some sort of
security benefit for as long as I have been associated with
Thunderbird. I have seen more than one add-on used to try and
enforce such a regime, and listened to the spurious complaints
about how security has now been broken because mail is
displayed now even with a master password set. The fact two
escape presses bypassed a master password prompt appears to be
lost on almost everyone.<br>
<br>
For the life of me I can not understand what benefit this
offers. All I see is a group of people that want user
software to start offering features they are reluctant to use
in their operating systems. (user authentication and password
protected screen savers.) They want this replaced with a box
that asks a password. Nothing else, just a password that
stops the program loading. No data encryption, no password
required to return from say a blanked screen, just a startup
password that does nothing, except slow startup.<br>
<br>
This is a "feature" that has <a moz-do-not-send="true"
href="https://bugzilla.mozilla.org/show_bug.cgi?id=16489">been
in bugzilla</a> for over 20 years and a decision was made 9
years ago that it would not be implemented. Yet here we are
still listening to folks suggesting if users needs were being
met it would be in the product. I think to implement this,
would be irresponsible. <br>
<br>
Matt<br>
<br>
</div>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
tb-planning mailing list
<a class="moz-txt-link-abbreviated" href="mailto:tb-planning@mozilla.org">tb-planning@mozilla.org</a>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/tb-planning">https://mail.mozilla.org/listinfo/tb-planning</a>
</pre>
</blockquote>
</body>
</html>