[tor-talk] Thunderbird leak

[Mike Cardwell]

* on the Sun, Jan 26, 2014 at 12:04:24PM -0600, Joe Btfsplk wrote:

> I've seen a few links in emails  open in new Tbird tabs, instead of 
> Firefox (email from persons I know, or think I know it's from them) .
> I usually just copy links & paste in Fx.  Safer.  If it's from someone I 
> know AND was expecting a msg, I rarely forget & just click links.  
> Rarely, those WILL open in a new Tbird tab, but usually in default 
> browser (Fx).

As mentioned in the blog post, when right clicking one of these links
in order to select "Copy Link Location" from the context menu, you will
find that the option is missing. I imagine that many people at this point
would skip their usual copy/paste routine and just click the link for
convenience.

> Don't know if has (anything) to do w/ Tbird options setting, under 
> Advanced > Reading & Display:  "Open Messages In":  New tab; New msg 
> window; Existing msg window.
> Never seen a Tbird setting about "open links in...".

You're definitely not supposed to be able to do this. Mozilla
acknowledged that it was a security issue and classified it as moderate.
It has been over two years since I told them about it and it hasn't
been fixed, hence why I am now making it public.

-- 
Mike Cardwell  https://grepular.com/     http://cardwellit.com/
OpenPGP Key    35BC AF1D 3AA2 1F84 3DC3  B0CF 70A5 F512 0018 461F
XMPP OTR Key   8924 B06A 7917 AAF3 DBB1  BF1B 295C 3C78 3EF1 46B4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 598 bytes
Desc: Digital signature
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20140126/ecd0e19d/attachment.sig>