bugtraq - Re: [Full-disclosure] Mozilla Thunderbird : Multiple Information Disclosure Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <44077B3A.8040300@cruzio.com>
Date: Thu, 02 Mar 2006 15:09:46 -0800
From: Daniel Veditz <dveditz@...zio.com>
To: Nick Boyce <nick.boyce@...il.com>
Cc: bugtraq@...urityfocus.com, security@...illa.org
Subject: Re: [Full-disclosure] Mozilla Thunderbird : Multiple Information
 Disclosure Vulnerabilities

Nick Boyce wrote:
> Hmmm. I didn't realise the "Show Images" setting got stored, and I
> don't think that's the best strategy from a privacy point of view.

It surprised me, too. The threat model was spammers trying to verify
live addresses, and in that model loading a webbug multiple times is no
worse than loading it once. Mail usage spying like the "ReadNotify"
service was apparently not considered.

> I take it you mean "stored for that one message",

Yes, just that one message.