Live data from Hacker News

Thunderbird 60.0 release

thunderbird.net

1–10 of 57 posts

Re: Thunderbird 60.0 release

#6

> FIDO U2F support Sweet, although IIRC several of the email providers with 2FA (Gmail and Outlook come to mind) have the option of providing app-passwords instead, which bypass the need for a 2FA token.

Which is a generally awful thing, because they bypass the need for a 2FA token.

Re: Thunderbird 60.0 release

#7

> FIDO U2F support Sweet, although IIRC several of the email providers with 2FA (Gmail and Outlook come to mind) have the option of providing app-passwords instead, which bypass the need for a 2FA token.

Just so you know, an app password downgrades the security of your 2FA+Password pairing, and I never use app paswords because of that. If it was somehow possible to intercept the password used in the IMAP handshake, then that means access to your inbox without 2FA. This is why I am a huge fan of web-based clients and not things like Thunderbird.

Re: Thunderbird 60.0 release

#8
If you are on verionsI was just in the same situation, and simply downloaded the installer from their main webpage [1] (after backing up my data in my profiles folder[2] and closing any running instances of Thunderbird), and it simply worked! I have to say, at least on Windows, the update looks much better, feels quite refreshing! Almost makes me want to actually check all the new emails :)

[1] = https://www.thunderbird.net/en-US/ [2] = https://support.mozilla.org/en-US/kb/profiles-where-thunderb...

Re: Thunderbird 60.0 release

#9

> FIDO U2F support Sweet, although IIRC several of the email providers with 2FA (Gmail and Outlook come to mind) have the option of providing app-passwords instead, which bypass the need for a 2FA token.

Just so you know, an app password downgrades the security of your 2FA+Password pairing, and I never use app paswords because of that. If it was somehow possible to intercept the password used in the IMAP handshake, then that means access to your inbox without 2FA. This is why I am a huge fan of web-based clients and not things like Thunderbird.

I could've sworn you had some granular level of control as far as what the apps are allowed to do when they access your Gmail account, e.g. Reading emails only versus read/reply/compose, etc. Maybe I'm thinking of OAuth.

For some reason I also thought there was some way of tying the app's identity to the password, such that if an app other than Thunderbird tried to use my Gmail Thunderbird-app password, Gmail would block it. But I'm probably wrong on that point.

Would be a great enhancement, if not.

Re: Thunderbird 60.0 release

#10
Gee I'm still on version 11. I tried updating once, got a ton of useless crap like calendars and shit and reverted back. Email is one of the few things that I want something very basic and crude.
Post reply on HN