thunderbird / thunderbird/thunderbird-android

Display transport security of received email

Open
#1,215 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: enhancement type: security
Dominant language
Kotlin
Stars
14k
Forks
2.8k
Avg merge
3d 3h
Merged PRs (30d)
57

Description

Expected behaviour

An email which was delivered between two servers (i.e. not between a server and itself over a loopback address) should be marked as insecure if it was not done in an encrypted fashion.

An email which was delivered securely in each step should be mark as secure.

Note: This does still apply to PGP/MIME and S/MIME email which otherwise leak information like the subject, to and from address and other headers.

Steps to test
  1. Receive an email sent securely, check the secure indicator is shown.
  2. Receive an email sent insecurely, check the insecure indicator is shown.
Method to implement

Processing of MIME "Received" headers.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the MIME "Received" header processing and the existing secure indicator. Use the listed steps to test messages delivered securely and insecurely, including multi-server delivery. Done means each delivery path is marked secure only when every server-to-server step was encrypted, while loopback delivery is excluded.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
mobile, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.