Opened 7 years ago

Closed 6 years ago

#5797 closed task (fixed)

Review and test Torbutton-birdy

Reported by: mikeperry Owned by: mikeperry
Priority: Medium Milestone:
Component: Applications/TorBirdy Version:
Severity: Keywords: MikePerry201205
Cc: g.koppen@…, tagnaq@…, sukhbir.in@…, proper@… Actual Points: 2
Parent ID: Points: 2
Reviewer: Sponsor:

Description

I promised Jake that if he posted a pre-release of torbutton-birdy publicly to tor-talk I'd review and test it. He did, so I'll review his work and test it in wireshark and see what happens.

Child Tickets

Change History (19)

comment:1 Changed 7 years ago by gk

Cc: g.koppen@… added

comment:2 Changed 7 years ago by cypherpunks

Currently known/open issues:
https://bugzilla.mozilla.org/show_bug.cgi?id=664633
https://bugzilla.mozilla.org/show_bug.cgi?id=669238
timestamp/timezone disclosure via date and message-id header fields.

comment:3 Changed 7 years ago by cypherpunks

+1 known issue:
despite setting

 pref("mailnews.reply_header_authorwrote", "%s");

replies look like:

  author *wrote*:

comment:4 Changed 7 years ago by ioerror

It seems that the above three issues are the current main issues - I'm hopeful that we can integrate a few of the fixes proposed by the Tails team.

Mike - do you have any suggestions for overloading this stuff without having to rebuild TB as we do for TBB? :)

comment:5 Changed 7 years ago by tagnaq

Cc: tagnaq@… added

comment:6 Changed 7 years ago by sukhbir

Cc: sukhbir.in@… added

comment:7 Changed 7 years ago by mikeperry

Yeah, I am downloaded the Thunderbird source to have a quick look at options today. I suspect that you can attack a XUL overlay binding to that damn autoconfig window and write some javascript to keep closing that fucker and/or navigate the user to the advanced window (which I think does not bypass proxy, right?)

I don't have time to write the code for you, but I'll see if I can find the names of the relevant XUL files you need to attach overlays to.

comment:8 in reply to:  7 Changed 6 years ago by ioerror

Replying to mikeperry:

Yeah, I am downloaded the Thunderbird source to have a quick look at options today. I suspect that you can attack a XUL overlay binding to that damn autoconfig window and write some javascript to keep closing that fucker and/or navigate the user to the advanced window (which I think does not bypass proxy, right?)

I don't have time to write the code for you, but I'll see if I can find the names of the relevant XUL files you need to attach overlays to.

This overlay is now in version 0.0.2 thanks to Sukhbir.

comment:9 in reply to:  2 Changed 6 years ago by ioerror

Replying to cypherpunks:

Currently known/open issues:
https://bugzilla.mozilla.org/show_bug.cgi?id=664633
https://bugzilla.mozilla.org/show_bug.cgi?id=669238
timestamp/timezone disclosure via date and message-id header fields.

The timezone disclosure issue should now be fixed in version 0.0.2 as we set it to UTC. It's not fantastic by any means but it is certainly more uniform.

comment:10 Changed 6 years ago by ioerror

Version 0.0.2 is now out for testing/review:
https://lists.torproject.org/pipermail/tor-talk/2012-May/024370.html

We still need to solve the message ID information leak and the reply_header_authorwrote issues. I suspect those are the two main issues left before we might consider a proper release.

comment:11 Changed 6 years ago by mikeperry

How does Thunderbird handle attachments? Does it launch an external app for them automatically?

If so, you may also want to try to adapt the Torbutton component that warns users first:
https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components/external-app-blocker.js

That thing works by hooking the components involved in app launching in Firefox. With any luck, they use the same component for Thunderbird.

Here's how it gets registered:
https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/chrome.manifest#l131

comment:12 Changed 6 years ago by mikeperry

It could also be the case that Thunderbird's app launching is more controlled than Firefox. Firefox tries to have warning dialogs before auto-launching shit, it just fails miserably at it.

The prefs that are *supposed* to cause Firefox to launch a warning dialog are network.protocol-handler.warn*. There's also several other network.protocol-handler prefs that might be relevant.

Probably worth trying those out before trying to port that component over.

comment:13 in reply to:  10 ; Changed 6 years ago by sukhbir

Replying to ioerror:

Version 0.0.2 is now out for testing/review:
https://lists.torproject.org/pipermail/tor-talk/2012-May/024370.html

We still need to solve the message ID information leak and the reply_header_authorwrote issues. I suspect those are the two main issues left before we might consider a proper release.

The reply_header_authorwrote issue has been fixed now.

comment:14 in reply to:  13 Changed 6 years ago by ioerror

Replying to sukhbir:

Replying to ioerror:

Version 0.0.2 is now out for testing/review:
https://lists.torproject.org/pipermail/tor-talk/2012-May/024370.html

We still need to solve the message ID information leak and the reply_header_authorwrote issues. I suspect those are the two main issues left before we might consider a proper release.

The reply_header_authorwrote issue has been fixed now.

I've released version 0.0.3:
https://github.com/downloads/ioerror/torbirdy/torbirdy.xpi

So - I think that means we're not leaking directly from the proxy, not leaking language information, the autoconf wizard is blocked and now setting UTC for everything; what remains to be fixed before we suggest regular people use it?

We do enable warnings for external handlers:
pref("network.protocol-handler.warn-external.http", true);
pref("network.protocol-handler.warn-external.https", true);

What others look important?

We could easily register these as true as well:

network.protocol-handler.warn-external-default
network.protocol-handler.warn-external.file
network.protocol-handler.warn-external.ftp

Thoughts?

comment:15 Changed 6 years ago by ioerror

I added the following warnings in [master 4b0058e]:

network.protocol-handler.warn-external-default
network.protocol-handler.warn-external.file
network.protocol-handler.warn-external.ftp

Shall I make a 0.0.4 release? :)

comment:16 Changed 6 years ago by proper

Cc: proper@… added

Can you get your own trac component torbirdy? That'd be better than having everything inside here in one thread.

comment:17 in reply to:  16 Changed 6 years ago by mikeperry

Component: TorbuttonTorBirdy

Replying to proper:

Can you get your own trac component torbirdy? That'd be better than having everything inside here in one thread.

Yep, we should do this. I just created component TorBirdy and set ioerror as the owner of it for now. We should file all the known bugs there instead of in the TODO file+mailinglist.

comment:19 Changed 6 years ago by mikeperry

Actual Points: 2
Resolution: fixed
Status: newclosed

I gave the new overlay + existing code another pass for potential XUL XSS code exec bugs, and did not see any. Calling this closed.

Note: See TracTickets for help on using tickets.