0

There shouldn't be a high security risk as long as the email attachments aren't opened / executed by the user but it could still be a risk and maybe I'm wrong.

So how does Thunderbird quarantine email attachments? (For example to prevent other programs from executing malicious attachments.) And is that method secure or would storing emails offline be a dangerous thing to do?

mYnDstrEAm
  • 319
  • 2
  • 17

1 Answers1

2

So how does Thunderbird quarantine email attachments?

Not at all.

(For example to prevent other programs from executing malicious attachments.)

Again, not at all. There's no way this is possible without taking over the OS. Any normal program can read the files where Thunderbird stores it's mails.

If this is a problem because a program could execute malicious attachments, you already have a problem because there's a malicious program already running.

would storing emails offline be a dangerous thing to do?

From a technical point, no. (Depending on the content of your mails, there might be legal problems if mails are found, or anything like that).

In theory it's possible that the text content of the mail contains text that triggers a critical bug (in Thunderbird or in the OS or...), but that's true for all programs, and not likely in case of email text.

However, one thing that you didn't mentioned: Viewing HTML mails.
It would be better to not do that, ie. configure Thunderbird to always display raw text (and ignore senders that are too stupid to include text versions). With any "active" (JS) or external (CSS, images, ...) content, there are plenty harmful things that can be done. And even with things like image blockers and so on, it's still a risk.

deviantfan
  • 3,854
  • 21
  • 22
  • It might not even require a malicious program running - it could be enough to exploit nonmalicious programs. Very disappointed that Thunderbird doesn't even quarantine email attachments. I set View -> Message Body As to "Plain Text". Thank you. – mYnDstrEAm Aug 25 '17 at 11:55
  • 2
    @mYnDstrEAm a) What nonmalicious programs just search programs in mails and start them automatically? – user155462 Aug 25 '17 at 12:20
  • 2
    @mYnDstrEAm b) It might help if you define "quarantine". If you mean "prevent reading of a file", like I understood, there's no way for Thunderbird to do this. Thunderbird can just use what the OS provides ... anyways, you won't find a mail client that does what you want, because of that. – user155462 Aug 25 '17 at 12:21