How To Make Thunderbird More Secure

I have been a user of the desktop email client Mozilla Thunderbird for the past five or so years. In that time, I have modified the default settings and behavior of the client to make it more secure against attacks and other malicious activities and issues. This guide acts as an overview of what I have done in those years. Please note that while it makes your email client securer, it does not make the program invincible. Common sense is still one of the most powerful weapons in a computer user's arsenal.

I also have to say at this point that I'm not including add-ons in this guide. This guide only looks at the native options that Thunderbird offers. The majority of changes should also be applicable in other email programs.

1. Disable HTML messages

I get it. HTML messages look nicer. You can do all kinds of things with HTML messages that you cannot do with plain text messages. Plain text messages on the other hand only display textual contents and nothing else, which reduces the likelihood of exploits.

You find the setting under View > Message Body As > Plain Text.

2. Disable JavaScript

The developers have removed JavaScript in Thunderbird 3 for emails completely. There is no option to enable JavaScript for emails. JavaScript for RSS feeds is enabled on the other hand. Thunderbird users who do not use RSS or do not want JavaScript in their feeds can disable it the following way. Click on Tools > Options > Advanced tab > Config Editor to open the advanced configuration window.

Filter for the term JavaScript and double-click JavaScript.enabled to set it to false if it is set to true.

3. Use SSL

You should furthermore make sure that all of your email accounts use SSL connections to protect against snooping and eavesdropping. Click on Tools > Account settings, and there on the Server Settings listing underneath each email account.

Check the help pages or contact support if None is selected under Connection Security. You also need to click on Outgoing Server (SMTP) at the bottom of the listing to see if all outgoing servers are also using SSL for connections.

4. E-Mail Scams

Go to Tools > Options > Security > E-Mail Scams and make sure that Tell me if the message I'm reading is a suspected email scam is enabled. This basically checks back if the email is a known scam email and warns you if it is.

5. Master Password

If you are working on a multi-user PC or want to protect your email passwords from unauthorized access, you should consider setting a master password in the email client for that purpose. Anyone with access to the PC can look at all email usernames and passwords if they are not protected with a master password.

Click on Tools > Options > Security, and check the Use a master password box there to enable the option. You are then asked to enter a password which from that moment on will protect the password database from unauthorized access.

Thunderbird displays a form on start up that asks for that master password. The password quality meter visualizes the strength of the selected password.

6. Disable the preview pane

Thunderbird uses a layout with three panes by default. Email accounts and folders on the left, the email messages on the upper right, and the preview pane at the bottom right.

Email previews are automatically displayed when you select a message in the email client. You may want to disable that feature as it may be used for malicious purposes. Please note that this is unlikely, especially if you have disabled HTML messages and JavaScript.

The easiest way to disable the message preview pane is to press the F8 key on the keyboard. You can re-enable the pane easily with another tap on the same key.

7. Display All Headers

Email headers help you find out if an email is legit or fake. Thunderbird displays a compact version by default which cannot be used to verify an email address. You can enable full email headers with a click on View > Headers > All.

Please note that Thunderbird limits the space available for email headers on its page. You can scroll the page by holding down the left mouse button and moving the scroll wheel up or down.

Closing Words

Add-ons can furthermore improve security but that's outside of the scope of this guide. Let me know if you are interested in a list of security related add-ons for the Thunderbird email client.

Have additional tips you'd like to share? Let me know in the comments.

Advertisement