Hardened Thunderbird Android!

[boredsquirrel]

Thunderbird Android is a completely separated project. It is based off the AOSP Mail app, which was continued in the fork "K9-Mail" and got integrated into the Thunderbird project.

The app is thus not based on Firefox or Gecko, and uses no user.js and a different way to store configs.

Still, I am sure this community would be interested in a hardening project. It will be a lot of maintenance, a result would be something like Mull, which is hardened Firefox Android.

Automatically patched codebase, APKs build in CI.

I would like to learn how to do this, and would love to discuss about such a project!

[HorlogeSkynet]

Hello @boredsquirrel ! So now I have extensively browsed K9-Mail/Android TB settings, here is the list of privacy/security-related settings I've noticed :

• General > Display > Show correspondent name
• General > Privacy > Hide mail client (see [RFC] mailnews.headers.sendUserAgent #60) and timezone
• Per account > Reading mail > Show remote images
• (for IMAP) Per account > Fetching mail > Incoming server > Send client information
• Per account > End-to-End encryption

Are you aware of "hidden" settings that should be manually enforced ?
If not, I personally think those 3/4 settings are very easily to find and "intuitively" set to the required value.

Anyway, if your goal is to debloat (is K9 bloated ?), harden and recompile it like Mull does, such a project definitely requires a dedicated repository and maintainer(s).

Bye 👋

[boredsquirrel]

Hi there. I will have to look at it.

I am aware of the GUI settings and they might already make it pretty private. But there will be more things for people that want extreme privacy, like timezone, language etc.

Also looking at hardening the code would be interesting. There might be things that can be improved.

That sounds highly technical and kinda vague though. So until we find something worth fixing, I wouldnt invest effort in it :)

[lucasmz-dev]

Pretty sure K9/Thunderbird uses the system webview for showing e-mail content btw. It failed when I had it disabled (accidentally).

[HorlogeSkynet]

Hello @lucasmz-dev, even for plain text e-mails ? That would seem surprising though. Did you try with Bromite set as default ?
Thanks, bye 👋

[lucasmz-dev]

When I have no WebView set (after a restart), everything seems to work except getting inside an email. Doesn't seem to matter which... So that's me extracting a "fact" out of a side-effect, makes sense to me though /shrug

I wouldn't use Bromite, Bromite is terribly out of date by now, and would be a bad idea IMO. Cromite has the browser but I don't think its webview is as easily installable in this case or cared for as much? IIRC it has the same package name as the system one so ehhh.

I use CalyxOS, it works fine with its one, and also with Mulch System WebView which is whitelisted for use by CalyxOS as well, and a few others, like I believe Google's as well if someone really needs that for some reason.

Edit: Bromite isn't even whitelisted for use in Calyx anymore (if it even was at some point)

[HorlogeSkynet]

Interesting related thread : https://forum.k9mail.app/t/hardening-k9-done-already/7796.

[lucasmz-dev]

I feel like a lot of the thunderbird hardening is more relevant to the fact that Thunderbird for desktops is Firefox, a while browser forked to be an email client, while Thunderbird for Android is just K9, which is a native client. The displaying content is the more scary part, but they're using WebView, as long as that's properly restricted, it sounds fine though. You shouldn't be able to run JavaScript or WASM for example.

One thing that Thunderbird could add to Android (which is possible on PC with extensions) is a DKIM verifier, I know of some popular email servers people use that have improper DMARC tests atm.