Bug: E-mail sent with the adress of somebody else

[fredch789]

Hello,

I found a quite strange problem in Thunderbird: by a simple manipulation, it is possible to send an e-mail using an other sender e-mail address than the owner's e-mail address. I do not know if I have to report the exact procedure in here. Please let me know how to proceed next.

Fred

[LIMPET235]

Hi Fred,
Moving this to Thunderbird Support where you will receive assistance.
&....It wouldn't hurt to post exactly what you do to get the error.

[tanstaafl]

That is not a bug. Its a feature of the SMTP protocol that many email clients (such as Thunderbird) use to support things such as aliases or multiple identities. In fact, Thunderbird 45.0 added a feature to make it easier to do that on the fly. Thats useful when your email provider supports "plus addressing" and you want to create a unique disposable address in case the recipient starts sending spam to that address. i.e. use username+something@domain.com instead of username@domain.com. If somebody sends to that address your smtp server will ignore the "+something" part and store it in your inbox. If its spam, you can filter username+something@domain.com without effecting other people trying to send legitimate mail to you.

http://kb.mozillazine.org/Multiple_iden ... il_account
https://www.mozilla.org/en-US/thunderbi ... 0526140950
https://www.fastmail.com/help/receive/addressing.html

[Helvetica]

>and you want to create a unique disposable address in case the recipient starts
>sending spam to that address

but wouldn't it still show the genuine "Sent from" address in one of the header lines ?

[tanstaafl]

Yes, but in Thunderbird's case you'd either need to configure "view -> headers -> all" or use "view -> message source" to see the headers. Few people do something like that with their email client.