The Thunderbird Privacy Guide for Dummies!

34 thoughts on “The Thunderbird Privacy Guide for Dummies!”

1. Good guide, I’d also advise using Enigmail for additional protection though.
   You could also use one of the following private email provides:
   ProtonMail (requires bridge for Thunderbird usage)
   CounterMail (requires premium for IMAP/SMTP support)
   Hushmail
   Mailfence (requires paid plan for IMAP/SMTP)
   Disroot
   Runbox
   Posteo.de
   LuxSci
   mailbox.org
   StartMail

   There are probably other services out there but I think this is enough for now.

   Reply to '512Kb'

   1. thanks for the comment

      an alternative to Enigmail for those interested is Autocrypt

      and one mail provider i’d add to your nice list is Lavabit – yes, Ladar is back in business :)

      i use and like Runbox

      Reply to '12Bytes'

2. Hi, Thank you for this useful guide.
   When you say: “Any time you update the ‘HorlogeSkynet’ user.js, or edit your user-overrides.js, you should always run the ‘arkenfox’ prefsCleaner.sh (Linux) or prefsCleaner.bat (Windows) script in order to reset any old/removed/depreciated preferences, otherwise they will remain active in Thunderbird’s prefs.js file. ”
   Should I run the arkenfox’ prefsCleaner.sh when I follow your guide for the 1st time (running ./updater.sh for the 1st time)? And should I run the arkenfox’ prefsCleaner.sh before or after running ./updater.sh?

   Thanks.

   Reply to 'Damien'

   1. you can run the prefsCleaner script any time you want, however you should always run it after the ‘HorlogeSkynet’ user.js is updated

      to answer your ? more accurately, no, you don’t have to run it before updater.sh, but you can run it after to clean up any old prefs that may be listed as depreciated, etc., in user.js

      Reply to '12Bytes'

      1. Ok, thanks. So I shouldn’t run prefsCleaner script now as I installed user.js for the first time, but I should run it from now on each time I update the user.js… Am I right? Sorry to insist, english isn’t my native language.

         Reply to 'Damien'

         1. you can run the cleaner script any time, even before you run the updater script

            just be sure to always run it after the updater script updates user.js

            make sense?

            Reply to '12Bytes'

            1. Yes, it makes sense, thank you. :-)

               Reply to 'Damien'

            2. I have another problem. When I try to run the prefsCleaner.sh script, it says:
               ”
               This script should be run from your Firefox profile directory.
               It will remove any entries from prefs.js that also exist in user.js.
               This will allow inactive preferences to be reset to their default values.
               This Firefox profile shouldn’t be in use during the process.
               1) Start
               2) Help
               3) Exit
               #? 1

               This Firefox profile seems to be in use. Close Firefox and try again.

               Press any key to continue.
               ”

               So I can’t run it. But Thunderbird isn’t launched when I try to run ./prefsCleaner.sh … What could cause that? Is there a way to bypass this warning?

               Thank you.

               Reply to 'Damien'

               1. odd – i run Linux also and prefsCleaner.sh doesn’t warn about t-bird OR firefox running even when they are, so there may be a problem with the script (i’ll mention this to the arkenfox user.js guys)

                  this is the block of code that does the checking:

                  
while [ -e webappsstore.sqlite-shm ]; do
echo -e "\nThis Firefox profile seems to be in use. Close Firefox and try again.\n"
read -p "Press any key to continue."
done


                  you can do this with it and try running the script again…

                  
#while [ -e webappsstore.sqlite-shm ]; do
# echo -e "\nThis Firefox profile seems to be in use. Close Firefox and try again.\n"
# read -p "Press any key to continue."
#done


                  Reply to '12Bytes'

                  1. Thanks! I tried first adding ‘#’ to the lines but it didn’t work and had an error message on line 34. So I deleted the lines and ran ./prefsCleaner.sh and it worked. I wonder why the check is faulty…

                     Reply to 'Damien'

                     1. i don’t know, but i informed the developer about it

                        Reply to '12Bytes'

                  2. Another question… I edited the user-overrides.js file. Then copied/pasted its content on an empty line at the end of the user.js file. Then ran the prefsCleaner.sh script. Is it the correct procedure?

                     Should I then leave the copied/pasted content from the user-overrides.js file in the user.js file? Or leave it there and next time I edit user-overrides.js I copy/past over it?

                     Reply to 'Damien'

                     1. the updater.sh script will automatically append user-overrides.js to user.js – you don’t have to do it manually, but you can

                        and yes, that needs to stay there (firefox/t-bird doesn’t read user-overrides.js)

                        Reply to '12Bytes'

                  3. And last question (sorry for taking your time). I followed the “INTEGRITY CHECK 1” and have this result (screen shot):
                     https://i.imgur.com/wGJcgKV.png

                     value is “USER SETTINGS LOADED”
                     but you say (in the user-overrides.js file) it should be:
                     value is “12bytes.org USER SETTINGS LOADED”

                     Is it ok or does it mean I didn’t pass the integrity check?

                     Reply to 'Damien'

                     1. yes, you passed – i fixed the typo in the file and will upload later

                        Reply to '12Bytes'

                        1. Ok, thank you for your kind help and explanations.

                           Reply to 'Damien'

3. Hello,

   When using user.js and your user-overrides.js with the cardbook addon https://addons.thunderbird.net/en-US/thunderbird/addon/cardbook/ , the adress book (remote adress book I have on my nextcloud server) is forgotten each time I close/start Thunderbird. I have to re-enter the url of my adress book and credentials each time I start Thunderbird.

   Do you know what can cause this behaviour?

   Thank you.

   Reply to 'Damien'

   1. i would suspect the problem is blocked cookies, but if it’s more than that then see this

      Reply to '12Bytes'

      1. Thks, I will try to investigate with your link. For the time being I tested by doing the following:
         -I uninstalled user.js and user-overrides.js and this is what happened: Cardbook showed the contacts (without me adding the contacts url from my nextcloud again). So I suspect something in user.js or user-overrides.js prevents cardbook to show the contacts (cardbook seems to remember the contact url from my server but doesn’t show the contacts for whatever reason).

         Reply to 'Damien'

         1. couple points…

            * when you’re troubleshooting, you should *always* make a backup of your profile
            * you never have to “uninstall” user.js – you can just rename it (user.js.bak) so Firefox can’t read it
            * Firefox never reads user-overrides.js, so there’s no point in removing it for troubleshooting

            you should read the link i gave, as well as what it says in the user.js and user-overrides.js files

            Reply to '12Bytes'

            1. Thks for the tips.

               Reply to 'Damien'

4. After putting the user.js and your user-overrides.js into practice I can no longer add a new email account. I cannot work out why.

   I started with a new blank profile. After starting Thunderbird I only added 1 account and closed Thunderbird. Then put the user-overrides.js, updater.sh and prefsCleaner.sh into the Thunderbird profile directory. Ran the updater and prefsCleaner scripts. Thunderbird starts and works perfectly fine, but I cannot add any additional email accounts.

   The option in the user UI to add an account is available and when I click it the dialog to add the new account opens. I can type in all of the required information but nothing happens when I click the Continue button. I can click on “Manual config” and if I check the settings it all looks ok but on this menu the “Done” button is grayed out. It is definitely something in the hardening that causes this.

   I have created two hardened profiles, on the Thunderbird I use for personal and the one I use for work, both behave exactly the same.

   Do you have any idea why?

   Reply to 'AK47'

   1. [SECTION 6000]: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) in user.js – just reset those prefs

      ran into the same problem myself but never updated user-overrides

      more here

      Reply to '12Bytes'

      1. Ok I see the problem with the account adding wizard (taking into consideration that user.js disables server auto-config). The “Port” , “SSL” , “Authentication” options on the “Manual config” window also needs to be set manually for the buttons to become enabled.

         I do understand the privacy concerns though with using the auto-config because that sends info to Mozilla.

         Thanks!

         Reply to 'AK47'

5. Do you know if Interlink Mail is a good alternative to Thunderbird? I’m only concerned about the smaller development team not being about to patch out security issues but considering Thunderbird’s team also keeps downsizing, I’m not sure that really matters.

   Reply to '512Kb'

   1. sorry, i know nothing about Interlink Mail – however, i believe Mozilla is working on Thunderbird once again – correct me if i’m wrong

      Reply to '12Bytes'

6. just wanted to ask – is the latest/current thunderbird user.js v78.1 still recommended as the current version of thunderbird is at v91.4.1

   thank you

   Reply to 'joeshmoe'

   1. yes – look here

      Reply to '12Bytes'

7. What happened to the updater.sh script? i no longer see any mention of it in your article. I still have a copy which i use and it seems to work as expected, so just wondering.

   Your article now instead instructs to copy and paste the contents of the user-overrides.js file to the end of the user.js file.

   Reply to 'Sherlock Holmes'

   1. the updater script was made using the script for the arkenfox user.js but i never kept up with the changes they made, which is why i dumped it – you can use theirs if you want, you’ll just have to make a few changes

      Reply to '12Bytes'

      1. It still works as is though. I didn’t think anything in it would really need to change unless i guess the download location for the user.js file changes. Otherwise it still downloads the latest user.js file and appends the user-overrides.js.

         Maybe worth putting it back? You know, for dummies. :-)

         Reply to 'Sherlock Holmes'

         1. for me it’s unnecessary and i don’t like publishing stuff i don’t use myself or don’t have an interest in maintaining

            Reply to '12Bytes'

8. There is something else that i have been meaning to ask you for a long time. Usually when you reply to a message in a mail client the original message is copied to the new mail and the header is copied that shows the date time etc of the original message being replied to. The same happens when you forward an email.

   However, after i apply the user.js file and i reply to a message the header is no longer copied. It is still copied when i forward but not when i reply. Do you know why that would be?

   Reply to 'Fixing Issues'

   1. no idea – i never noticed this – you can do the process of elimination thing to find the pref that’s causing this

      Reply to '12Bytes'