cross-posted from: lemmy.world/post/31800014
cross-posted from: lemmy.world/post/31800014
Please see the cross-post as it is updated.

According to a post online, Thunderbird email client makes connections to sites that have nothing to do with sending and receiving email, for "telemetry" and other questionable reasons

Is this something we should be concerned about? Is there a good alternative to Thunderbird given that it seems to have telemetry implemented inside it?

I use Thunderbird heavily and I'm really worried about this problem. Can someone clarify whether if thunderbird is trustworthy?

Below is the post support.mozilla.org/en-US/ques…

In case it gets taken down, a user asked this:

I would like to know why, when Thunderbird first starts up or shortly thereafter, it attempts to connect to the following sites:

detectportal.firefox.com

status.geotrust.com

thunderbird-settings.thunderbird.net

It does not need to connect to any of these to send or receive email, so I would like to know why it's attempting to connect to those addresses. Little Snitch is blocking them for now but if one of them is important I can remove that block.

Also, at some point every day, Thunderbird complains that it can't get the latest version, and every day I have to dismiss that popup. I bring this up because it may be related to me blocking the connections but until I know what they are for I'd like to know if it is possible to make Thunderbird stop checking for updates.

They all concern me but the one that really concerns me is thunderbird-settings.thunderbird.net, first because it is listed as a bad address on one of the malware sites, and second because I don't want my settings being sent off my computer. Really the only reason I want Thunderbird to connect to the Internet is to send and receive mail, and maybe to check for updates if it can do ONLY that, and not send any other data from my computer back to the mothership.

---

And this was the response, from a "Top 10 Contributor"/"Moderator" (emphasis added):

Firefox.com is owned by Mozilla corporation.

Thunderbird.net is owned by the Thunderbird project / Mzla technologies

GeoTrust is an Audited encryption certificate purveyor with a huge web presence that is a subsidiary of DigiCert, a larger certificate and PKI company.

If you have software identifying either an malware sites or some other imagined bad sites then I suggest you get rid of it. This is course unless you suspect Thunderbird or Mozilla of nefarious intentions in which case you probably want to remove their products and use another mail client and browser.

Why does Thunderbird try and connect to the web? Because significant part off it are web pages. That is why there are so many external preferences loaded in the defaults.

Another response on this site states **support.mozilla.org/en-US/ques… detectportal.firefox.com is used to detect captive portals on public wifi networks to be able to redirect you to their logon screen, so you don't just get page loading errors in firefox (set network.captive-portal-service.enabled to false in about:config in order to disable that feature). Thunderbird ises the Fireofx code base and will be doing the same of web pages.

I would guess without trying that status.geostruct.com is an attempt to verify the legitimacy of a geotrust SSL/TLS certificate issued by probably your mail server as Thunderbird.net uses lets encrypt and Firefox uses Amazon. I assume your connections are encrypted. Probably prompted by the setting Query OSCP responder servers to confirm the current validity of certificates.

I clicked the link you posted to thunderbird-settings.thunderbird.net which gave me a link to docs.kinto-storage.org/en/stab… where I read

At Mozilla, Kinto is used in Firefox for global synchronization of frequently changed settings like blocklists, experimentation, A/B testing, list of search engines, or delivering extra assets like fonts or hyphenation dictionaries.

Given Thunderbird is built on the Mozilla platform, I think we have an answer.

All I can say is in this day and age, software calls home extensively to report telemetry, load web pages and download settings appropriate for certain actions like configuring an account. TRying to prevent that is really limiting the software ability to function as a fairly basic level.

You have listed three of perhaps twice that number of sites Thunderbird will regularly connect to.

On startup it will load a web page from

live.thunderbird.net/

Opening the addon page will load Thunderbird.net pages as will viewing the release notes, or any of the entries on the help menu except about. Some open in a browser window, others open internally to Thunderbird. I have no idea what exact connections are made and I am not aware of any list or page that monitors them.

Checking for updates is not optional, The team do not want folk using old versions of the software as it exposes them to increased security risks as each version contains security enhancements. Updates can be managed in corporate situation using group policies. Otherwise stand alone users are limited in their options options to automatic install or not.

I won't post the user's reply to that (it is a bit lengthy) but he's not happy with the response. He just wants an email client that will connect to Google' email service using oAuth. As he says, he already has several web browsers and doesn't need another. He just wants his email program to do email and that's all, apparently.

I think maybe the Thunderbird developers have some explaining to do, particularly with regard to why they are forcing telemetry on users and giving them no way to opt out.

cross-posted from: lemmy.world/post/31800014
Please see the cross-post as it is updated.