audit claws mail

Originally created by Tails on #6119 (Redmine)

Message-ID

Tails currently sets domain=localhost in accountrc.tmpl.

An account created from this template on Tails devel branch (Debian Squeeze, Claws Mail 3.7.6-4) ends up with set_domain=0 and domain=, and the Message-ID is generated using the hostname part of the sender’s email address.

Tails 0.6 uses the same Claws Mail version (from Debian backports).

EHLO/HELO

Outgoing EHLO/HELO SMTP commands can also leak private information (see this or-talk thread about it.

According to our tests claws-mail always says EHLO localhost, whatever value the domain is set to.

HTML / Javascript

Optional plugins (fancy, dillo, html2, etc.) can render HTML e-mail. Without any of them, claws-mail does basic HTML formatting (e.g. links) by default. The render_html prefs item, when set to false, fully disables HTML rendering.

Tails currently uses the following HTML-related settings:

render_html=0
invoke_plugin_on_html=0
promote_html_part=0

Resources

torsocks homepage has some test results about Claws Mail
blog post about using Claws Mail with torsocks
the TorifyHOWTO currently only contains information copied from the torsocks homepage, but it’s still worth being watched for updates

Parent Task: #5769

_Originally created by Tails on [#6119 (Redmine)](https://public-redmine-archive.tails.boum.org/code/issues/6119)_

# Message-ID

Tails currently sets `domain=localhost` in `accountrc.tmpl`.

An account created from this template on Tails devel branch (Debian
Squeeze, Claws Mail 3.7.6-4) ends up with `set_domain=0` and `domain=`,
and the `Message-ID` is generated using the hostname part of the
sender’s email address.

Tails 0.6 uses the same Claws Mail version (from Debian backports).

# EHLO/HELO

Outgoing EHLO/HELO SMTP commands can also leak private information (see
[this or-talk thread about
it](http://archives.seul.org/or/talk/Aug-2008/msg00261.html\)).

According to our tests claws-mail always says `EHLO localhost`, whatever
value the `domain` is set to.

# HTML / Javascript

Optional plugins (fancy, dillo, html2, etc.) can render HTML e-mail.
Without any of them, claws-mail does basic HTML formatting (e.g. links)
by default. The `render_html` prefs item, when set to false, fully
disables HTML rendering.

Tails currently uses the following HTML-related settings:

render_html=0
    invoke_plugin_on_html=0
    promote_html_part=0

# Resources

- [torsocks homepage](http://code.google.com/p/torsocks/) has some
    test results about Claws Mail
  - [blog
    post](http://rorschachstagebuch.wordpress.com/2008/11/02/claws-mail-zweit-profil-fur-tor/)
    about using Claws Mail with torsocks
  - the
    [TorifyHOWTO](https://wiki.torproject.org/noreply/TheOnionRouter/TorifyHOWTO)
    currently only contains information copied from the torsocks
    homepage, but it’s still worth being watched for updates

Parent Task: tails/tails#5769

Edited May 15, 2020 by import-from-Redmine

To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information