[Users] claws-mail does not remember password even though the "Remember with password manager" option is checked

Tue Mar 8 22:53:33 CET 2022

Good afternoon!

"Your version of Linux Mint is not significant here, what is or could
be, significant is the version of Claws Mail you refer to, but you
don't mention that."

My Claws version is 3.17.5, it's what ships with my version of Mint.

"Remember with password manager" is not from Claws Mail. This sentence
appears nowhere in Claws Mail. So whatever is asking to remember your
password is not Claws Mail."

In any case, Claws will not let me access my e-mail without entering
the password at that prompt. Further, that prompt steals complete focus
and locks me out of all windows until I enter the password, which I
can't access because I'm locked out. I had to change my TTY pin entry
settings in ~/.gnupg/gpg-agent.conf to force the prompt to remain in
the terminal instead of launching a window. In the terminal, the prompt
just says: "Passphrase:" and it will not open my e-mails until I enter
it.

"Always a bad idea to reuse passwords, especially one so significant as
the gpg password." Please explain. If someone breaks into my system
it's game over and they own all passwords. I don't see how having a
different account password from gpg password makes any difference; it's
one service. All my other services have different passwords and I don't
use this gpg key anywhere else. I don't even think it's possible for me
to have different passwords. My e-mail provider requires the gpg key
for login and accepts whatever password goes with that key. If there is
a way to split the account password from the gpg password I'm not aware
of it, but in any case, that my e-mail isn't so important that I need
the security (and hassle) of two passwords.

"Claws Mail is not a gnome program and has nothing to do with
gnome-keyring...Your gpg-agent settings will control your interaction
with gpg on your system, not specifically in Claws Mail."

Well something is causing Claws to use gnome-keyring and/or gpg-agent
when it's installed. I don't know enough about how my system works
under the hood to comment further on that aspect. All I see is what's
going on on the surface.

So if Claws operates without any keyring or gpg-agent then where does
it store my private keys or how does it access them?

"Go to your account preferences in Claws Mail and enter your password
on the 'Basic' page."

It's alread entered. The only thing is, it appears as a hexadecimal
number. Is that normal? The hexadecimal number in the 'Password' field
in 'Basic' in 'Account preferences' doesn't match anything I have. My
IMAP key is a different hexadecimal number. I tried entering the raw
account password and the IMAP key, both of which are different than
what is currently entered. I did that for all 132 accounts, closed
Claws out and restarted it. The result in both cases is:

"Error
Connection to imap1.countermail.com failed: login refused.

CRAM-MD5 logins only work if libetpan has been compiled with SASL
support and CRAM-MD5 SASL plugin is installed."

I checked the log and it says the same thing with no other info. It
then opens a prompt in a window:

"Input password
Input password
Input password for jmgroup on imap1.countermail.com:
[checkmark] Remember password for this session
[Cancel] [OK]"

Of course, I wish it would remember the password permanently and not
just for this session. When I enter the password the same error pops up
again and I'm locked out of my e-mails. Then in the terminal, it says:
"Passphrase: ", I enter the password there, and then it allows me into
my e-mails. (If I used the default gpg-agent settings it would launch a
window to prompt for the password but that was causing problems.)

I then close out of Claws, restart it, and get the same CRAM-MD5 error
and "Input password" prompt with the "Remember password for this
session" checkmark. Again it rejects my password until I enter it into
the terminal.

There is no CRAM-MD5 SASL plugin that I'm aware of, or if there is one
it's not available to install from
/usr/lib/x86_64-linux-gnu/claws-mail/plugins. All there is is
bogofilter.so, pgpcore.so, pgpinline.so, pgpmime.so, smime.so, and
spamassassin.so, all installed except bogofilter.so and
spamassassin.so. The package 'libetpan20' is installed'. I assume it
has SASL support. I tried googling that error and found absolutely
nothing useful.

I'm glad I backed up my passwordrc, because I needed to restore it to
at least get rid of that error. (It still prompts me for password.) The
unrecognizable hexadecimal number in the password field is back but
there is no CRAM-MD5 error.

And that's where I get stuck. To my knowledge there is nothing else I
can put in that password to access my e-mail and not have errors.

By the way, can you give the exact syntax I need to manually encrypt
and decrypt passwords for ~/.claws-mail/passwordrc using openssl in a
terminal? I require this capability to manage the extreme number of
accounts I have, using scripts.

Thank you!

On Tue, 8 Mar 2022 10:43:15 -0000
Paul <paul at claws-mail.org> wrote:

> 
> 
> --- Start of PGP/Inline encrypted data ---
> On Tue, 8 Mar 2022 00:19:24 -0600
> lmfrm <lmfrm at nanogroup.xyz> wrote: 
> 
> > I had been using Linux Mint 18 Mate 64-bit and upgraded to Linux
> > Mint 20.3 XFCE 64-bit recently.
> > 
> > After this upgrade, I installs claws-mail from the repository
> > and transferred all claws-mail settings from the old OS to the new.
> 
> Your version of Linux Mint is not significant here, what is  or
> could be, significant is the version of Claws Mail you refer to, but
> you don't mention that.
> 
> > It no longer remembers the password despite checking the "Remember
> > with password manager" checkbox. (I don't know what 'password
> > manager' it's referring to.)
> 
> "Remember with password manager" is not from Claws Mail. This sentence
> appears nowhere in Claws Mail. So whatever is asking to remember your
> password is not Claws Mail.
> 
> > I'm using pgp e-mail but it doesn't tell me if it's asking for the
> > account password or the gpg password--in any case, mine happen to be
> > one and the same.
> 
> Always a bad idea to reuse passwords, especially one so significant
> as the gpg password.
> 
> >  I don't think gnome-keyring stored my password unless claws-mail
> > put it there.
> 
> Claws Mail is not a gnome program and has nothing to do with
> gnome-keyring.
> 
> > My private keys are stored in my gpg keyring but of course, the
> > password is not because pgp keys are just encrypted blobs and don't
> > include passwords. However, I configured ~/.gnupg/gpg-agent.conf as
> > follows just in case it had anything to do with claws checking
> > passwords:
> > default-cache-ttl 999999
> > max-cache-ttl 999999
> > but it did nothing.
> 
> Your gpg-agent settings will control your interaction with gpg on your
> system, not specifically in Claws Mail.
> 
> > I just wish to not have to type my account/gpg password incessantly;
> > this is impractical.
> > 
> > Where might I be going wrong? Or is it a bug?
> 
> Go to your account preferences in Claws Mail and enter your password
> on the 'Basic' page.
> 
> with regards
> 
> Paul
> _______________________________________________
> Users mailing list
> Users at lists.claws-mail.org
> https://lists.claws-mail.org/cgi-bin/mailman/listinfo/users
> --- End of PGP/Inline encrypted data ---
> 
> 