You can find build instructions in the projects README file. Thatfile also includes instructions on how to use our precompiled binariesfor Windows.

The Octopus is actively developed by the Sequoia PGP team. We areprimarily financed by the pep foundation. Our mandate isspecifically to improve the OpenPGP ecosystem, and more generally toimprove internet freedom tools.

Currently, the Octopus is developed outside of Thunderbird. There aretwo main reasons for this. First, the Thunderbird developers do notwant to invest resources in supporting a new OpenPGP backend afterhaving recently invested in RNP. Second, Sequoia and the Octopus arelicensed under the GPLv2+. Although the GPLv2+ is compatible withMPL 2.0, adding GPLv2+ code to Thunderbird is not currently alignedwith their licensing strategy.

Admittedly, implementing another library’s API is a bit dodgy.Long-term we’d like to see Thunderbird adopt SOP. SOP is aStateless OpenPGP API. The current version only targets the CLI, butthere is work to standardize a C API and ABI. Using SOP would allowincreased choice for users. It also gives Thunderbird more freedom toeasily change their implementation should the need arise.

The Octopus includes a number of additional features that enhanceThunderbird. We suspect that for many users, the integration withGnuPG will be most interesting. But, we’ve also added a Parcimonieimplementation, and fixed some security weaknesses.

GnuPG Keyring Integration

When Thunderbird starts, it asks RNP to parse its keyring. At thispoint, the Octopus also runs gpg --export and includes that in theresults. This makes the user’s GnuPG keyring available toThunderbird. (From that point on the Octopus also monitors GnuPG’skeystore for updates.) This can be disabled by setting theGNUPGHOME environment variable to /dev/null as follows:

The certificates imported from GnuPG can be used as normal. It ispossible to examine them in Thunderbird’s OpenPGP Key Manager, settheir “acceptance”, etc.

Birds Nest Tbird

There are two known limitations. First, the first time an OpenPGPoperation is performed, Thunderbird scans the keystore and creates anindex of the available keys. Thunderbird does not currently updatethis index on its own. Thus, keys that are added to gpg’s keystorewill not be visible to Thunderbird until either the cache is manuallyflushed (OpenPGP Keyring Manager, File, Reload Key Cache), oryou restart Thunderbird. Second, if you remove a certificate managedby GnuPG using the Thunderbird certificate manager, it will be removedfrom the in-memory keystore, but it is currently not actually removedfrom your gpg keystore. As such, it will reappear the next timeThunderbird loads the keyring.

The Octopus carefully keeps track of what certificates were loadedfrom GnuPG and only writes them out to Thunderbird’s keyring if theyhave been modified; modified certificates are not currently writtenback to GnuPG. But, closer integration with GnuPG’s keyring isplanned.

gpg agent Integration

The Octopus automatically monitors what keys are loaded into gpg’sagent, and reports to Thunderbird that secret key material isavailable for them. This means that it is trivial to mark a keymanaged by the agent as a personal key in Thunderbird withoutmodifying Thunderbird’s configuration files. Also, attempts to decryptmessages encrypted to a key managed by the agent are automaticallyforwarded to the agent for decryption.

Unlike Thunderbird the Octopus talks directly to the agent. Thus,it is not necessary to install GPGME; you only need to have gpg inyour PATH.

GnuPG’s Web of Trust Data

Thunderbird only supports a custom “acceptance” mechanism forauthenticating OpenPGP certificate. Thunderbird ignores keysignatures, and it is not possible to add certification authorities.

When Thunderbird starts up, the Octopus reads gpg’s trust database,and merges it into Thunderbird’s acceptance database. This meanscertificates that are considered authenticated by GnuPG are alsoconsidered authenticated by Thunderbird.

This integration is done carefully. If a user has manually accepted acertificate in Thunderbird, that setting is not overridden. Thishappens not only during the initial import, but also later: when theuser accepts a certificate in Thunderbird, the Octopus detects thisand will no longer update that certificate’s acceptance based onGnuPG’s trust database.

The Octopus monitors GnuPG for changes to its trust database. So,unlike when a new certificate is added to GnuPG’s keystore, it is notnecessary to restart Thunderbird to notice changes to the trustdatabase.

Parcimonie

Parcimonie is a feature that automatically refreshes the user’sOpenPGP certificates in the background using a number of privacypreserving techniques. In particular, updates are staggered, and thetime between updates is drawn from a memoryless distribution tofrustrate an attacker who wants to predict when a user will check foran update. Enigmail had its own version of this mechanism, but it wasremoved when Enigmail was integrated into Thunderbird.

The Parcimonie feature in the Octopus currently checks for updates onkeys.openpgp.org and in the appropriate Web Key Directories (WKDs)using the aforementioned privacy preserving mechanisms. It checks forupdates for all non-revoked, valid certificates about once a week, onaverage. It also supports merging updates from User ID-lesscertificates.

Before importing a certificate, we first check if it appears to beflooded. If so, we strip third-party certifications from keys thatwe don’t have a certificate for as those certifications areeffectively useless.

This feature is controlled by the net feature, which is enabled bydefault. To disable it (and elide the dependencies on sequoia-netand tokio), build as follows:

Weak Cryptography

The Octopus uses Sequoia, which rejects cryptographic algorithms thatare known to be weak by default. Unfortunately, RNP still acceptsMD5, among other vulnerable algorithms, without warning. Thunderbirdhas patched MD5 out of the version of RNP that they distribute,however, Thunderbird continues to support unlimited use of SHA-1,which is known to be vulnerable to collision attacks. Sequoia, andby extension, the Octopus, rejects certificates and messages that useweak cryptographic primitives. Because RNP does not have a mechanismto indicate that a certificate or component should not be used, theOctopus reports these keys as having expired one second after theircreation time.

Protection from Surreptitious Forwarding

When Thunderbird creates an email it uses the RFC 1847 Encapsulationmethod construct, which has been known to be broken for over 20years. The issue is that if Alice signs a message and sends it toBob, Bob can use the signature in a different context.

This security issue can be fixed by using OpenPGP’s intended recipientfeature. Then, if Bob forwards the signed message (e.g., “I owe you100 Euros”) to Carol, Carol’s MUA will mark the signature as invalidas she is not the intended recipient of the message.

In the Octopus, we detect the use of the encapsulation method andautomatically and transparently replace it with the safer combinedmethod whenever possible. Specifically, when we encrypt a message,we check whether we just generated the signed part. If so, we fix it.Because this generates another signature, if you are using a keymanaged by gpg’s agent, you may be prompted to authorize a secondsignature.

Sequoia also has a number of non-functional advantages relative toRNP.

Keys Encrypted at Rest

Sequoia automatically encrypts unencrypted secret key material inmemory when it is not in use. This makes secret key exfiltration alaHeartbleed much harder, and protects against Spectre, Rowhammer,etc.-style attacks. OpenSSH uses the same type of protection.

RNP has the concept of locking and unlocking keys, but this isexplicit, and Thunderbird does not always relock keys after use.

SHA-1 Mitigations

SHA-1 is broken. Unfortunately, SHA-1 is still widely used. Todeal with this Sequoia implements a number of countermeasures:

• Sequoia uses SHA1-CD, a variant of SHA-1 that detects andmitigates collision attacks. This protection is also used byGitHub, among others.

• Sequoia only accepts SHA-1 in safer contexts. For instance,SHA-1 over messages, and its use in third-party certifications arerejected by default. But, SHA-1 self-signatures that are notsuspicious are allowed.

• Sequoia has announced a timeline to completely deprecate theuse of SHA-1: in 2023 SHA-1 will no longer be accepted fordigital signatures.

RNP accepts SHA-1 everywhere without any additional protections. Bydefault, it even acceptsMD5. Happily, Thunderbird carries apatch to disable MD5 support.

Collision Protection

Sequoia includes a salt in signatures and self-signatures to defendagainst collision attacks, among others. OpenSSH does the samething. Should the collision resistance of another hash be broken,this will frustrate attackers trying to perform a Shambles-styleattack.

No Split Brain Problem

RNP maintains separate public and secret keyrings. This can lead to aso-called split-brain problem where a certificate is present in bothkeyrings, and confusingly one version is returned sometimes and theother version other times. This is also the model that GnuPG 1.xused, and is one of the reasons that GnuPG migrated to a singleOpenPGP keystore in GnuPG 2.0 with only the secret key material heldby the agent.

To avoid this problem, the Octopus merges the two databases. Toremain backwards compatible with RNP, when the Octopus writes out thecertificates, certificates with secret key material are written tosecring.gpg and those without are written to pubring.gpg.

Multi-threading

Thanks to Rust’s safer concurrency paradigms, it is less dangerousand less complicated for the Octopus to use threads than librarieswritten in other languages. The Octopus uses this, for instance, toparse keyrings faster. And to perform updates in the background.

OpenPGP Conformance

Sequoia implements nearly allof the OpenPGP RFC. The onlynotable missing bit is the lack of ElGamal support.

RNP doesn’t implement a number of important parts. For instance, itdoes not reject unknown critical subpackets and notations. This isa security problem. RNP doesn’t handle unknown packet versions.This is a future compatibility problem. RNP also doesn’t handle“esoteric” keys, like shared keys where only the encryption subkey’ssecret key material is shared. This is a compatibility problem. Moreexamples can be found in the OpenPGP interoperability test suite.

Over the past couple of months, we had several productive emailexchanges and a meeting with Magnus and Kai from the Thunderbird team.We’re grateful for the help they provided and their feedback.

This article is helpful for the users to accomplish the successful transfer of Thunderbird Emails to New Computer. Users can easily move all Thunderbird data to a new computer by exporting all its items to an external device. This data may include Thunderbird emails, contacts, appointments, calendars, address books, settings, saved passwords, and other data from One PC to another instantly.

There are free manual and advanced ways to perform migration of Thunderbird to Thunderbird on another computer. This easy tutorial will enable a user to solve the queries like how to transfer Thunderbird to a new computer while keeping all the profile folder and data secured and preserved. For non-technical users, it’s a very crucial task that’s why we discuss the possible solutions in the easiest way to accomplish such a task.

Challenge While Moving Thunderbird Emails to New Computer:

Thunderbird is one of the favorite Email clients due to its easy use, support for various email protocols like POP3, IMAP, SMTP etc. The most important reason for its global reach is its free of cost and available for open source to further development. For many of us, the mailbox files may contain the repositories o crucial information and business contacts. Similarly, Thunderbird store all important data like emails, contacts, calendars, address books, settings, saved passwords, add-on data, etc. in a profile directory. Unfortunately, there is no option in Thunderbird settings to export your data and settings to another Thunderbird supported file. The only possible way, in that case, is manually copying profile folder to new PC and allowing Thunderbird to access the profile folder.

But, is this method worth enough. What about the data security and folder hierarchy, email properties, directory analysis, email integrity as well it’s not a secure way. There are always chances of loss of data and its formatting. Hence, it is needed to have any professional Thunderbird backup software which proves to be very powerful. Before we discuss more the possible ways for how to move Thunderbird emails to new PC, let’s analyze some users queries to know the exact scenario.

“I just purchased a new Windows 10 PC and I would like to move my Thunderbird emails over to my new computer and new user account. I’ve looked in the ‘Tools’ menu of Thunderbird for an ‘export’ feature of some kind – hoping to export my user data for re-import on the new machine – but, there does not appear to be such an option. Can you help?”

Dennis, New Jersey, May 1, 2018

“One of my clients has installed new Windows7 and he was wondering if it is possible to somehow transfer/copy the account settings on Mozilla Thunderbird, so he doesn’t want to re-install it. He was finding a way to transfer all that onto a fresh install of Mozilla email client (Thunderbird) on new Windows 7 install. That would save a lot of time and work. How can we move Thunderbird Profile to New Computer?”

Susanne, California, July 7, 2018

Free Way to Move Thunderbird Data to New Computer:

There is no doubt that if a user wants to transfer Thunderbird emails to the new computer then the primary choice is always to do it free of cost. The good thing is, practically it can be possible. Thunderbird, unlike Outlook, saves its mailbox items and repositories in its Profile directory instead of Program directory. Therefore, one only need to copy the whole Thunderbird Profile directory to an external device and then paste it into the destination PC & hence allowing the Thunderbird to load data from the resultant profile path.

To perform this task just follow these quick steps:

• Browse for the Thunderbird Profile folder path in your system or PC. One can browse to it by proceeding as given: Run Thunderbird >> Tools Menu >> and click on Account Settings option >> Choose Server Settings, where at bottom one can see Local Directory path. Click on Browse button and then copy the path. Run Windows Explorer and then Paste the Path in Address Bar of Explorer. The requested Thunderbird Profile folder will be instantly displayed.
• Another way to find the Thunderbird Profile path is, copy ‘%APPDATA%Thunderbirdprofiles’ text in your clipboard. Press the start button and then press CTRL+V option and then Enter. The requested Profile path will display.
• There can be one or more Thunderbird profiles folders available there. One can use the Date Modified sort feature to choose the new and latest updated Thunderbird Profile directory.
• Once you successfully select the folder, check the folder size by choosing Property by right-clicking upon it or press ALT+ENTER Choose the external device according to the folder size like CD/DVD/Blu-Ray/Pen Drive/Hard Drive/ etc. according to requirement. Copy all the folder and paste it into the requested external device & eject the device from primary PC.
• Now, Insert the external device into New PC. Paste the Profile folder at a requested location in the new computer. Although it’s up to your choice it is recommended to paste the items at the same Thunderbird Profile location. Just follow the procedure 2 to do so. i.e. Copy ‘%APPDATA%Thunderbirdprofiles’ in clipboard then Paste it into Windows Search Box from Start Menu.
• Run Thunderbird and then proceed to Tools Menu >> Account Settings & choose Server Settings. Now, browse to the saved folder and click on OK
• If a user wants to create a new Thunderbird profile for the resultant mailbox items for further use. Run Thunderbird Profile Manager. Copy ‘thunderbird-profilemanager’ in clipboard and paste (CTRL+V) it into Windows Search Box from Start menu.
• The Thunderbird Profile manager window should now appear. Click the “Create Profile” button. It will say “Welcome to the Create Profile Wizard“. Click Next, then it will say “Enter new profile name“. The default is “Default User” – use that, then click the “Choose Folder” button. By default, Thunderbird will go to the “standard” location where profiles are stored on the hard drive. At this point, you should see two folder profiles: a new one that was already created when you installed Thunderbird onto the new machine, and the old one that you copied over from the media. Select your old profile folder, then click the “Finish” button, then click “Exit“.
• Launch Thunderbird & you can see that all your old Thunderbird Profile data has been migrated to the New Computer with Exact email formatting & folder hierarchy.

Limitations & Drawbacks of using Free Way: The major problem, which occurs while doing so is that Mozilla Thunderbird is a cross-platform email client. Hence, the Thunderbird Profile Directory path may be very from One OS to another. For Example, the default Thunderbird Profile on various OS is:

Latest Windows OS: C:UsersUserNameAppDataRoamingThunderbirdProfiles

Mac OSX:

Users/UserName/Library/Application Support/

Due to a different Profile location, it does not keep the Meta properties and integrity of Thunderbird items properly. Some other drawbacks of the manual method are:

1. It may lead to the risk of data loss while copying the Thunderbird Profile folder data.
2. There are no assurances for security of Data to perform Thunderbird Profile Data Migration.
3. It is necessary to keep a proper backup of Thunderbird mailbox items in case of any accidental system failure, which may increase the chances for corruption of files.
4. The whole process is very time-consuming and requires high technical knowledge.

Transfer All Thunderbird Data to New Computer Using Professional Way:

As free method imposes various limitations & drawbacks, therefore, it is a wise choice for the users to choose a professional approach with the help of the third-party application. One such application is RecoveryTools Thunderbird Migrator software. The software provides users direct option to import Thunderbird Profile data to Thunderbird Mail client. Users only need to choose the source Thunderbird Profile Repository then the software will instantly import these items into Thunderbird program in a new PC. The utility is designed with advanced features to move data from one Thunderbird program to another. Some major advantages that come with this utility are:

• Allow to directly move all items of Thunderbird from One PC to Another.
• Preserves the original folder structure and hierarchy during this migration.
• Provides dual ways to load Thunderbird items either as choose whole Thunderbird Profile directory or select only desired Thunderbird Mailbox file for selective conversion.
• Helps the users to move Old Thunderbird Account to New Thunderbird Account.
• Enables the users to Move Emails with all inserted Attachments.
• Move in Batch Multiple Thunderbird Profiles removing data redundancy.

How to Move Thunderbird to New PC?

The software is designed in keeping consideration of non-technical users. All the working process is very simple and adequate for the users. Simply follow these quick steps to accomplish this task.

1. Run Thunderbird Export Software in your system & read all necessary instructions to perform the migration.
2. Dual ways to load either whole Thunderbird Profile Directory or selectively choose Mailbox files.
3. Now, select the Thunderbird option from the list of saving option. It will automatically save the mailbox items at default Thunderbird Profile location.
4. Click on Convert button & all the mailbox items are saved at Thunderbird Profile location.

As we can see that this method instantly helps the users to transfer Thunderbird Emails to New Computer.

The Verge: In this article, we discussed how to transfer Thunderbird emails to New Computer. We discussed the major challenges, user’s requirements, and the ways to do so. We used a freeway by moving Thunderbird profile directory to the New computer. The profile folder stores everything like emails, messages with attachments, address lists, account settings, Thunderbird settings, stored passwords, tasks, calendar data, and data of Add-Ons. Copy the Thunderbird Profile directory to an external storage device and then paste them in New Computer.