In our company users can't know thier mail passwords. We are trying to migrate from OE to something else and Thunderbird is almost ideal for us. But with this option always active it is impossible. There should be at least some password protection to the configuration window.

this bug is not security sensitive, it's really an enhancement request.

This is the Thunderbird equivalent of Firefox bug 259996. Depending on how or where it's fixed it might end up a duplicate, but until we've got a fix in hand it's safer to assume each app might need or want a different approach and thus require a separate bug.

There are several earlier versions of this bug that were duped to bug 259996. This is not a dupe, Thunderbird has its own UI and might fix this differently than Firefox.

I noticed the same problem in Firefox 1.5 RC3 It was a bit shammy because I was going to defend that feature in a forum so I had do edit my post, because the feature didn't work... about:config pref.privacy.disable_button.view_passwords It doesn't work neither with true or false... []s

I noticed the same problem in Firefox 1.5 RC3 It was a bit shammy because I was going to defend that feature in a forum so I had do edit my post, because the feature didn't work... about:config pref.privacy.disable_button.view_passwords It doesn't work neither with true or false... []s

In Thunderbird you can use #togglePasswords { display: none !important } in the userChrome.css and than the Button is gone.

disable_button prefs don't work if they aren't locked. See http://kb.mozillazine.org/Locking_preferences or any of the other guides (most or all of which will talk about Firefox), just keep in mind that because Thunderbird uses a general.config.obscure_value of 0, you don't need to do the rot13 step (unless you set your own obscure_value). Well, and you'll need to keep in mind that it's pointless unless you also prevent your users from accessing the program directory. Well, and you'll need to keep in mind that it's pointless unless you also somehow prevent your users from accessing their profile directory, since without a master password it's trivial to get passwords out of the file where they are stored (and with a master password, you would have to let them have the master password to be able to use the passwords, at which point they could still get them out of the profile). Well, and you'll need to keep in mind that it's pointless unless you also use SSL so they can't trivially sniff the password as it's sent, and somehow prevent them from switching to not use SSL. But what the bug is asking for, a way to deploy Tb within a company without having the button to show passwords shown, has been around for years.