Thunderbird and Exchange

This morning a friend was complaining on Twitter about using Evolution on Linux to talk to his company’s Exchange server. Evolution is the default answer to the question “how do I talk to Exchange from Linux”, but my past experience has been much like my friend’s – it’s really not a very good answer.

I suggested Thunderbird to him. In my opinion, Thunderbird is the best email program out there. It’s been my email program of choice for several years. It will happily work with Exchange to receive and send email. Googling for “thunderbird exchange” will bring back lots of useful results.

But Exchange isn’t just about email. There’s a whole calendaring system there too. Evolution supports that, but (by default) Thunderbird doesn’t. There is, however, a way to get your Exchange calendar into Thunderbird using a rather circuitous route. Here’s how I do it.

Firstly, you need the Lightning add-on for Thunderbird. Lightning adds calendar features to Thunderbird. You can create events and get alerts when they are about to happen. You can even subscribe to external calendars as long as they are in a standard format. Unfortunately, Exchange calendars aren’t in standard formats. So we need some kind of intermediary.

The intermediary I use is Google Calendar. In fact I use Google Calendar as my definitive calendar. Every other calendar application I use reads from or writes to my Google Calendar. And Thunderbird (or, rather, Lightning) is one of the applications that interacts with it. Google Calendar writes calendars in the correct standard format, so Lightning will read a Google Calendar out of the box. But we can get cleverer than that using another Thunderbird add-on called Provider. Once Provider is installed, communication between Lightning and Google Calendar becomes two-way. I can add events either in Lightning or in Google Calendar and they will turn up in both.

There’s one final step. We need to synchronise our Exchange calendar with Google Calendar. And Google have a product that does just that. It’s called Google Calendar Sync. With this installed, your Exchange calendar is automatically synchronised with Google Calendar regularly. So now we can edit our calendar anywhere and the new or updated events will show up in all of our calendars. I’ve even noticed that invitations to events from other Exchange users show up in Lightning – but I haven’t tried replying from there yet.

There are two things I don’t like about Google Calendar Sync. Firstly, it has to be running on a PC running Windows which is connected to your Exchange Server. So it’s not a solution that will work whilst you’re (for example) out of the office with your office PC switched off. Secondly, it will only sync with your main Google Calendar. I would have liked to have a separate calendar for work events (and it’s only work events that come from my Exchange calendar), but that doesn’t seem to be supported yet.

And there are a couple of caveats with Lightning and Provider. If you’re using a Beta test version of Thunderbird 3 then the standard Lightning and Provider downloads don’t work with it. There are nightly builds of them both available, and the version of Lightning that I tried worked fine but Provider still didn’t seem to work. I expect that situation to change quickly over the next few weeks as the Thunderbird 3 launch gets closer.

A year ago I was really disorganised. I never knew what I was supposed to be doing. Settling on Google Calendar as a definitive place to plan my life was a really good idea. At least now, I know which meetings I’m missing.


Phishing Protection

I read all of my email using either mutt or Thunderbird depending on which computer I’m using at the time. When I install either of those on a new computer, the first thing I do is to configure it so that it won’t display HTML email. I have many good reasons for doing this, but mostly I just prefer reading email as plain text.

Most email these days seems to be sent with both HTML and plain text versions so I just get to see the text version, people who are more trusting than me about HTML email get to see the HTML version and everyone is happy. If someone sends me email with no plain text version then I don’t get to see it. This is rarely a problem as these mails tend to come from people who I don’t want to read email from anyway.

But recently I noticed another advantage to my policy. It’s helping to protect me from phishing attacks. The whole point of a phishing attack is to persude you to click on a link which doesn’t go where you think it goes. So you think that you are verifying your account information with Paypal whereas you’re actually giving your username and password to someone who you really don’t want to have it. The best way for them to do that is to send an HTML email where they can disguise the links. The text in the link makes you think that you’re going to a legitimate site, but actually the link goes to somewhere completely different. You can’t disguise that in plain text.

So phishing attacks generally only have a HTML version. A plain text version would give the game way too easily. But all of the legitimate businesses who the phishing attacks pretend to be (Ebay, Paypal, my bank) always send both plain text and HTML versions as they have nothing to hide. So if I get an email from Ebay and there is no plain text version, then I can instantly see that it’s a phishing attack and can be deleted.

Just one more reason to say no to HTML email.