Can the blocking of JavaScript and the disabled loading of embedded attachments make an HTML email relatively secure?

Question

In order to protect myself from getting trojans and other stuff, I have changed Thunderbird’s options to only display emails in a simplified HTML format. But this format takes away pretty much of the advantages HTML emails have to offer (for example, writing justified text).

Yesterday, I have found an add-on which could solve my problem, but I’m not sure whether it offers a good protection or not. It is called “Allow HTML Temp” and it enables me to watch proper HTML emails again. But it has the options to deactivate JavaScript and to not load embedded attachments.

In the preferences it says that allowing original HTML emails is not recommended, but could it be “recommended” or “tolerable” or whatever if JavaScript and the loading of embedded attachments are forbidden?

I am using NoScript and do not click on links from spam emails.

The German Federal Office for Information Security has written the following:

Fallacy 1: “If I just look at an email but do not open an attachment, nothing can happen.”

Unfortunately, this is not true. Many emails today are sent in HTML format. […] In the […] source code of an HTML formatted email lurks the danger: There, malicious code can be hidden which can already be executed when opening the HTML email […] without any clicking on an attachment.

I have read that it should be sufficient if I keep Thunderbird updated all the time, but I suspect it of letting through some malicious emails. This is because my old mail provider has been bought by a new company which does not offer spam protection at all. Furthermore, it does not scan emails for viruses, trojans or any other malicious code.

I know that even palin text mode does not offer a complete protection, but does such an add-on for Thunderbird increase my security so that I can read original HTML emails (that is, not in a simplified version of HTML) again?

Answer 1

Check when that document you quoted was written, this is because the use of JavaScript in HTML emails is disabled. Even if it were enabled, almost all email clients (apart from very, very old ones) have the feature of JavaScript auto-run disabled.

As to the loading of embedded images, yes their HTML code can open malicious links when loaded, hence why most email clients disable the feature, instead giving you a choice to load them every time you open the email.

So, because JavaScript doesn't actually serve any advantage (did I mention emails with JS often get sent to spam?), you might as well leave it disabled in case of the slim chance that your email client let's a malicious piece of code slip. For the embedded attachments, again you should disable the auto-load of them, and instead let you manually load them.

So activate the option but leave "deactivate embedded attachments and JavaScript" turned on.