Is this the longest time between request/bug and fix?
https://gitlab.gnome.org/GNOME/gtk/-/issues/233
16 years and still pending! All bets are off for this dark horse
21 years after the request OpenPGP support gets added to Thunderbird
31–40 of 281 posts
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#32I do think there ought to be a way to do good cryptography in email. Email is not going away anytime soon, so giving up on it as a legitimate place where cryptography is needed seems too ivory tower for me. The “dead simple solution” is to just run the Signal protocol over SMTP, although I’m sure it’s possible there is a better design if you were to think about the specifics.
A slightly more realistic "dead simple solution" might be for mail clients to extend their OpenPGP support to include Autocrypt[0] which would allow users to gain some of the advantages of OpenPGP without having to understand any of the details.
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#33I do think there ought to be a way to do good cryptography in email. Email is not going away anytime soon, so giving up on it as a legitimate place where cryptography is needed seems too ivory tower for me. The “dead simple solution” is to just run the Signal protocol over SMTP, although I’m sure it’s possible there is a better design if you were to think about the specifics.
S/MIME is the closest to dead simple solution, but it requires trusting certificate authorities.
It's a much better user experience, and honestly I'm surprised that no enterprise orgs have adopted it, because it would probably be cheaper than all this phishing training.
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#34I do think there ought to be a way to do good cryptography in email. Email is not going away anytime soon, so giving up on it as a legitimate place where cryptography is needed seems too ivory tower for me. The “dead simple solution” is to just run the Signal protocol over SMTP, although I’m sure it’s possible there is a better design if you were to think about the specifics.
Not if you want to interoperate with anything currently in existence. And if you don't, why bother building it on SMTP?
Aren't there specific legal protections for email in some places, distinct from other online communication?
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#35How is the Thunderbird development speed nowadays?
Pretty moribund. They got dropped by Mozilla so it's entirely community-driven, and there's only so many things you need to add to an email client, unless you want it to turn into emacs or something. That said it's a damn good product that's damn good at what it does.
There's as many developers working on it now as there were when it was a part of Mozilla.
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#36sigh Thunderbird has so many great features under the hood, but the hood is the biggest issue I have that prevents me from switching full time. Classic and wide layouts are not optimized for wide resolutions in modern laptops. Their vertical layout is unusable. The columns in the list of messages are horizontal, taking up too much width. Each layout is a tradeoff on whether I want to message pane to be usable or the list of messages to be usable.
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#37Is anyone else having problems with this, after migrating from Enigmail on Thunderbird 68?
It fails to associate my accounts with my keys in my keyring, so I try to import an exported key. Whenever I do this, it gets stuck in a loop asking me for the passphrase for an old, revoked key :( Even after I deleted the revoked keypair -- which I know I shouldn't -- it's refusing to cooperate.
So it looks like I've actually lost this feature by upgrading...
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#38Good for them, but PGP is essentially dead for any non-technical zealot users. S/MIME is better supported and easier to use.
That's actually the deal with Thunderbird, too. Supported S/MIME and needed a plugin, Enigmail, to interface with OpenPGP. What is happening here is that the thunderbird add-on interface is changing and they decided that instead of porting Enigmail they are integrating OpenPGP straight into Thunderbird like S/MIME is.
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#39I do think there ought to be a way to do good cryptography in email. Email is not going away anytime soon, so giving up on it as a legitimate place where cryptography is needed seems too ivory tower for me. The “dead simple solution” is to just run the Signal protocol over SMTP, although I’m sure it’s possible there is a better design if you were to think about the specifics.
S/MIME is the closest to dead simple solution, but it requires trusting certificate authorities. It's a much better user experience, and honestly I'm surprised that no enterprise orgs have adopted it, because it would probably be cheaper than all this phishing training.
Enterprises, at least in the form of the U.S. federal government, have but there are two key drawbacks:
1. At least until recent, Microsoft implemented it as blocking code in the UI thread – open a message and Outlook won't paint until it can verify the cert, access your local key store (hope your token is in a USB port which is 100% reliable), etc. If you thought “Does that mean that revocation checks block the UI until a network process completes?” you're sadly right.
2. Adoption hasn't been enough to be able to ban untrusted senders. This could still be quite useful for, say, a hard requirement that *@example.com must have signatures but it doesn't help with really common phishing tactics like pretending to be a vendor, business partner, etc.
3. You definitely need to get serious about key management because your ability to read your old encrypted email depends on retaining those keys. This is obviously not impossible but it has a cost when you think about the need to store them securely in a manner which can be restored after the inevitable system failures and compromises.
Re: 21 years after the request OpenPGP support gets added to Thunderbird
#40Earlier quoted context omitted.
Not if you want to interoperate with anything currently in existence. And if you don't, why bother building it on SMTP?
You build it on SMTP because upgrading clients is easier than doing a clean slate redesign of ubiquitous internet protocols. Presumably we're discussing how an open protocol addition might gain any traction at all over walled garden protocols like Slack -- and in those cases you want to maintain as much compatibility as possible. "Federated SecureEmail 2.0" would be dead-on-arrival, where "Secure Client on top of bog…
>You build it on SMTP because upgrading clients is easier than doing a clean slate redesign of ubiquitous internet protocols.
Why not just toss the whole shebang and rebuild it below that layer? Signal Protocol seems to be pretty successful here.
>Presumably we're discussing how an open protocol addition might gain any traction at all over walled garden protocols like Slack
No, I'm asking how a new open protocol can be built on top of email in a way that maintains strong backwards compatibility while offering strong security guarantees, like end-to-end encryption. I don't think it's possible.