Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

21 years after the request OpenPGP support gets added to Thunderbird

bugzilla.mozilla.org

Post reply on HN
Print view View original

211–220 of 281 posts

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#211

Post by globular-toast »

currysausage wrote: post #207
globular-toast wrote: post #172

Thunderbird has the only calendar I know that has a "multiweek" display as opposed to (well, in addition to) the utterly retarded month view that exists in every other GUI. We've been doing electronic calendars for how long now? Why are we still using a paradigm from paper based calendars? At the beginning of a month I can see three weeks ahead, but at the end of the month I can see three weeks behind. It frustrates…

Sorry for nit-picking and being off-topic (I get your point!), but I don’t think there was ever a version of Google Maps without zoom. Actually, I have the fondest memories of the first version of Google Maps (the orange-themed one). It was so much better than anything it replaced at the time, and I think it would be perfectly usable even today, 15 years later!

It did have zoom, but they were fixed levels so no different to having multiple paper maps at different scales. Yes, of course there is the advantage that it's "not paper", but that was the only advantage really. This is not unexpected at all as new technology very often mimics existing technology in its first iteration. If you look at the first outputs of the Gutenberg press you can see they were trying to mimic handwritten books of the time. But usually the new technology very quickly surpasses the old after the first iteration, as electronic maps have now done.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#212

Post by somedude11 »

jrochkind1 wrote: post #113
ifmpx wrote: post #110

Earlier quoted context omitted.

People in this industry use OpenPGP because it's flexible and amendable to almost any usecase you can think of. "Better solutions" are usually indeed better but are also so specialized for their purpose to the point that they can't be easily used for any other purpose. OpenPGP is used to secure everything from simple messages and email to authenticating OS updates for most servers today. Should they use something mor…

What industry do you mean by "this industry"? Just... computing? I didn't know OpenPGP was used to authenticate OS updates for most servers today. Can you give me a place to find out more about that; are you talking about a specific OS?

Packet managers on pretty much every Linux distribution use GPG for verifying packages.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#213

Post by shp0ngle »

globular-toast wrote: post #170
shp0ngle wrote: post #129

"How much do you trust the owner of this key to sign other keys properly? * I don't know * I do NOT trust * I trust marginally * I trust fully * I trust ultimately" This is a real pop-up I got the last time I tried to use PGP with Thunderbird. If people still get regular pop-ups like these, I don't think PGP will ever be popular. They might have switched to PEP (pretty easy privacy) that uses TOFU (trust-on-first-use…

Security has a big dirty secret: it's hard. If what you're doing is easy, it ain't security. Simple as that. TOFU works if you actually do it properly. That means verifying the fingerprint of the key you just received out of band once time. Now you can trust that key. How many people do this? Even IT professionals just routinely say yes for new ssh keys without checking. That's not TOFU, that's just trusting that you…

When I observed people actually using Enigmail, they just do "search for that person keys" in enigmail, which did search at MIT or whatever, and picked the first (and only) result.

(Again, that was before PEP/TOFU. In my former company, we had PGP as a company mandate. Everyone hated that, and it never ever worked properly for group e-mails, no matter how hard we tried to hack it. Not sure what is the experience now.)

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#214

Post by littlestymaar »

lucideer wrote: post #203
ehnto wrote: post #183

Earlier quoted context omitted.

Is establishing a HTTPS connection internationally exporting a munition, using a munition, or none of the above?

As far as I understand current interpretation, hosting a dowload of a piece of software that includes code capable of establishing a https connection (e.g. bundling a tls lib), on a US server, that can be dowloaded to a computer outside of the US, constitutes munitions export.

TIL github is one the biggest international munitions dealer

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#215

Post by MayeulC »

dane-pgp wrote: post #32
oconnore wrote: post #8

I do think there ought to be a way to do good cryptography in email. Email is not going away anytime soon, so giving up on it as a legitimate place where cryptography is needed seems too ivory tower for me. The “dead simple solution” is to just run the Signal protocol over SMTP, although I’m sure it’s possible there is a better design if you were to think about the specifics.

A slightly more realistic "dead simple solution" might be for mail clients to extend their OpenPGP support to include Autocrypt[0] which would allow users to gain some of the advantages of OpenPGP without having to understand any of the details. [0] https://autocrypt.org/

Interesting. In my opinion, this should also contain provisions for storing the private key password-encrypted on the IMAP server.

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#216

Post by ricksharp »

kevingadd wrote: post #177
skrebbel wrote: post #155

Earlier quoted context omitted.

I see your point, but as a non-American who's flooded with videos of random Americans walking around supermarkets carrying semiautomatic rifles, I'm not sure what you mean with "tightly regulated militia".

The US is all about selective enforcement, and the undesirable hacker type and their unpleasant "cryptography" is likely a higher priority for munitions enforcement than an irritable white guy with an AR-15 at the supermarket, because only one of them actually threatens the status quo.

But is the guy wearing a mask?

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#217

Post by flyx86 »

the_duke wrote: post #206
flyx86 wrote: post #187

Earlier quoted context omitted.

Matrix bridges do that for me today! Currently using IRC and Telegram bridges, thinking about adding Slack. Sadly, Electron-based Element is still the best Matrix client by far.

The lack of thread support in Element makes Slack bridging very hard to use, sadly.

I needed some time to figure out you're not talking about multithreading in JavaScript/electron, but about this

https://github.com/vector-im/element-web/issues/2349

:)

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#219

Post by rob74 »

kevingadd wrote: post #177
skrebbel wrote: post #155

Earlier quoted context omitted.

I see your point, but as a non-American who's flooded with videos of random Americans walking around supermarkets carrying semiautomatic rifles, I'm not sure what you mean with "tightly regulated militia".

The US is all about selective enforcement, and the undesirable hacker type and their unpleasant "cryptography" is likely a higher priority for munitions enforcement than an irritable white guy with an AR-15 at the supermarket, because only one of them actually threatens the status quo.

Cryptography and the AR-15 may both be classified at weapons, but you can't actually shoot someone with cryptography. I suspect that may also play a role when it comes to enforcement...

Re: 21 years after the request OpenPGP support gets added to Thunderbird

#220

Post by upofadown »

brnt wrote: post #159
dylan604 wrote: post #14

I remember back in the 90s exchanging PGP keys with my roommate to exchange encrypted emails. It was supposed to be so easy. Just 12 simple steps. Every time.

PGPs trust levels are what made PGP never take off: even laypersons could see this is theater, not security. For reasons unclear to me Thunderbird chose not to go with something like autocrypt.org, but stick with standard PGP and implement parts of their attempt to simplify, which isn't nearly enough to get regular users on board, never mind implement things like forward security, which autocrypt does. A missed chanc…

There is an autocrypt plugin for Thunderbird:

* https://addons.thunderbird.net/en-US/thunderbird/addon/autoc...

Now that most SMTP connections are encrypted with STARTTLS on the wire, autocrypt is not that valuable. At an email server autocrypt can be trivially man in the middled with just a simple script. It ends up being just another encrypted messaging solution that skips the hard but crucial problem of identity.

Added: Autocrypt does not do forward secrecy. Most people want to keep their old emails, so forward secrecy wouldn't add much value:

* https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy

Post reply on HN