Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Enigmail 2.0 to automatically encrypt e-mails

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 14 posts

Tell HN: Enigmail 2.0 to automatically encrypt e-mails

#1

Post by vx17h »

It's four days ago the pEp-Development branch was merged into the master source code repository of Enigmail, meaning the pretty Easy privacy (p≡p) technology is now at Enigmail's core to encrypt e-mails:

https://sourceforge.net/p/enigmail/source/ci/382c7dc3cc84a0fa9648ad5f7054e725d32eda22/log/?path=

In fact, for novice users (or such without OpenPGP setup), the new p≡p scheme will be used (as "junior mode") to automatically create keys and distribute them to the communication partners: https://twitter.com/pEpCouncil/status/792233350463447040

p≡p has a broad, cross-platform approach as how to automatically encrypt all "written digital communications".

Furtherly, its technologic core (p≡p engine) underwent a code audit: https://pep.foundation/blog/press-release--pep-releases-first-code-audit-of-the-pep-engine/index.html

A beta of Enigmail/p≡p will be launched at Mozilla Festival in London, this Sun: https://twitter.com/pEpCouncil/status/791575091343687680

Good video talks explaining what p≡p actually is, were given at the GNU Hacker Meeting (GHM) in Rennes, France: https://gnunet.org/ghm2016

Re: Tell HN: Enigmail 2.0 to automatically encrypt e-mails

#4

Post by vx17h »

aleken wrote: post #2

Will pep handle key exchanging as well? Looks interesting, but I can't find out if/how it handles this?

Yes, the public key is just attached to the outgoing messages and automatically imported by p≡p-capable software.

That's kind of a TOFU (Trust On First Use) approach, but you can verify trust by comparing the fingerprints, in p≡p by default represented as dictionary words in your natural language (somewhat similar to Signal). That's suitable for comparison by phone (=> quickly done).

Re: Tell HN: Enigmail 2.0 to automatically encrypt e-mails

#6

Post by newscracker »

Mods, can we have a "Show HN" prefix for this please?

I didn't realize this was just a discussion thread here, and I opened two tabs like I usually do - one for the main link and one for the HN thread. In this case I got two tabs with the same HN thread. :)

Re: Tell HN: Enigmail 2.0 to automatically encrypt e-mails

#7

Post by XorNot »

vx17h wrote: post #4
aleken wrote: post #2

Will pep handle key exchanging as well? Looks interesting, but I can't find out if/how it handles this?

Yes, the public key is just attached to the outgoing messages and automatically imported by p≡p-capable software. That's kind of a TOFU (Trust On First Use) approach, but you can verify trust by comparing the fingerprints, in p≡p by default represented as dictionary words in your natural language (somewhat similar to Signal). That's suitable for comparison by phone (=> quickly done).

Is there an indication of trust status? I.e. "auto imported" vs. Manually verified, and more importantly what happens when fingerprints change?

Re: Tell HN: Enigmail 2.0 to automatically encrypt e-mails

#8

Post by vx17h »

XorNot wrote: post #7
vx17h wrote: post #4

Earlier quoted context omitted.

Yes, the public key is just attached to the outgoing messages and automatically imported by p≡p-capable software. That's kind of a TOFU (Trust On First Use) approach, but you can verify trust by comparing the fingerprints, in p≡p by default represented as dictionary words in your natural language (somewhat similar to Signal). That's suitable for comparison by phone (=> quickly done).

Is there an indication of trust status? I.e. "auto imported" vs. Manually verified, and more importantly what happens when fingerprints change?

Yes, there's a Privacy Status in p≡p, there being four different states: no color (mostly today: insufficient crypto, weak crypto, unknown), yellow/orange for accepted, transparent and well implemented crypto, green for crypto avoiding the MITM (Man-In-The-Middle) possibility (after the involved peers checked their Trustwords and accepted them to be trustworthy) and red if the p≡p engine detects an attack.

Cf. the documentation for screenshots how this looks (nowadays): https://prettyeasyprivacy.com/docs

Post reply on HN