From owner-freebsd-hackers@freebsd.org Thu Nov 19 19:22:21 2020 Return-Path: Delivered-To: freebsd-hackers@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 35D75472C9A for ; Thu, 19 Nov 2020 19:22:21 +0000 (UTC) (envelope-from george+freebsd@m5p.com) Received: from mailhost.m5p.com (mailhost.m5p.com [74.104.188.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "m5p.com", Issuer "Let's Encrypt Authority X3" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4CcV1S4XV7z3Jpj for ; Thu, 19 Nov 2020 19:22:20 +0000 (UTC) (envelope-from george+freebsd@m5p.com) Received: from [IPv6:2001:470:1f07:15ff::26] (court.m5p.com [IPv6:2001:470:1f07:15ff:0:0:0:26]) (authenticated bits=0) by mailhost.m5p.com (8.15.2/8.15.2) with ESMTPSA id 0AJJMDXY012611 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO) for ; Thu, 19 Nov 2020 14:22:18 -0500 (EST) (envelope-from george+freebsd@m5p.com) Subject: Re: How is Thunderbird signing my emails? To: freebsd-hackers@freebsd.org References: <3e4179d0-f6c4-66a5-9628-b2ee95071858@FreeBSD.org> <7CB521CC-8B8D-4E06-BBE0-23FD58A2F79F@freebsd.am> <20201119171548.anb34fpeuij3liyr@nerd-thinkpad.local> From: George Mitchell Message-ID: Date: Thu, 19 Nov 2020 14:22:12 -0500 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:78.0) Gecko/20100101 Thunderbird/78.4.0 MIME-Version: 1.0 In-Reply-To: <20201119171548.anb34fpeuij3liyr@nerd-thinkpad.local> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="13CJvmGTuU9akqrXyS1k7zH1nmyh6G3Nc" X-Spam-Status: No, score=-0.3 required=10.0 tests=HELO_MISC_IP, HELO_NO_DOMAIN, NICE_REPLY_A autolearn=unavailable autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on mattapan.m5p.com X-Rspamd-Queue-Id: 4CcV1S4XV7z3Jpj X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of george@m5p.com designates 74.104.188.4 as permitted sender) smtp.mailfrom=george@m5p.com X-Spamd-Result: default: False [-4.40 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; R_SPF_ALLOW(-0.20)[+a:c]; HAS_ATTACHMENT(0.00)[]; TO_DN_NONE(0.00)[]; NEURAL_HAM_SHORT(-1.00)[-1.000]; SIGNED_PGP(-2.00)[]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:+,3:+,4:+,5:~]; RBL_DBL_DONT_QUERY_IPS(0.00)[74.104.188.4:from]; ASN(0.00)[asn:701, ipnet:74.104.0.0/16, country:US]; R_DKIM_NA(0.00)[]; TAGGED_FROM(0.00)[freebsd]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; MID_RHS_MATCH_FROM(0.00)[]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.20)[multipart/signed,multipart/mixed,text/plain,application/pgp-keys]; PREVIOUSLY_DELIVERED(0.00)[freebsd-hackers@freebsd.org]; DMARC_NA(0.00)[m5p.com]; RCPT_COUNT_ONE(0.00)[1]; SPAMHAUS_ZRD(0.00)[74.104.188.4:from:127.0.2.255]; SUBJECT_ENDS_QUESTION(1.00)[]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; MAILMAN_DEST(0.00)[freebsd-hackers] X-Content-Filtered-By: Mailman/MimeDel 2.1.34 X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Nov 2020 19:22:21 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --13CJvmGTuU9akqrXyS1k7zH1nmyh6G3Nc Content-Type: multipart/mixed; boundary="zp7MTH2ij6xZTg9PhhTt6d6R6NfS8FIQN"; protected-headers="v1" From: George Mitchell To: freebsd-hackers@freebsd.org Message-ID: Subject: Re: How is Thunderbird signing my emails? References: <3e4179d0-f6c4-66a5-9628-b2ee95071858@FreeBSD.org> <7CB521CC-8B8D-4E06-BBE0-23FD58A2F79F@freebsd.am> <20201119171548.anb34fpeuij3liyr@nerd-thinkpad.local> In-Reply-To: <20201119171548.anb34fpeuij3liyr@nerd-thinkpad.local> --zp7MTH2ij6xZTg9PhhTt6d6R6NfS8FIQN Content-Type: multipart/mixed; boundary="------------27E28617A44FDB675DA14B6B" Content-Language: en-US This is a multi-part message in MIME format. --------------27E28617A44FDB675DA14B6B Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable On 11/19/20 12:15 PM, Daniel Ebdrup Jensen wrote: > On Thu, Nov 19, 2020 at 04:05:40PM +0400, Antranig Vartanian wrote: >> I=E2=80=99m wondering if there are any alternative clients that Just = Works=20 and uses GnuPG keyring? >> >> Thanks in advance. >> >> Sent from my iPhone >> >>> On 19 Nov 2020, at 3:02 PM, Lev Serebryakov wrote:= >>> >>> =EF=BB=BFOn 19.11.2020 5:52, George Mitchell wrote: >>> >>>> The Thunderbird people have integrated the functionality of Enigmai= l >>>> into Thunderbird itself. In the abstract, this sounds like a great= >>>> idea, because I believe that the more people use PGP signatures and= >>>> encryption, the better. But the concrete reality of the=20 implementation >>>> puzzles me in a couple of respects: >>> Concrete reality of the implementation is awful. It is not=20 replacement for Enigmail :-( >>> >>>> a. It's now inclined to attach my public key to every message I sen= d, >>>> unless I tell it it not to do that on a message-by-message basis=20 (under >>>> the "Security" menu in the message composition dialog). I can't fi= nd >>>> where I can globally disable this. >>> See https://bugzilla.mozilla.org/show_bug.cgi?id=3D1654950 - new=20 releases will have hidden setting for it. >>> >>>> b. More alarmingly, when it appends my PGP signature to my outgoing= >>>> messages, it is able to unlock my private key without asking for th= e >>>> passphrase. How is it doing this?? >>> New Thunderbird doesn't use GPG keyring, it imports all keys into=20 its own database (also it doesn't use Web Of Trust!). Private keys are=20 protected only by global profile password (did you have this one set?=20 I'm in doubt, it is rarely-used feature). So, if you account is without = global password, you imported private keys are not protected at all.=20 Good luck with that :-( >>> >>> -- >>> // Lev Serebryakov >>> _______________________________________________ >>> freebsd-hackers@freebsd.org mailing list >>> https://lists.freebsd.org/mailman/listinfo/freebsd-hackers >>> To unsubscribe, send any mail to=20 "freebsd-hackers-unsubscribe@freebsd.org" >> _______________________________________________ >> freebsd-hackers@freebsd.org mailing list >> https://lists.freebsd.org/mailman/listinfo/freebsd-hackers >> To unsubscribe, send any mail to=20 "freebsd-hackers-unsubscribe@freebsd.org" > > Hi folks, > > NeoMutt and GnuPG works well together, and NeoMutt can even render=20 html email by using w3m as a pager for the by setting 'auto_view=20 text/html' and putting the following into ~/.mailcap: > text/html; w3m -T text/html %s; nametemplate=3D%s.html; copiousoutput > > I've been using it on my FreeBSD laptop for both mailing lists,=20 FreeBSD development, and as a daily driver. > > Also, please think of this as a little reminder not to top-post on=20 mailing lists. :) > > Yours respectfully, > Daniel Ebdrup Jensen Thanks to all for the information. I've been pondering Signal for a while now (thanks to RW for the blog post about avoiding encrypted email altogether). -- George --------------27E28617A44FDB675DA14B6B-- --zp7MTH2ij6xZTg9PhhTt6d6R6NfS8FIQN-- --13CJvmGTuU9akqrXyS1k7zH1nmyh6G3Nc Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEENdM4ZHktsJW5kKZXwRES3m+p4fkFAl+2xeQFAwAAAAAACgkQwRES3m+p4fnJ oRAAu1i5VEkOx1UooH82kOUtsoV/2fiqz135EHdJ38uT2w7DsN1uZbiOlDUoF0emDtISRdIWApEl HTmbWKzMTRgV8qzt40PXnvlYPFarIy6Bc66NLGT+3+SpJmyeOVoUsLbNu6v6z2d7pJ+tWbqRWC8b nOE8ZEIIA0A5n5QSpvkMEGchVly+gKxJcBpEsREHrCotiptyC+BKBuYv9/fi5/UdI6dnnzv2T+sy O6YmQbZrkaQTL90WFBqTLZGz7F+J7TDgg8bXWA1ua1STdm2DFSyyoQ3x+eWIGIrESEQc+8gXOewI 4oJ1BaxXIjslVRakRu79fO/A4DmubtPgANAHeKTDuCJasCbU/4lHPIkcB9bHf6jDBTiPKrIygW7S Huza+vSpl4Rx/OEMt3uJs5NzmTnwpIGbQ823IQqNm9IOktqCS+y0S/OkTDmay/gcltTXxIdKlXjM BsSAvyCK1fAl4xd0UTwAmDMjSrXB5SVMliF/ScE2OFGkqS363jUkf/GcgpvhFmS1OqhnHoMy+B7k 8mcfAkbN5F9CZmnpqBGdCakTCNqVnZYs6NAEBw/B4sPLJQcjJ5EAGciEilz3IVSpnrFrPDjEVTY3 1Bu9Sk/thmPD+c3g43GOF6RwmLjrZ8LsZWfSOrFMeHCLchghHsJ/pa7I3QyIVklBi4GnfIq7nGKy D8c= =zByL -----END PGP SIGNATURE----- --13CJvmGTuU9akqrXyS1k7zH1nmyh6G3Nc--