Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

Thunderbird & Enigmail. 7/10 would encrypt again.


sort by: page size:

For whoever doesn't know what Enigmail is... it's a security add-on for Mozilla Thunderbird. It allows you to use OpenPGP to encrypt and digitally sign your emails and to decrypt and verify the messages received.

I am a bit sad that the release notes say nothing about encryption.

PGP support was (for me) the big thing about thunderbird 78. It was a bit rough around the edges (in terms of UI and extension support) but I expected it to improve with subsequent releases. Now it sounds like they did not iterate on encryption at all (apart from fixing a few bugs).

(This is from reading the release notes. I did not yet have time to test the new version.)

Shameless plug: I proposed a patch that would bring the compose UI much closer enigmail: https://bugzilla.mozilla.org/show_bug.cgi?id=1669788


You'll be happy to learn that the P=P folks are most likely going to be handling full end to end encryption integration for Thunderbird, for the current version, and the new one (if it happens):

https://pep-project.org/


> About two years ago, Thunderbird decided to integrate Enigmail into Thunderbird and simultaneously replace GnuPG with RNP. That Thunderbird has selected RNP is not only an endorsement of RNP, but it means that RNP became perhaps the most used OpenPGP implementation for mail encryption.

Firefox is sorta doing this too, baking in the functionality of addons so we don't have to install addons and keep them updated (which is also a security risk since addon authors are usually tempted to change the ownership of the codebase and introduce bad actors). You can run firefox now with their HTTPS-Only mode, aswell as block tracking attempts with 'strict mode'. You can even spoof the useragent with the `resistFingerprinting` flag which is awesome.


As far as I know encryption wasn't removed in 7.2, just disabled via error messages. You could just fork it given the new license and reenable encryption, right?

This is fantastic news well done Let's Encrypt.

Perhaps they can move the encryption into an extra open source module in the future.

Luckily we have Let's Encrypt now.

It seems the end-to-end encryption was done by OpenWhisperSystems.

Yes, we are very fortunate to have Let's Encrypt now.

They have that fantastic 'enimga' encryption.

That's a rather interesting choice of name for an encryption tool.

You can do all that they did AND add encryption on top.

Not that I really want to steal any of Moxie's thunder, but if you're reading this comment thread you might also be interested in SC4:

https://github.com/Spark-Innovations/SC4

Strong encryption that runs in a browser. Recently completed its first security audit.


See it positive. At least it's possible to encrypt the filesystem now.

And encrypted!

I can deal with that encryption. Thanks for the links, didn't hear before this being a discussion topic at all.

Looks like they used Let's Encrypt to save the day!

They should partner with Let's Encrypt! This is great.
next

Legal | privacy