Problem with Mozilla Thunderbird PGP mails

Problem with Mozilla Thunderbird PGP mails

[Steve Youngs]

[-- Attachment #1: Type: text/plain, Size: 545 bytes --]

I've noticed that if someone sends me a cleartext PGP signed (ie
non-MIME) message from Mozilla Thunderbird, Gnus does not recognise it
as being signed.

Has anyone else seen this?  Or know what the problem is?

Apparently, these messages can still be verified using Mailcrypt, but
not with PGG.

-- 
|---<Steve Youngs>---------------<GnuPG KeyID: A94B3003>---|
|              Ashes to ashes, dust to dust.               |
|      The proof of the pudding, is under the crust.       |
|------------------------------<sryoungs@bigpond.net.au>---|

[-- Attachment #2: Type: application/pgp-signature, Size: 256 bytes --]

Re: Problem with Mozilla Thunderbird PGP mails

[Jesper Harder]

Steve Youngs <sryoungs@bigpond.net.au> writes:

> I've noticed that if someone sends me a cleartext PGP signed (ie
> non-MIME) message from Mozilla Thunderbird, Gnus does not recognise it
> as being signed.
>
> Has anyone else seen this?  Or know what the problem is?

They are probably format=flowed.

Re: Problem with Mozilla Thunderbird PGP mails

[Steve Youngs]

[-- Attachment #1: Type: text/plain, Size: 647 bytes --]

* Jesper Harder <harder@ifa.au.dk> writes:

  > Steve Youngs <sryoungs@bigpond.net.au> writes:
  >> I've noticed that if someone sends me a cleartext PGP signed (ie
  >> non-MIME) message from Mozilla Thunderbird, Gnus does not recognise it
  >> as being signed.
  >> 
  >> Has anyone else seen this?  Or know what the problem is?

  > They are probably format=flowed.

So what can we do about it?

-- 
|---<Steve Youngs>---------------<GnuPG KeyID: A94B3003>---|
|              Ashes to ashes, dust to dust.               |
|      The proof of the pudding, is under the crust.       |
|------------------------------<sryoungs@bigpond.net.au>---|

[-- Attachment #2: Type: application/pgp-signature, Size: 256 bytes --]

Re: Problem with Mozilla Thunderbird PGP mails

[Jesper Harder]

[-- Attachment #1: Type: text/plain, Size: 953 bytes --]

Steve Youngs <sryoungs@bigpond.net.au> writes:

> * Jesper Harder <harder@ifa.au.dk> writes:
>
>   > Steve Youngs <sryoungs@bigpond.net.au> writes:
>   >> I've noticed that if someone sends me a cleartext PGP signed (ie
>   >> non-MIME) message from Mozilla Thunderbird, Gnus does not recognise it
>   >> as being signed.
>   >> 
>   >> Has anyone else seen this?  Or know what the problem is?
>
>   > They are probably format=flowed.
>
> So what can we do about it?

Hit the Thunderbird developers with a cluestick?  Using cleartext pgp
in a MIME message that is more complicated than

  Content-Type: text/plain
  Content-Transfer-Encoding: 7bit

is fundamentally broken.

Seriously, to accomodate inapproriate use of inline pgp we have to
look for magic strings inside MIME multiparts (and format=flowed
parts).

For example here's a patch that "fixes" it for format=flowed (it's not
a proper solution -- it just disables f=f treatment completely).


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: Type: text/x-patch, Size: 684 bytes --]

*** /home/harder/gnus/lisp/mm-decode.el	Wed Mar 10 12:56:07 2004
--- /home/harder/cvsgnus/lisp/mm-decode.el	Tue Mar 16 03:35:35 2004
***************
*** 578,586 ****
  
  (defun mm-dissect-singlepart (ctl cte &optional force cdl description id)
    (when (or force
! 	    (if (equal "text/plain" (car ctl))
! 		(assoc 'format ctl)
! 	      t))
      (mm-make-handle
       (mm-copy-to-buffer) ctl cte nil cdl description nil id)))
  
--- 578,584 ----
  
  (defun mm-dissect-singlepart (ctl cte &optional force cdl description id)
    (when (or force
! 	    (not (equal "text/plain" (car ctl))))
      (mm-make-handle
       (mm-copy-to-buffer) ctl cte nil cdl description nil id)))
 

Re: Problem with Mozilla Thunderbird PGP mails

[Steve Youngs]

[-- Attachment #1: Type: text/plain, Size: 901 bytes --]

* Jesper Harder <harder@ifa.au.dk> writes:

  > Hit the Thunderbird developers with a cluestick?

I like this solution. :-)

  > Seriously, to accomodate inapproriate use of inline pgp we have to
  > look for magic strings inside MIME multiparts (and format=flowed
  > parts).

Couldn't Gnus just simply scan the message for 
"----Begin PGP Signed Message----", or whatever it is?  But that won't
solve the problem of PGG not being able to verify the sig (mailcrypt
can, BTW).

So this problem is two-fold (and not our fault)...

  1) Gnus doesn't recognise that the message is signed.

  2) PGG can't verify the signature. (possibly related to #1)

 

-- 
|---<Steve Youngs>---------------<GnuPG KeyID: A94B3003>---|
|              Ashes to ashes, dust to dust.               |
|      The proof of the pudding, is under the crust.       |
|------------------------------<sryoungs@bigpond.net.au>---|

[-- Attachment #2: Type: application/pgp-signature, Size: 256 bytes --]

Re: Problem with Mozilla Thunderbird PGP mails

[Jesper Harder]

Steve Youngs <sryoungs@bigpond.net.au> writes:

> * Jesper Harder <harder@ifa.au.dk> writes:
>
>   > Hit the Thunderbird developers with a cluestick?
>
> I like this solution. :-)

We'd need to spank ourselves as well.

Gnus can also generate these monstrosities.  I just disabled f=f when
generating inline pgp, but you can still generate evil inline gpg
inside multiparts with

   <#part sign=pgp>

> So this problem is two-fold (and not our fault)...
>
>   1) Gnus doesn't recognise that the message is signed.
>
>   2) PGG can't verify the signature. (possibly related to #1)

AFAIK, 1) is the only problem.

Re: Problem with Mozilla Thunderbird PGP mails

[Lars Magne Ingebrigtsen]

Jesper Harder <harder@ifa.au.dk> writes:

> Seriously, to accomodate inapproriate use of inline pgp we have to
> look for magic strings inside MIME multiparts (and format=flowed
> parts).

That shouldn't be too difficult, I'd have thought.  (Hm.  Perhaps it
will.)  Do you have any example messages I could look at?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: Problem with Mozilla Thunderbird PGP mails

[Jesper Harder]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Jesper Harder <harder@ifa.au.dk> writes:
>
>> Seriously, to accomodate inapproriate use of inline pgp we have to
>> look for magic strings inside MIME multiparts (and format=flowed
>> parts).
>
> That shouldn't be too difficult, I'd have thought.  (Hm.  Perhaps it
> will.)  Do you have any example messages I could look at?

I think a fascist filter ate my reply, so I sent an example generated
by Gnus itself to gnus.test instead, <news:m3isew2xjc.fsf@defun.localdomain>

-- 
Jesper Harder                                <http://purl.org/harder/>

Re: Problem with Mozilla Thunderbird PGP mails

[Lars Magne Ingebrigtsen]

Jesper Harder <harder@ifa.au.dk> writes:

> I think a fascist filter ate my reply, so I sent an example generated
> by Gnus itself to gnus.test instead, <news:m3isew2xjc.fsf@defun.localdomain>

Uhm...  looking over the code, this doesn't really seem all that easy
to fix.  :-)

But perhaps I'm squinting the wrong way, and the PGP-to-kinda-MIME
parser could be placed a different place in the decoding chain?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen