I just installed Thunderbird on my nephew's new school-computer (I'm not starting him on Emacs just yet) and tried out the built-in PGP-support. I noticed that instead of including an unencrypted Subject:-header, it is replaced by "Subject: ..." and then 'filled in' when the message is decrypted. I wonder if anyone has looked into adapting Gnus to do something similar? Or maybe just do the same extraction and 'filling in' of the Subject: when reading an encrypted email sent from Thunderbird. It looks like what Thunderbird does it that it generates an encrypted.asc which decrypts to a MIME message, which has a part that includes the Subject:-header: Content-Type: multipart/mixed; boundary="80MRq3onMnRYcWyMqpzN3xR7VKumL3WsW"; protected-headers="v1" Subject: Dette er emnelinien From: Test Testersen <test@koldfront.dk> To: =?UTF-8?Q?Adam_Sj=c3=b8gren?= <asjo@koldfront.dk> Message-ID: <f66d7c92-9cfb-28ec-3f50-5e7c1132c832@koldfront.dk> So the display-part is perhaps easier than the sending part. I also noticed that Thunderbird included an Autocrypt:-header, which seems to include the public key of the sender - I haven't looked into it, but it might be worth adding support for that in Gnus as well? Or maybe it's a waste of bandwidth... Best regards, Adam -- "Our voodoo-dolls are full of hopes" Adam Sjøgren asjo@koldfront.dk
Adam Sjøgren <asjo@koldfront.dk> writes: > I noticed that instead of including an unencrypted Subject:-header, it > is replaced by "Subject: ..." and then 'filled in' when the message is > decrypted. Hm... I guess it would be possible to update the Summary buffer, too, but it'd be pretty awkward -- do we want to redo the threading, for instance? > I wonder if anyone has looked into adapting Gnus to do something similar? > > Or maybe just do the same extraction and 'filling in' of the Subject: > when reading an encrypted email sent from Thunderbird. > > It looks like what Thunderbird does it that it generates an > encrypted.asc which decrypts to a MIME message, which has a part that > includes the Subject:-header: > > Content-Type: multipart/mixed; boundary="80MRq3onMnRYcWyMqpzN3xR7VKumL3WsW"; > protected-headers="v1" > Subject: Dette er emnelinien > From: Test Testersen <test@koldfront.dk> > To: =?UTF-8?Q?Adam_Sj=c3=b8gren?= <asjo@koldfront.dk> > Message-ID: <f66d7c92-9cfb-28ec-3f50-5e7c1132c832@koldfront.dk> > > So the display-part is perhaps easier than the sending part. We could update the headers in the Article buffer easily enough, but on the other hand -- if the user wants to respond to this in clear text, hitting `C-d' first is easy enough, and ... do we want to encourage responding to encrypted stuff in clear text? (I mean, if we just rewrite the Article buffer Subject/From/etc headers, then hitting `r' will use those, and then we might reveal... stuff...) > I also noticed that Thunderbird included an Autocrypt:-header, which > seems to include the public key of the sender - I haven't looked into > it, but it might be worth adding support for that in Gnus as well? Or > maybe it's a waste of bandwidth... What does the Autocrypt header do? -- (domestic pets only, the antidote for overdose, milk.) bloggy blog: http://lars.ingebrigtsen.no
Lars Ingebrigtsen <larsi@gnus.org> writes: >> I also noticed that Thunderbird included an Autocrypt:-header, which >> seems to include the public key of the sender - I haven't looked into >> it, but it might be worth adding support for that in Gnus as well? Or >> maybe it's a waste of bandwidth... > > What does the Autocrypt header do? https://autocrypt.org/ is a way for publishing your gpg public keys automatically and collecting them as well, among other things. There is quite a handful of MUAs using it, as thunderbird and deltachat: https://autocrypt.org/dev-status.html -- Alberto
>>>>> Alberto Luaces <aluaces@udc.es> writes: > Lars Ingebrigtsen <larsi@gnus.org> writes: >>> I also noticed that Thunderbird included an Autocrypt:-header, >>> which seems to include the public key of the sender - I haven't >>> looked into it, but it might be worth adding support for that in >>> Gnus as well? Or maybe it's a waste of bandwidth... >> >> What does the Autocrypt header do? > https://autocrypt.org/ is a way for publishing your gpg public > keys automatically and collecting them as well, among other > things. > There is quite a handful of MUAs using it, as thunderbird and > deltachat: https://autocrypt.org/dev-status.html > -- Alberto Doesn't autocrypt use the Web Key Directory (WKD) for PGP keys? This seems a pain to set up <https://wiki.gnupg.org/WKD>. Best wishes,
Colin Baxter <m43cap@yandex.com> writes:
> Doesn't autocrypt use the Web Key Directory (WKD) for PGP keys? This
> seems a pain to set up <https://wiki.gnupg.org/WKD>.
AFAIK it doesn't, since everything is encoded into the message's
headers. I have been using it without any WKD setup.
Nevertheless, that fact doesn't rule out that it can be used, but I
never heard about it.
--
Alberto
Hello Alberto, >>>>> Alberto Luaces <aluaces@udc.es> writes: > Colin Baxter <m43cap@yandex.com> writes: >> Doesn't autocrypt use the Web Key Directory (WKD) for PGP keys? >> This seems a pain to set up <https://wiki.gnupg.org/WKD>. > AFAIK it doesn't, since everything is encoded into the message's > headers. I have been using it without any WKD setup. > Nevertheless, that fact doesn't rule out that it can be used, but > I never heard about it. Ok, my mistake. My question is getting to be a little off-topic, but if WKD is not used then how is the key for a new recipient automatically located? Best wishes, Colin.
Colin Baxter <m43cap@yandex.com> writes: > Hello Alberto, >>>>>> Alberto Luaces <aluaces@udc.es> writes: > > > Colin Baxter <m43cap@yandex.com> writes: > >> Doesn't autocrypt use the Web Key Directory (WKD) for PGP keys? > >> This seems a pain to set up <https://wiki.gnupg.org/WKD>. > > > AFAIK it doesn't, since everything is encoded into the message's > > headers. I have been using it without any WKD setup. > > > Nevertheless, that fact doesn't rule out that it can be used, but > > I never heard about it. > > Ok, my mistake. My question is getting to be a little off-topic, but if > WKD is not used then how is the key for a new recipient automatically > located? No problem. It is a discovery protocol, so it grows stronger —so to say— as far as the communication evolves. You start sending a message in the clear, but offer your key in the headers, so it is automatically collected and used by your interlocutor in the following messages. Of course you have also to have an out-of-band mean of verifying the identity of the other party. Maybe I lost some details or explained it incorrectly, so here you will find the idea: https://autocrypt.org/examples.html -- Alberto
>>>>> Alberto Luaces <aluaces@udc.es> writes: > Colin Baxter <m43cap@yandex.com> writes: >> Hello Alberto, >>>>>>> Alberto Luaces <aluaces@udc.es> writes: >> >> > Colin Baxter <m43cap@yandex.com> writes: >> Doesn't autocrypt >> use the Web Key Directory (WKD) for PGP keys? >> This seems a >> pain to set up <https://wiki.gnupg.org/WKD>. >> >> > AFAIK it doesn't, since everything is encoded into the >> message's > headers. I have been using it without any WKD setup. >> >> > Nevertheless, that fact doesn't rule out that it can be used, >> but > I never heard about it. >> >> Ok, my mistake. My question is getting to be a little off-topic, >> but if WKD is not used then how is the key for a new recipient >> automatically located? > No problem. It is a discovery protocol, so it grows stronger —so > to say— as far as the communication evolves. You start sending a > message in the clear, but offer your key in the headers, so it is > automatically collected and used by your interlocutor in the > following messages. Of course you have also to have an > out-of-band mean of verifying the identity of the other party. > Maybe I lost some details or explained it incorrectly, so here you > will find the idea: https://autocrypt.org/examples.html I like the idea of sending the key in a header, with subsequent automatic exchanges. That is very nice. :-) Best wishes, Colin.