Mailing List Archive

If you think about using the current stable version of Thunderbird
(version 78), then there is no Enigmail and no Autocrypt. OpenPGP has
been implemented directly in Thunderbird, but there is currently no
Autocrypt support in Thunderbird.

-Patrick

Daniel Bossert via Gnupg-users wrote on 20.11.2020 10:23:
> Hello all
>
> How secure is it to use Thundebrird with Autocrypt? I use Sylpheed at the moment, but it is not that comfortable to use as Thunderbird.
> Also, when I send an email, the signature will be shown instead like with thunderbid just an info that the mail is signed
>
> Do you have some inputs?
>
> Regards
> Daniel
>
>
>
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users@gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnupg-users
>

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

On Fri, 20 Nov 2020 10:23, Daniel Bossert said:

> How secure is it to use Thundebrird with Autocrypt? I use Sylpheed at
> the moment, but it is not that comfortable to use as Thunderbird.

Checkout Claws-mail which was forked from Sylpheed many years ago. The
OpenPGP and S/MIME integration of both was initially done by me but many
others improved it at lot. Claws is like Thunderbird cross-platform.

The current TB OpenPGP support is pretty basic after they removed
Enigmail.


Salam-Shalom,

Werner

--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

Hello Werner

I would like to use claws-mail, but it looked quite old-school when I last used it.
There was no auto-configure of mail setup (find mail-server by itself).

But I will install it again and check it out.

Thank you
Daniel


On Sat, 21 Nov 2020 19:02:33 +0100
Werner Koch <wk@gnupg.org> wrote:

> On Fri, 20 Nov 2020 10:23, Daniel Bossert said:
>
> > How secure is it to use Thundebrird with Autocrypt? I use Sylpheed at
> > the moment, but it is not that comfortable to use as Thunderbird.
>
> Checkout Claws-mail which was forked from Sylpheed many years ago. The
> OpenPGP and S/MIME integration of both was initially done by me but many
> others improved it at lot. Claws is like Thunderbird cross-platform.
>
> The current TB OpenPGP support is pretty basic after they removed
> Enigmail.
>
>
> Salam-Shalom,
>
> Werner
>
> --
> Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.


--
PGP: 81A8 1EC7 179C BE5F 02A8 2C01 3FF1 07B6 FC68 F10A

Claws Mail is an useful alternative, but please keep aware it does not
support html mail, text only!
https://www.claws-mail.org/manual/de/claws-mail-manual.html#AEN955

Best regards, Chris


> Date: Sat, 21 Nov 2020 19:02:33 +0100
> From: Werner Koch <wk@gnupg.org>
> To: Daniel Bossert via Gnupg-users <gnupg-users@gnupg.org>
> Subject: Re: Thunderbird / Enigmail / Autocrypt
> Message-ID: <87sg92lhae.fsf@wheatstone.g10code.de>
> Content-Type: text/plain; charset="us-ascii"
> ...
> Checkout Claws-mail which was forked from Sylpheed many years ago.
> The
> OpenPGP and S/MIME integration of both was initially done by me but
> many
> others improved it at lot. Claws is like Thunderbird cross-platform.
> The current TB OpenPGP support is pretty basic after they removed
> Enigmail.
> Salam-Shalom,
> Werner


_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Hi Chris,

Am 22.11.20 um 10:02 schrieb gnupgpacker:
> Claws Mail is an useful alternative, but please keep aware it does not
> support html mail, text only!
> https://www.claws-mail.org/manual/de/claws-mail-manual.html#AEN955
>
> Best regards, Chris
>

I don't understand why HTML in e-Mails is so important for some people.

For example, I configured my Mailserver to sort out HTML-Mails as Spam
as long the sender is not on a whitelist.
HTML in e-Mails is a very big security risk in my eyes.

regards
Juergen

--
/¯\ No |
\ / HTML | Juergen Bruckner
X in | juergen@bruckner.email
/ \ Mail |

On Sun, Nov 22, 2020 at 12:38:52PM +0100, Juergen Bruckner via Gnupg-users wrote:
>
> I don't understand why HTML in e-Mails is so important for some people.
>
> For example, I configured my Mailserver to sort out HTML-Mails as Spam as
> long the sender is not on a whitelist.
> HTML in e-Mails is a very big security risk in my eyes.
+1

ael


_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

> On 22 Nov 2020, at 11:40, Juergen Bruckner via Gnupg-users <gnupg-users@gnupg.org> wrote:
>
> HTML in e-Mails is a very big security risk in my eyes.

Not just yours, but unfortunately for many people it is a risk that they must absorb, because e.g. their job may depend upon it. It is not always feasible to scold your correspondents about their use of HTML mail, just as it is not always feasible to complain about their use of Microsoft Word. People need tools that work in the real world; not everyone can afford the luxury of righteous evangelism.

A
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

On Sun, 22 Nov 2020 16:06:41 +0000
Andrew Gallagher <andrewg@andrewg.com> wrote:

Hello Andrew,

>It is not always feasible to scold your correspondents about their use
>of HTML mail,

True, but when my bank (just one example) tells me about their 'caring
about security' and then spewing HTML left, right, and centre, whilst
simultaneously disavowing themselves of blame should a virus be
transported by their message, they can, quite frankly, go take a running
jump.

--
Regards _
/ ) "The blindingly obvious is
/ _)rad never immediately apparent"
Tell the dinosaurs they just won't survive
The History Of The World (Part 1) - The Damned

On Sun, 22 Nov 2020 16:17:37 +0000, Brad Rogers stated:
>True, but when my bank (just one example) tells me about their 'caring
>about security' and then spewing HTML left, right, and centre, whilst
>simultaneously disavowing themselves of blame should a virus be
>transported by their message, they can, quite frankly, go take a
>running jump.

So, off the top of your head, how many viruses, parasites and
other assorted malignancies has your bank infected you with?

--
Jerry

On 22-11-2020 12:38, Juergen Bruckner via Gnupg-users wrote:

> I don't understand why HTML in e-Mails is so important for some people.

I agree on a personal level, but if you use your email also to
communicate with business users (usually using Outlook) it would be nice
to get their mails in a human readable format. Which requires,
unfortunately, usually html.

--
ir. J.C.A. Wevers
PGP/GPG public keys at http://www.xs4all.nl/~johanw/pgpkeys.html


_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

El día lunes, noviembre 23, 2020 a las 03:03:54a. m. +0100, Johan Wevers escribió:

> On 22-11-2020 12:38, Juergen Bruckner via Gnupg-users wrote:
>
> > I don't understand why HTML in e-Mails is so important for some people.
>
> I agree on a personal level, but if you use your email also to
> communicate with business users (usually using Outlook) it would be nice
> to get their mails in a human readable format. Which requires,
> unfortunately, usually html.

Since ages human read mails in ASCII or UTF-8 text. Why you think this
is not a "human readable format"?

HTML as e-mail (read carefully: as email, not as attachment) should be
forbidden because most MUA automatically fetch additional remote content
which violates privacy and can fetch bad content into your system.
You're warned.

matthias

--
Matthias Apitz, ? guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
??? ????? ??? ??????, ??? ?????? ??? ?????????? (??a????? ????? ?????)
Without books no knowledge - without knowledge no communism (Vladimir Ilyich Lenin)
Sin libros no hay saber - sin saber no hay comunismo. (Vladimir Ilich Lenin)

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

??????? Original Message ???????
On Sunday, November 22, 2020 10:08 PM, Matthias Apitz <guru@unixarea.de> wrote:

> El día lunes, noviembre 23, 2020 a las 03:03:54a. m. +0100, Johan Wevers escribió:
>
> > On 22-11-2020 12:38, Juergen Bruckner via Gnupg-users wrote:
> >
> > > I don't understand why HTML in e-Mails is so important for some people.
> >
> > I agree on a personal level, but if you use your email also to
> > communicate with business users (usually using Outlook) it would be nice
> > to get their mails in a human readable format. Which requires,
> > unfortunately, usually html.
>
> Since ages human read mails in ASCII or UTF-8 text. Why you think this
> is not a "human readable format"?
>
> HTML as e-mail (read carefully: as email, not as attachment) should be
> forbidden because most MUA automatically fetch additional remote content
> which violates privacy and can fetch bad content into your system.
> You're warned.
>
> matthias
>

At my job, I frequently send out summary charts and graphs surrounded by text.
Attachments simply do not work; my audience cannot spend the mental energy to
context-switch between text and attachments, and my reports become unusable.

I also provide hyperlinks in my reports. Sharing hyperlinks in plaintext emails
is possible, but verbose and unfriendly to the viewer.

In such circumstances, plaintext email is not human readable; I must use HTML.

Thanks,
-Caleb


_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

I don't know if this is the right place here, but as we are discussing about sylpheed and claws-mail as well:
I have the following issue with Sylpheed:

I searched in Sylpheed for an email of April 20, 2020 for an insurance. I could easily find it in Thunderbird, but Sylpheed couldn't find it. I didn't see the mail in the inbox list of Sylpheed. Could it be Sylpheed doesn't catch all mail? How can I force it to sync everything it finds on the server?

I know it's not pgp related, but you guys know these two MUA, so therefore I ask.

Regards
Daniel

--
PGP: 81A8 1EC7 179C BE5F 02A8 2C01 3FF1 07B6 FC68 F10A

On Mon, 23 Nov 2020 07:22:19 +0000
cqcallaw via Gnupg-users <gnupg-users@gnupg.org> wrote:

> ??????? Original Message ???????
> On Sunday, November 22, 2020 10:08 PM, Matthias Apitz <guru@unixarea.de> wrote:
>
> > El día lunes, noviembre 23, 2020 a las 03:03:54a. m. +0100, Johan Wevers escribió:
> >
> > > On 22-11-2020 12:38, Juergen Bruckner via Gnupg-users wrote:
> > >
> > > > I don't understand why HTML in e-Mails is so important for some people.
> > >
> > > I agree on a personal level, but if you use your email also to
> > > communicate with business users (usually using Outlook) it would be nice
> > > to get their mails in a human readable format. Which requires,
> > > unfortunately, usually html.
> >
> > Since ages human read mails in ASCII or UTF-8 text. Why you think this
> > is not a "human readable format"?
> >
> > HTML as e-mail (read carefully: as email, not as attachment) should be
> > forbidden because most MUA automatically fetch additional remote content
> > which violates privacy and can fetch bad content into your system.
> > You're warned.
> >
> > matthias
> >
>
> At my job, I frequently send out summary charts and graphs surrounded by text.
> Attachments simply do not work; my audience cannot spend the mental energy to
> context-switch between text and attachments, and my reports become unusable.
>
> I also provide hyperlinks in my reports. Sharing hyperlinks in plaintext emails
> is possible, but verbose and unfriendly to the viewer.
>
> In such circumstances, plaintext email is not human readable; I must use HTML.
>
> Thanks,
> -Caleb

Probably HTML within an organization should be allowed but not when leaving such one?

>
>
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users@gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnupg-users

--
PGP: 81A8 1EC7 179C BE5F 02A8 2C01 3FF1 07B6 FC68 F10A

El d?a lunes, noviembre 23, 2020 a las 07:22:19a. m. +0000, cqcallaw escribi?:

> > Since ages human read mails in ASCII or UTF-8 text. Why you think this
> > is not a "human readable format"?
> >
> > HTML as e-mail (read carefully: as email, not as attachment) should be
> > forbidden because most MUA automatically fetch additional remote content
> > which violates privacy and can fetch bad content into your system.
> > You're warned.
> >
> > matthias
> >
>
> At my job, I frequently send out summary charts and graphs surrounded by text.
> Attachments simply do not work; my audience cannot spend the mental energy to
> context-switch between text and attachments, and my reports become unusable.
>
> I also provide hyperlinks in my reports. Sharing hyperlinks in plaintext emails
> is possible, but verbose and unfriendly to the viewer.
>
> In such circumstances, plaintext email is not human readable; I must use HTML.

Below you find a good example of such HTML SPAM going directly to an
external web server to fetch an "IMG" which could contain malisious code.
Is this what you really want to send to your boss or colleagues?

matthias


<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Unbenanntes Dokument</title>
</head>

<body>
<p><strong>FFP2 Maske 1,89 bzw. 1,99 Euro</strong>. Die beliebteste und
meist getragene Atemmaske der Welt.</p>
<p>&nbsp;</p>
<p>Sehr geehrte Damen und Herren,</p>
<p>Folgende Angebote sind sofort lieferbar, einzeln verschweisst:</p>
<p><img
src="https://scontent-frx5-1.xx.fbcdn.net/v/t1.0-9/126513141_2743524842569455_973641306125964327_o.jpg?_nc_cat=100&amp;ccb=2&amp;_nc_sid=730e14&amp;_nc_ohc=NfVk0yNJgskAX9WQt3q&amp;_nc_ht=scontent-frx5-1.xx&amp;oh=2064e0f7143521537359d540ebc4a7c4&amp;oe=5FDF8DE4"
width="650" height="650" /></p>
<p><u>CE-Zertifiziert</u> durch Institut der europ&auml;ischen
Union.<strong><br /> Schutzklasse FFP2!</strong> (KN95) Guter Schutz vor
SARSCoV2 - Covid19CoronaViren.</p>
<p>Lieferung an Firmen, Beh&ouml;rden, Arztpraxen, Apotheken, Kliniken
usw.:</p>
<p>Abnahmemengen: 10er weise oder 100er weise.</p>
<p><strong><em>FFP2 Atemschutzmasken: (Auch nach AT, CH, NL, LU)<br /> 10
St. 19,90 Euro zzgl. 16 Proz. MwSt.</em></strong></p>
<p><em><strong>Angebot f&uuml;r Firmen, Kliniken, Arztpraxen:<br /> 100 St.
189,- Euro zzgl. 16 Proz. MwSt.</strong></em></p>
<p>(Gr&ouml;&szlig;ere Mengen auch sofort lieferbar.)</p>
<p>Bestellen Sie ganz einfach und zeitsparend, in dem Sie uns auf dieses
Schreiben <strong><u>einfach antworten</u></strong><u>.</u><br />
(Lieferung auf Rechnung. Keine Vorkasse oder &auml;hnliches.)</p>
<p>ceschutz@gmx.de</p>
<p><strong>Versandkostenfreie Lieferung!</strong></p>
<p>6 Wochen R&uuml;ckgaberecht bei Nichtgefallen! Ihnen enstehen keine
Kosten.</p>
<p>&nbsp;</p>
<p>Mit freundlichen Gr&uuml;&szlig;en,</p>
<p>Michaela Kress<br /> CE-Schutz Vertrieb<br /> Hannover</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>Bitte antworten Sie uns direkt per Email.</p>
<p>EU-Kunden k&ouml;nnen gern die Umsatzsteuernummer (VAT) angeben.</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
</body>
</html>


_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

On Mon, 23 Nov 2020 07:22, cqcallaw said:

> At my job, I frequently send out summary charts and graphs surrounded by text.
> Attachments simply do not work; my audience cannot spend the mental energy to

Proper MUAs display inline images without problems. I recall that even
exmh did this ~25 years ago. It is just that the marketing department
can't enforce the corporate identity on text mails - or are too lazy to
create rules which work with plain text (and maybe inline images).

And well, I like HTML mails: my main address is free of spam thanks to a
simple procmail rule ;-)


Shalom-Salam,

Werner

--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

On Sun, 22 Nov 2020 10:02, gnupgpacker said:
> Claws Mail is an useful alternative, but please keep aware it does not
> support html mail, text only!
> https://www.claws-mail.org/manual/de/claws-mail-manual.html#AEN955

Just load one of the HTML viewer plugins. Note that most plugins are an
integral part of Claws and thus don't run into problems like Enigmail
with Thunderbird.

Right, the first-use setup is not as easy as with Thunderbird. That is
the difference between a multi-million dollar per year project and a
voluntary thingy.


Salam-Shalom,

Werner

--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

On Mon, Nov 23, 2020 at 07:08:12AM +0100, Matthias Apitz wrote:
> El d?a lunes, noviembre 23, 2020 a las 03:03:54a. m. +0100, Johan Wevers escribi?:
>
> > On 22-11-2020 12:38, Juergen Bruckner via Gnupg-users wrote:
> >
> > > I don't understand why HTML in e-Mails is so important for some people.
> >
> > I agree on a personal level, but if you use your email also to
> > communicate with business users (usually using Outlook) it would be nice
> > to get their mails in a human readable format. Which requires,
> > unfortunately, usually html.
>
> Since ages human read mails in ASCII or UTF-8 text. Why you think this
> is not a "human readable format"?
>
> HTML as e-mail (read carefully: as email, not as attachment) should be
> forbidden because most MUA automatically fetch additional remote content
> which violates privacy and can fetch bad content into your system.
> You're warned.

I consider that Mutt gives me the best of both, when I configure it:

auto_view text/html

and in .mailcap:

text/html; \
lynx -dump -force_html %s; \
copiousoutput

The text is flattened. The result is sometimes ugly, but readable.

Attachments (such as images, or things purporting to be images) are
presented separately, and I can open them if I choose. (Or I can copy
them out and inspect them in other ways, if I'm suspicious. Examining
the un-rendered structure and content of some malicious messages can
be briefly entertaining.)

I would be mildly surprised to learn that my co-workers, outside of my
immediate workgroup, are even aware that I don't see their emails
rendered the way they do. And nobody has ever told me, "your message
looks funny," except an occasional comment that someone couldn't open
the "attachment" (meaning the PGP/MIME signature). Those stopped when
I got a corporate X.509 certificate and configured Mutt to use S/MIME
for internal mail.

Other console MUAs probably can do similar things when configured to
do so.

--
Mark H. Wood
Lead Technology Analyst

University Library
Indiana University - Purdue University Indianapolis
755 W. Michigan Street
Indianapolis, IN 46202
317-274-0749
www.ulib.iupui.edu

On 23-11-2020 7:08, Matthias Apitz wrote:

> Since ages human read mails in ASCII or UTF-8 text. Why you think this
> is not a "human readable format"?

Sure, hand crafted html in a text reader is human readable. But the html
that is vomited by Outlook is not (unless you are a very experienced web
developer).

> HTML as e-mail (read carefully: as email, not as attachment) should be
> forbidden because most MUA automatically fetch additional remote content
> which violates privacy and can fetch bad content into your system.

Fortunately Thunderbird does not do that by default. But you can select
trusted domains for which it does if you like.

--
ir. J.C.A. Wevers
PGP/GPG public keys at http://www.xs4all.nl/~johanw/pgpkeys.html


_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Thanks Werner.

After further investigation about html mailing with Claws Mail:
'Dillo HTML viewer' project has been updated Jun-2015, not available for
Windows.
'litehtml' is available for Windows, but latest update is Oct-2015.

In our environment ~ 70% of contacts are using M$ Outlook and its
standard html mail functions, so discussion about sense of purpose are
mindless even a change of security awareness take place around there...
But you are right, html mail is definitely an annoyance and security
risk, but wide spreaded compatibility to several communication partners
and its needs is necessary!

Best regards, Chris

> -----Original Message-----
> From: Werner Koch <wk@gnupg.org>
> Sent: Monday, November 23, 2020 1:30 PM
> ...
> Just load one of the HTML viewer plugins. Note that most plugins are
> an integral part of Claws and thus don't run into problems like
> Enigmail with Thunderbird.


_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

On Mon, Nov 23, 2020 at 01:23:39PM +0100, Werner Koch via Gnupg-users <gnupg-users@gnupg.org> wrote:

> On Mon, 23 Nov 2020 07:22, cqcallaw said:
>
> > At my job, I frequently send out summary charts and graphs surrounded by text.
> > Attachments simply do not work; my audience cannot spend the mental energy to
>
> Proper MUAs display inline images without problems. I recall that even
> exmh did this ~25 years ago. It is just that the marketing department
> can't enforce the corporate identity on text mails - or are too lazy to
> create rules which work with plain text (and maybe inline images).
>
> And well, I like HTML mails: my main address is free of spam thanks to a
> simple procmail rule ;-)
>
> Shalom-Salam,
>
> Werner

Apologies in advance. I know this is all off-topic for
a gnupg mailing list, but for those who really hate
html email, and are able to function without it,
there's a potentially useful mail filter I wrote that
converts everything to text that can be converted, and
deletes everything else.

http://raf.org/textmail
https://github.com/raforg/textmail

It makes it look like everyone is sending you plain text. :-)

For everyone else, I recommend lots of phishing training
to mitigate the biggest risks of html email.

At least until gmail/outlook/etc. implement, by default,
the equivalent of Thunderbird's brilliant Torpedo
anti-phishing addon.

cheers,
raf


_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

On Mon, 23 Nov 2020 18:03, gnupgpacker said:

> After further investigation about html mailing with Claws Mail:
> 'Dillo HTML viewer' project has been updated Jun-2015, not available for
> Windows.

Mature software does not always need updates. Nevertheless the plugin
code was recently updated to get rid of conditionals to build with gtk2.
Right, it is not availabale for Windows but ...

> 'litehtml' is available for Windows, but latest update is Oct-2015.

The latest update is just 6 weeks old. The plugin is part of the
standard claws installer for Windows. Right, the Windows installer is
often behind the source release (right now by a year). But again, this
is a project by volunteers.

FWIW, for years we distributed Claws as part of Gpg4win but at some
point decided that it is better to let the Claws devs do the installer
so that we can concentrate on things we are can do best.


Shalom-Salam,

Werner

--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.