oss-sec mailing list archives
Enigmail warning
From: Henri Salo <henri () nerv fi>
Date: Mon, 18 Aug 2014 09:22:44 +0300
Please read: http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/ Quote from thread below: Enigmail 1.7 is completely broken for my purposes. Steps to reproduce the problem: 1) Write an email in TB. 2) Ensure "Force encryption" in Enigmail. 3) Ensure "Force signing" in Enigmail. 4) Recheck encryption and signing settings... OK. 5) Send the email. 6) Look at the received email. OOPS. It is NOT signed and NOT encrypted. Sorry to say this so directly, but an encryption system, which CONFIRMS to the user in it's graphical user interface on two different places that it will encrypt AND THEN SENDS THE EMAIL WITHOUT ANY ENCRYPTION IN PLAIN TEXT ... is just the BIGGEST IMAGINABLE CATASTROPHE. Sorry for my profane language but there is simply no excuse for such bullshit. I am currently preparing a crypto class for journalists next week to teach them how to use safe email. HOW am I going to explain that? A system tells the user in a separate window as well as in a menu line that everything will be encrypted but then it simply FORGOT to ENCRYPT and, ooops, their report will be intercepted and their source will be tortured ? Ok...let's see....maybe there is some magic incompatibility with the TB or OS version or the specific configuration I used or whatever... As a computer scientist I can imagine many bug-explanations. Good that I am just a computer scientist. As a serious user (dissident, whistle-blower, diplomatic or military user) I would now be waiting for the bad guys come and get me with their water-board. Still as a computer scientist I need an answer to which system I will teach in my class next week. Command-line PGP ?!?
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Enigmail warning Henri Salo (Aug 17)
- Re: Enigmail warning Noel Kuntze (Aug 17)
- Re: Enigmail warning Henri Salo (Aug 17)
- Re: Enigmail warning Pedro Cunha (Aug 18)
- Re: Enigmail warning Henri Salo (Aug 17)
- Re: Enigmail warning Jerome Athias (Aug 18)
- Re: Enigmail warning Nick Boyce (Aug 18)
- RE: Enigmail warning securitylists (Aug 19)
- Re: Enigmail warning Guilherme Andrade (Aug 20)
- RE: Enigmail warning securitylists (Aug 19)
- Re: Enigmail warning cve-assign (Aug 21)
- Re: Enigmail warning Noel Kuntze (Aug 17)