From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Notmuch Mail <notmuch@notmuchmail.org>
Subject: Re: cope with inline PGP encrypted messages
Date: Wed, 09 May 2018 17:53:54 -0400 [thread overview]
Message-ID: <877eoclclp.fsf@fifthhorseman.net> (raw)
In-Reply-To: <20171212071553.6440-1-dkg@fifthhorseman.net>
On Tue 2017-12-12 01:15:48 -0500, Daniel Kahn Gillmor wrote:
> Inline PGP encrypted messages are clearly worse than PGP/MIME
> structured encrypted messages. There are no standards for how they
> are formed, and they don't offer any structured metadata about how to
> interpret the bytestream produced by decrypting them.
>
> However, some other MUAs and end-user workflows may make creation of
> inline PGP encrypted messages the only available option for message
> encryption, and when Notmuch encounters such a message, it should make
> a reasonable best-effort to render the cleartext to the user.
Jamie Rollins points out that I need to think more about some of the
security implications of this patch series, so i'd prefer to withdraw it
from consideration for notmuch at the moment. i'd say it's a WIP but
really not ready for general consumption. Not sure how to best
represent that in nmbug -- but for now i've removed
notmuch::needs-review and added notmuch::wip. bremner, let me know if
you think i should have done something different.
I do think that we need to come up with *some* way of letting people
read messages with inline PGP encrypted chunks in them safely.
Otherwise, notmuch users will resort to dirty tricks (because they want
to read the mail), and those dirty tricks will possibly be worse than
anything we come up with.
But higher-priority issues are drawing my attention right now, and i
don't want this series to distract from them.
--dkg
next prev parent reply other threads:[~2018-05-09 21:55 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-12 7:15 cope with inline PGP encrypted messages Daniel Kahn Gillmor
2017-12-12 7:15 ` [PATCH 1/5] crypto: prepare for decryption of " Daniel Kahn Gillmor
2018-04-30 11:24 ` David Bremner
2018-04-30 11:42 ` David Bremner
2018-05-01 17:42 ` Daniel Kahn Gillmor
2018-05-03 21:34 ` David Bremner
2017-12-12 7:15 ` [PATCH 2/5] cli/{show, reply}: try to decrypt " Daniel Kahn Gillmor
2017-12-12 7:15 ` [PATCH 3/5] index: tag text parts with inline PGP encryption as "encrypted" Daniel Kahn Gillmor
2017-12-12 7:15 ` [PATCH 4/5] index: _index_encrypted_mime_part returns success or failure Daniel Kahn Gillmor
2017-12-12 7:15 ` [PATCH 5/5] index: try indexing the cleartext of inline PGP encrypted text parts Daniel Kahn Gillmor
2018-05-09 21:53 ` Daniel Kahn Gillmor [this message]
2018-05-10 12:39 ` cope with inline PGP encrypted messages David Bremner
2018-05-11 17:42 ` Daniel Kahn Gillmor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://notmuchmail.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877eoclclp.fsf@fifthhorseman.net \
--to=dkg@fifthhorseman.net \
--cc=notmuch@notmuchmail.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://yhetil.org/notmuch.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).