Re: [PATCH v4 2/3] cli/show: make --decrypt take a keyword.

[Daniel Kahn Gillmor <dkg@fifthhorseman.net>]

On Sat 2017-12-23 10:39:47 -0400, David Bremner wrote:
> One thing that gave me pause is the fact that --decrypt=auto does not
> verify by default. What are the security implications of this?

The only issue is that some messages that are correctly signed are
marked as unsigned if the user hasn't chosen to explicitly --decrypt.
The reverse failure would be the real security problem, but that's not
happening here :)

> Do we verify when indexing? Does this require more documentation?

We do not verify when indexing at all, because we have nothing to do
with any statement about signature verification during indexing (we
aren't caching it in the database, for example)

If notmuch was to do something more clever with signature verification,
i'd be interested in working on it, but i'm not currently clear what
that would be, specifically (e.g. Patrick Brunschwig and i discussed
some interesting thoughts about signature verification for enigmail that
resulted in this mailing list post [0]).

But i don't think these decisions are ones that need to be made in the
context of this particular series.

all that said, if anyone has been thinking about signature verification
for e-mail, i'd be happy to hear your thoughts on how notmuch could do
better there.

     --dkg

[0] https://admin.hostpoint.ch/pipermail/enigmail-users_enigmail.net/2017-November/004683.html