<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 25/08/2015 7:01 PM, R Kent James
wrote:<br>
</div>
<blockquote cite="mid:55DC35E6.7000504@caspia.com" type="cite">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
This is the text from a blog post today on the Thunderbird blog:<br>
<br>
See <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://blog.mozilla.org/thunderbird/2015/08/thunderbird-and-end-to-end-email-encryption-should-this-be-a-priority/">https://blog.mozilla.org/thunderbird/2015/08/thunderbird-and-end-to-end-email-encryption-should-this-be-a-priority/</a><br>
<br>
<p>Should this be a focus for Thunderbird development?</p>
<br>
</blockquote>
I think we should focus on making s/mime a simple process before we
get into upcoming or new end to end encryption. Current processes
require identifying the correct certificate in your browser and
exporting it. (even though the link to retrieve the certificate is
in an email) Then in Thunderbird importing that same certificate.
Cumbersome, difficult to explain to the neophyte and prone to
error. Then the certificate has to be set to be used on the
account. When I asked a group of Microsoft small business
specialist about it's lack of use I was basically told "it is to
hard". They preferred web based solutions that required Zero
intellect from the user. So I think that unless we can make that
preexisting process simple enough for my sister, then there is no
hope of selling encryption. In any form. <br>
<br>
Whilst s/mime has issues, is is widely supported by Mail Clients and
s/mime encrypted messages to say Google can be read onsite if the
relevant certificate is installed in the browser, or it could last
time I checked. It would also be a good toe in the water thing. if
we can not make this user friendly then there is little future for
encryption as the general public struggle with error messages that
say the mail server rejected your message because the address was
invalid. <br>
<br>
As we are seeing with the Microsoft Family protection and some anti
virus products . There is a general movement to abrogate the local
value of certificates, and the chain of trust they are based on by
inserting your own (Name app here) signing authority. But I still
think we need to fix s/mime's usability before we go off on new
security projects.<br>
<br>
Does anyone know if the trustedbird project is still active, they
might be good partners? It looks like they released 24.3 in June. <a
class="moz-txt-link-freetext"
href="https://adullact.net/frs/?release_id=5045&group_id=569"><a class="moz-txt-link-freetext" href="https://adullact.net/frs/?release_id=5045&group_id=569">https://adullact.net/frs/?release_id=5045&group_id=569</a></a><br>
<br>
Matt<br>
<br>
<div class="moz-signature">-- <br>
“Against stupidity the gods themselves contend in vain.” <i>―
Friedrich von Schiller, Die Jungfrau von Orleans </i></div>
</body>
</html>