<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 2/23/2018 1:58 PM, Phillip
Hallam-Baker wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAMm+Lwhy_2Z2KFJ=Qx+BS0FYjs9X2yTXhnNBZAwHE2uB1mvr9g@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">The big
problem with using E2E encryption has always been managing the
private keys. </div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">Thunderbird
already has S/MIME support. Almost nobody uses it because it
is a 20 minute process for ME to install a cert. So heaven
help a naive user.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">If someone
could give me a command line tool script that would install an
S/MIME certificate into the Thunderbird store and configure it
to use it, I can provide a tool that will do all the cert
management for the user so the user has encryption available
without having to think.</div>
</div>
</blockquote>
<p>Thunderbird stores the certificates in a NSS database in its
profile. You could very easily use the NSS certutils utility to
insert certificates and the requisite private keys into the
database (you don't want to do this when Thunderbird is running,
of course). We don't ship the certutil tool in our install
package. (The NSS database is itself either a Berkeley DB or a
SQLite database, although I think our profile creation logic
manually forces it to be the older Berkeley DB format).</p>
<p>Yes, the certificate manager in Thunderbird is an
incomprehensible mess. It's not really our fault though; the UI is
managed largely by Firefox's security team, who has very little
need to actually care about the UI for the most part (when was the
last time you used a TLS client certificate?). And we lack people
who understand S/MIME in detail.</p>
<p>We absolutely should provide a *much* better interface for email
encryption. Bonus points if someone can figure out how to manage
both S/MIME and PGP keys in the same UI. I have my suspicions that
anything approximating universal email encryption is feasible, but
there is definitely a lot of room to push the state of the art
here, particularly in UI. "Why Johnny Can't Encrypt" is of course
required reading for anyone seeking to make improvements here.<br>
</p>
<pre class="moz-signature" cols="72">--
Joshua Cranmer
Thunderbird and DXR developer
Source code archæologist</pre>
</body>
</html>