<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body smarttemplateinserted="true" text="#000000" bgcolor="#FFFFFF">
<div id="smartTemplate4-template"><br>
</div>
<div id="smartTemplate4-quoteHeader">
<style type="text/css" scoped="">
#newHeaderAG1 b { font-weight:bold; color: #990033; min-width: 4.5em; max-width:none; display:inline-block;}
</style>
<blockquote type="cite" style="margin-bottom: -20px !important;
padding-bottom:20px !important;">
<div id="newHeaderAG1" style="font-size: x-small; padding:1em;
background-color:rgba(220,220,240,0.4); border-radius:3px;"> <b>Subject:</b>Re:
Thunderbird and Encryption - the future of privacy - pEp<br>
<b>From:</b>Joshua Cranmer <a class="moz-txt-link-rfc2396E" href="mailto:pidgeot18@gmail.com"><pidgeot18@gmail.com></a><br>
<b>To:</b>Tb-planning <br>
<b>Sent: </b>Saturday, 24/02/2018 21:42:58 21:42 GMT ST +0000
[Week 8]<br>
</div>
</blockquote>
</div>
<blockquote type="cite"
cite="mid:53b1fc53-a63d-3a08-8329-d232a8468439@gmail.com"
id="mid_53b1fc53_a63d_3a08_8329_d232a8468439_gmail_com" class="
cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div class="moz-cite-prefix">On 2/23/2018 1:58 PM, Phillip
Hallam-Baker wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAMm+Lwhy_2Z2KFJ=Qx+BS0FYjs9X2yTXhnNBZAwHE2uB1mvr9g@mail.gmail.com"
id="mid_CAMm_Lwhy_2Z2KFJ_Qx_BS0FYjs9X2yTXhnNBZAwHE2uB1mvr9g_mail_gmail_com"
class=" cite">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">The big
problem with using E2E encryption has always been managing
the private keys. </div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">Thunderbird
already has S/MIME support. Almost nobody uses it because it
is a 20 minute process for ME to install a cert. So heaven
help a naive user.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">If someone
could give me a command line tool script that would install
an S/MIME certificate into the Thunderbird store and
configure it to use it, I can provide a tool that will do
all the cert management for the user so the user has
encryption available without having to think.</div>
</div>
</blockquote>
<snip><br>
<br>
We absolutely should provide a *much* better interface for email
encryption. Bonus points if someone can figure out how to manage
both S/MIME and PGP keys in the same UI. I have my suspicions that
anything approximating universal email encryption is feasible, but
there is definitely a lot of room to push the state of the art
here, particularly in UI. "Why Johnny Can't Encrypt" is of course
required reading for anyone seeking to make improvements here.<br>
</blockquote>
<p>I read it yesterday, very very interesting. As it was focusing on
PGP 5 testing with End Users I thought it gave some great
insights. I personally used enigmail for a while and was always
jarred by the fact that I couldn't read my own emails without
regularly entering the pass phrase. It's been a few years and I
have forgotten the passphrase (I never stored it into the Password
Manager) so I am waiting for my certificates to expire so I can
make a fresh start.</p>
<p>I think notwithstanding the difficulty of set-up, once it is
configured there should be a "completely transparent" mode, that
allows reading all stored Emails (no matter whether encrypted or
not) and also should work with HTML formatted Email - most of all,
after storing in the local database there should be an option to "<b><i>permanently
decrypt</i></b>" an Email - which means I can treat it like a
normal email without need for decryption every time; it could be
optionally unlocked via the master password, but again I do not
use one in Thunderbird (I do in Waterfox) because I trust my
machine (desktop security) & firewalls and do not want a
barrier preventing me from being productive.<br>
</p>
<p> I bet the majority of users would like encryption to work
similar to this. I think in enigmail a lot of ground was already
covered (such as automatically encrypting based on recipient) but
UI needs to be stream lined to make it less obtrusive and more
clear. Complexities like signature choices / key revocation should
be hidden as much as possible in the initial stage in order to not
scare away interested users who want to learn about mail
encryption.</p>
<p>I think it would be good if pEp could be discussed more publicly
and maybe mentioned more often in blog post / community
management. What's the status on a try-out extension? Is it still
going to be <a moz-do-not-send="true"
href="https://mail.mozilla.org/pipermail/tb-planning/2016-February/004508.html">rolled
into Enigmail</a>?<br>
</p>
<p>Axel<br>
</p>
</body>
</html>