<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 30/08/2020 11:24 am, Wayne Mery
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2f969d8b-9402-9ac5-ff3e-cc153e7bbd69@lehigh.edu">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<p>Thunderbird 78.2.1 and 81.0b2 are both live.</p>
<ul>
<li>78.2.1 enables OpenPGP by default <a
class="moz-txt-link-freetext"
href="https://www.thunderbird.net/en-US/thunderbird/78.2.1/releasenotes/"
moz-do-not-send="true">https://www.thunderbird.net/en-US/thunderbird/78.2.1/releasenotes/</a></li>
</ul>
</blockquote>
<br>
Bravo Wayne! Congratulations. I love it.<br>
<br>
<blockquote type="cite"
cite="mid:2f969d8b-9402-9ac5-ff3e-cc153e7bbd69@lehigh.edu">
<ul>
<li>81.0b2 ditto, plus a few fixes <a
class="moz-txt-link-freetext"
href="https://www.thunderbird.net/en-US/thunderbird/81.0beta/releasenotes/"
moz-do-not-send="true">https://www.thunderbird.net/en-US/thunderbird/81.0beta/releasenotes/</a><br>
</li>
</ul>
<p>OpenPGP enabled by default is a new milestone in the evolution
of version 78.� The UI is now visible for end-to-end (message)
encryption, aka e2ee, in account settings.� <br>
</p>
<ul>
<li>Introduction <a class="moz-txt-link-freetext"
href="https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption"
moz-do-not-send="true">https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption</a></li>
</ul>
</blockquote>
<br>
I'm really a lurker here but I feel encouraged by this announcement
to say something.<br>
<br>
In general the concept of e2ee is good. HOWEVER it solves a
non-existent problem. Email has been insecure from day 1 and
everyone knows this and uses other mechanisms for keeping real
secrets. As your article carefully points out it is potentially
dangerous to make mistakes and as it also points out and indeed
demonstrates, understanding e2ee for email is costly in terms of
brain-space and therefore new users will avoid it.<br>
<br>
The REAL problem is phishing. The magic preventer is signed email. <br>
<br>
No matter how carefully an attacker trawls the web for evidence with
which to impersonate a trusted correspondent they cannot sign mail
from that trusted person. Their poisoned email will be immediately
revealed as a phishing attempt provided those correspondents usually
sign their mail to each other.<br>
<br>
This reality reveals an immediate opportunity for Thunderbird.<br>
<br>
If I was calling the shots I would focus on email signing and forget
e2ee. Encrypted email will always have a tiny market dominated by
paranoid IT departments who probably don't know Thunderbird exists.<br>
<br>
Signed email has a potentially huge market purely because it is a
defence against one of the most serious problems email faces today
and in the foreseeable future.<br>
<br>
You probably can't make signed email "on" by default but you could
make it really easy to understand for non-technical people. And you
could strongly recommend it. You can't strongly recommend e2ee
because it is simply unnecessary for the vast majority.<br>
<br>
Finally, the best strategy for achieving widespread e2ee, if that is
in fact desirable, is to introduce email signing first. That will
lower the psychological and intellectual barriers somewhat.<br>
<br>
Have a look at my sig below.<br>
<br>
Cheers <br>
<br>
Mike<br>
<br>
<pre class="moz-signature" cols="72">--
Signed email is an absolute defence against phishing. This email has
been signed with my private key. If you import my public key you can
automatically decrypt my signature and be sure it came from me. Just
ask and I'll send it to you. Your email software can handle signing.
</pre>
<blockquote type="cite"
cite="mid:2f969d8b-9402-9ac5-ff3e-cc153e7bbd69@lehigh.edu">
<ul>
<li>Ask questions at <a class="moz-txt-link-freetext"
href="https://thunderbird.topicbox.com/groups/e2ee">https://thunderbird.topicbox.com/groups/e2ee</a></li>
<li>File bug reports at
<a class="moz-txt-link-freetext"
href="https://bugzilla.mozilla.org/enter_bug.cgi?product=Mailnews%20Core&component=Security:%20OpenPGP">https://bugzilla.mozilla.org/enter_bug.cgi?product=Mailnews%20Core&component=Security:%20OpenPGP</a></li>
</ul>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
tb-planning mailing list
<a class="moz-txt-link-abbreviated" href="mailto:tb-planning@mozilla.org">tb-planning@mozilla.org</a>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/tb-planning">https://mail.mozilla.org/listinfo/tb-planning</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72"> </pre>
</body>
</html>