[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140818062244.GA4602@kludge.henri.nerv.fi>
Date: Mon, 18 Aug 2014 09:22:44 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Subject: Enigmail warning
Please read: http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/
Quote from thread below:
Enigmail 1.7 is completely broken for my purposes.
Steps to reproduce the problem:
1) Write an email in TB.
2) Ensure "Force encryption" in Enigmail.
3) Ensure "Force signing" in Enigmail.
4) Recheck encryption and signing settings... OK.
5) Send the email.
6) Look at the received email. OOPS. It is NOT signed and NOT encrypted.
Sorry to say this so directly, but an encryption system, which CONFIRMS
to the user in it's graphical user interface on two different places
that it will encrypt AND THEN SENDS THE EMAIL WITHOUT ANY ENCRYPTION IN
PLAIN TEXT ... is just the BIGGEST IMAGINABLE CATASTROPHE.
Sorry for my profane language but there is simply no excuse for such
bullshit.
I am currently preparing a crypto class for journalists next week to
teach them how to use safe email.
HOW am I going to explain that? A system tells the user in a separate
window as well as in a menu line that everything will be encrypted but
then it simply FORGOT to ENCRYPT and, ooops, their report will be
intercepted and their source will be tortured ?
Ok...let's see....maybe there is some magic incompatibility with the TB
or OS version or the specific configuration I used or whatever... As a
computer scientist I can imagine many bug-explanations.
Good that I am just a computer scientist. As a serious user (dissident,
whistle-blower, diplomatic or military user) I would now be waiting for
the bad guys come and get me with their water-board.
Still as a computer scientist I need an answer to which system I will
teach in my class next week. Command-line PGP ?!?
Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
