4 ms·

The comments here are overwhelmingly negative so far, so I'll say something positive: even if this comes rather late for Thunderbird, I appreciate that Mozilla

The comments here are overwhelmingly negative so far, so I'll say something positive: even if this comes rather late for Thunderbird, I appreciate that Mozilla chose to add this functionality. Any feature that makes PGP easier to use for the average person (especially better integration into a platform) is a win my book.

Jonnax 7y ago
There's a lot of negativity around Mozilla in general. Like take their rewrite of their android browser. It's faster than Chrome and is currently in preview. Add-on support is work in progress but they got plenty of snarky attacks that it's not in MVP. The whole DNS over HTTPS attacks seemed focussed on Firefox, a browser with a tiny marketshare compared to Chrome who also implements it.
- dessant 7y ago
  Firefox does seem to attract that demographic, or it could be just a symptom of open source entitlement. I've received some of the rudest personal attacks via extension reviews on Firefox Add-ons. Take a look: https://addons.mozilla.org/en-US/firefox/addon/search_by_image/reviews/1424324/ https://addons.mozilla.org/en-US/firefox/addon/search_by_ima...
  - Jonnax 7y ago
    Wow. That user saying that you should be satisfied with just the ratings is crazy.
- kbenson 7y ago
  It definitely feels like there's a double standard at play sometimes. It's pretty routine for people here to announce after any mistake Mozilla makes that it's the last straw and they're done with it, and going back to Chrome. That just boggles my mind.
skrowl 7y ago
Does it fix PGP not having forward secrecy?
- exabrial 7y ago
  In my mind, the biggest value for PGP is _proving_ your identity, not encrypting communications (unless said properties of PGP are desirable). That being said, I wish PGP had at least a casual PFS Extension. I've imagined ideas like an ephemeral key server that can deletes keys after awhile (you could run your own), and/or including futures keys to use in replies in the signature block.
  - dngray 7y ago
    That article states why PFS for email isn't really all that useful: > As far as I know, Brown et al.'s proposal is not often used. One reason for this is that forward secrecy is not always desired. For instance, if you encrypt a backup using GnuPG, then your intent is to be able to decrypt it in the future. If you use forward secrecy, then, by definition, that is not possible; you've thrown away the old decryption key. They are two different tools for two different jobs.
- dngray 7y ago
  > Does it fix PGP not having forward secrecy? The thing is about forward secrecy it's only really useful in situations where the communication is real time. Email is not. https://arstechnica.com/information-technology/2016/12/signal-does-not-replace-pgp/ https://arstechnica.com/information-technology/2016/12/signa... If you're concerned about that storing it on a hardware key (like a Yubikey) is the way to go.

Jonnax 7y ago

There's a lot of negativity around Mozilla in general. Like take their rewrite of their android browser. It's faster than Chrome and is currently in preview. Add-on support is work in progress but they got plenty of snarky attacks that it's not in MVP. The whole DNS over HTTPS attacks seemed focussed on Firefox, a browser with a tiny marketshare compared to Chrome who also implements it.

dessant 7y ago
Firefox does seem to attract that demographic, or it could be just a symptom of open source entitlement. I've received some of the rudest personal attacks via extension reviews on Firefox Add-ons. Take a look: https://addons.mozilla.org/en-US/firefox/addon/search_by_image/reviews/1424324/ https://addons.mozilla.org/en-US/firefox/addon/search_by_ima...
- Jonnax 7y ago
  Wow. That user saying that you should be satisfied with just the ratings is crazy.
kbenson 7y ago
It definitely feels like there's a double standard at play sometimes. It's pretty routine for people here to announce after any mistake Mozilla makes that it's the last straw and they're done with it, and going back to Chrome. That just boggles my mind.

skrowl 7y ago

Does it fix PGP not having forward secrecy?

exabrial 7y ago
In my mind, the biggest value for PGP is _proving_ your identity, not encrypting communications (unless said properties of PGP are desirable). That being said, I wish PGP had at least a casual PFS Extension. I've imagined ideas like an ephemeral key server that can deletes keys after awhile (you could run your own), and/or including futures keys to use in replies in the signature block.
- dngray 7y ago
  That article states why PFS for email isn't really all that useful: > As far as I know, Brown et al.'s proposal is not often used. One reason for this is that forward secrecy is not always desired. For instance, if you encrypt a backup using GnuPG, then your intent is to be able to decrypt it in the future. If you use forward secrecy, then, by definition, that is not possible; you've thrown away the old decryption key. They are two different tools for two different jobs.
dngray 7y ago
> Does it fix PGP not having forward secrecy? The thing is about forward secrecy it's only really useful in situations where the communication is real time. Email is not. https://arstechnica.com/information-technology/2016/12/signal-does-not-replace-pgp/ https://arstechnica.com/information-technology/2016/12/signa... If you're concerned about that storing it on a hardware key (like a Yubikey) is the way to go.