12 ms·
Thunderbird 78.x is great but has issues for advanced PGP users
- forgotmypw17 6y agoSummary: Mozilla used a library called RNP instead of integrating GPG. RNP does not support many GPG features, such as smartcards. Enigmail, the old method of using GnuPG with Thunderbird, is broken in 78.x. Author recommends downgrading to 68.x and using Enigmail for advanced users.
- qzw 6y agoRight, but then Thunderbird regularly prompts you to update to 78.x, and I’ve almost clicked ok several times already. I assume there’s probably a setting one can toggle in the config editor to turn off the prompt, but there should really be an option in the UI.
- forgotmypw17 6y agoWhen this type of stuff starts happening, I take it as a sign that the software has reached "critical mass", is now in a runaway cycle of increasing abuse of its users, and migrate away as quickly as possible. Thunderbird, years ago for me. If a human acts abusive towards me, it is logical to end the relationship, even if it is years old. I am a tolerant person, so once or twice I may accept excuses and justifications, but after that, it's time to distance myself. I don't see why it should be any different from software. If I feel like I am dependent on it and "can't" move away, all the more reason to prioritize finding alternatives. It is irrelevant whether the causes are incompetence, malice, or "accidental", the result is all the same, and I cannot allow it.
- selestify 6y agoSounds like a pretty reasonable personal choice to me, I don’t know why you’re being downvoted without any explanatory comments.
- arsome 6y agoThere is still, somehow, nothing I've found that's better than Thunderbird for an open source desktop GUI email client. Little choice but to allow it for many users like myself. Worse still - even many of the proprietary ones now rely on 3rd party servers for "cloud" features, or are bloated and ugly electron apps.
- lmm 6y agoKMail is pretty great IME.
- pizza234 6y agoThere's not much in the email clients landscape; almost nothing in Linux, actually. I suppose that this is because nowadays almost all the users read email from web clients. For me TB just works (especially because I'm locked at the ESR version, 68), however, I've never been extremly happy of it.
- forgotmypw17 6y ago"I know I shouldn't stay with them, but they are a good person, and even if they beat me, I just don't know if there are any better options out there." No offense intended, that's what your comment sounds like. If you start looking, I bet you will find some options.
- theamk 6y agoI did start looking, and I didn’t find anything’ better. It seems most of the people who cared about local mail clients moved to either: - online services, which are way worse Re: auto-updates, they do not even ask. - mail clients with limited HTML support, which are not usable with many online stores I want to use. Which mail client are you using?
- pizza234 6y agoThere is a variety of desktop mail clients, but the vast majority (of cross platform _and_ open source) is small-ish unkown-ish programs. The plugin system is in my opionion important (like for browsers) functionality, so popularity of a client is a significant factor, in order to have plugins available. Evolution is possibly the only valid competitor, however, it's not cross-platform as Thunderbird.
- mappu 6y agoBackstory: GnuPG is a program, not a library, and attempts to use it as one involve parsing its stdout (e.g. using GPGME) Thunderbird renders untrusted HTML content and therefore is subject to a steady stream of CVEs and must stay absolutely up-to-date with Gecko Gecko scaled back XUL and extension support, and WebExtensions are not sufficient to allow an Enigmail extension to run an installed binary.
- im3w1l 6y agoWhich version of HTML is used for email? No javascript for instance right? Possible to make a reduced parser for which it is easier to verify correctness?
- freeone3000 6y agoThere is no standard HTML version for email, the same way there is no standard HTML version for a website. The contents can reasonably be anything.
- im3w1l 6y agoFollow up question: What parts of html do you need implement to render 99% of emails decently accurately?
- freeone3000 6y agoFor a very long time, the limit was Outlook on Windows, which used the Word 2003 parser. So, whatever was supported by Word 2003. But, more recently, mail campaigns have instead targeted Gmail, so "whatever Gmail renders" (this is not everything a browser renders, but is close). It's not feasible to implement a subset for this and do parallel CVE fixes.
- emilsedgh 6y agoUnfortunately Outlook has a pretty big market share in corporate world and if you're serious about your emails, you still have to support it. It's worse than IE6. And to help your sanity, use mjml.
- mretutum 6y agothis is hands down my biggest beef with most shiny new crypto libraries (and the push to reimplement all the things with them) -- almost never support for hardware key storage
- XorNot 6y agoTo be fair trying to get a decent hardware key is a lesson in "no longer sold" from any list I found when looking into it a year back for GPG. In fairness I also had the requirement of "is not USB" - but this is reasonable IMO (don't train your users to plug in USB key like things)
- freeone3000 6y agoYou can use a traditional smartcard to store your GPG keys. That should meet your requirements?
- Firehawke 6y agoYou can even use a Yubikey.
- Xophmeister 6y agoIt also doesn’t use GPG’s keychain. If you “upgrade” from Enigmail, it will try to import your keychain. Now you have two keychains :( Of course, if you’ve detached your primary key, the import will fail (in a very unclear way), so you have your GPG keychain and a half-baked duplicate of it in Thunderbird. Then the UI for encrypting and signing mail is hidden away in a menu somewhere, so I forget to turn it off when I don’t want it (some legacy systems don’t react well to the “weird” attachments). When I do want it, it magically knows my passphrase and encrypts/decrypts/signs automatically, whether it’s me at the helm or not. So much for security at rest. Honestly, I was really frustrated and disappointed by the upgrade. It’s not easy to roll it back, either, apparently. I haven’t risked it, but I sorely miss TB68 with Enigmail.
- woodson 6y agoBackup your profile before the update. Thunderbird 78 makes non-backward-compatible changes to it, so you cannot downgrade to TB68.
- brnt 6y agoThunderbord uses openpgp.js, far from half-baked. Among others, Proton uses it. I'm obviously not happy for users who can't use TB now, but this external GPG-client stuff has to die. It never was userfriendly, and is only safe because the target audience is so small nobody bother. Passing around secrets on stdout?
- krageon 6y agoA primarily JS implementation is absolutely not as mature as the agent you were probably using before. Broadly I think I agree with you, but it would have been just as easy for TB to respect what you already had set up if that existed and use whatever they feel is right if not.
- zaarn 6y agoBefore they used a half-baked C library that interfaces via Text-based RPC to GPG directly (which has already seen some CVEs). I'd take the gpg.js implementation over that any day.
- 4778468d 6y agoIf you’re reading this thread, please leave a comment to say if you do or do not use PGP with email. I suspect few do.... it’s very very hard for ordinary users to grasp.
- swaits 6y agoI sign every message I send. I like that I can reasonably prove exactly what I did or did not write. Can’t remember encrypting any other than the occasional test message. I gave up on Thunderbird with the release of 78. Previously Emigmail was just functional enough once I got its finicky settings all dialed in. Now I’ve gone all in on [MailMate](https://freron.com/ https://freron.com/) on macOS. Out of the box PGP support was only one of many pleasantries I found when I first tried this a few weeks ago. It’s dramatically changed my idea of how well a GUI MUA can actually work. Money well spent!
- dragonwriter 6y agoSigning let's you prove what you did write, it doesn't let you prove what you did not write, since all the signed emails in the world don't prove the nonexistence of unsigned emails from the same sender. Now, if you have a regular practice of signing emails, one without a valid signature that purports to be from you is pretty strong evidence that either you didn't send it or you anticipated the need for future repudiation, but it doesn't itself prove anything about which of those applies.
- tuwtuwtuwtuw 6y agoYou can't prove what you did not write.
- neilv 6y agoWhen I ended up casually using PGP for personal email, it was for encryption when emailing with some friends at other schools, expressly because not everyone at one site or the other was trusted not to snoop on other people's emails. Not that PGP alone would've been enough defense against a determined and knowledgeable systems person, but it did presumably offer some privacy (and also, just the principle of it). Then I fell out of the habit, so I'm curious in what kinds of scenarios you envision in which your habitual use of email signatures would help?
- gorgoiler 6y agoImagine HTTPS but where the site name and the URL of the resource were in plaintext and only the body was encrypted. That’s what PGP email feels like. It’s useful for closed circuits though, where you have a group of correspondents needing to prove their authenticity. One company I use will sign their invoices, for example. I’ve never verified the signatures. If you need to go to the technical effort of private group communication, running your own webmail service seems a lot easier and a lot more private. I love PGP for other infra. I love my smartcards. But I can’t remember the last time I’ve used it for email :)
- flo123456 6y agoMy biggest issue with the new Thunderbird is the encrypted subjects. These break email for everyone not using TB, as TB is the only software that is able to show the real subject. Everyone else just gets „...“.
- SkyMarshal 6y agoIs that optional, or automatically enabled with no way to disable?
- t0astbread 6y agoThe latter it seems: https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq#w_can-i-disable-the-encryption-of-the-email-subject https://support.mozilla.org/en-US/kb/openpgp-thunderbird-how...
- brnt 6y agoEncrypting subjects is both part of Autocrypt and there's a GPG plan floating around that features it. K9mail supports it (which is the only other client I use). Fairmail might too.
- n0nc3 6y agoAn axiom of cryptographic tool design: there are no advanced users. Designs that ignore the axiom will always create dangerous failure modes.
- t0astbread 6y agoA consequence of taking this axiom to the extreme is that you might not be able to support many diverse threat models though.
- deleted 6y ago[deleted]
- zaarn 6y agoWell then you develop seperate tools for separate threat models. Covering all possible threat models is impossible and supporting many of them is a heavy maintenance burden that can easily lead to the standard user having their threat model compromised due to the added complexity.
- t0astbread 6y agoFair point. You could have "locked down" tools for standard users and "I can install my PGP smartcard extension" tools for power users. I guess in this case it was unfortunate that Thunderbird happened to be used by both the standard and the power users.
- zaarn 6y agoCartering to power users isn't usually good for marketshare because it means you limit your market share to a small subset of the market. Making Thunderbird more accessible and making GPG more accessible, even if that means you can't support some niche use cases, is usually the better choice.
- t0astbread 6y ago
- deleted 6y ago[deleted]
- mkesper 6y agoThe real solution is to use gnupg as external program, it's hinted at in the FAQs and a walkthrough is here: https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards#Configure_an_email_account_to_use_an_external_GnuPG_key https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards#Conf... Dear Thunderbird developers, if someone uses gnupg assume they want to use gnupg and not some self-cooked, half-working solution.
- corty 6y agoThe "real" solution is broken and does not work at all, it just crashes or hangs thunderbird. Thunderbird is dead, has been dying for some time. Now that Mozilla is going bancrupt, users should rather look for alternatives and not waste time. Especially on a half-cooked encryption with obvious quality problems causing a possibly huge number of security problems.
- Despacito2019 6y agoIf you read the article the author mentions that it doesnt work at all,
- mkesper 6y agoIt works totally for me, sorry. Using a smartcard so Thunderbird doesn't give me another option right now.
- atsider 6y agoI'm using Debian's 78.5.0. It uses external gpg by default and works flawlessly for me with my hardware USB token.
- favadi 6y agoDoes that mean Debian developers patch Thunderbird to remove the new GPG implementation?
- iam-TJ 6y agoIf you need to prevent upgrade in Debian, Ubuntu, and other Debian package based distros add a version hold in apt's preferences by creating a 'pin' on the current version: /etc/apt/preferences.d/thunderbird68 Package: thunderbird Pin: version 1:68.* Pin-Priority: 1000
- Thoughtful 6y agoHow would you later remove the pin?
- inetknght 6y agoJust like climbing a tree, the best way down is usually the inverse of the way you got up. If you added a version pin by adding a file... then remove the version pin by removing the file.
- aborsy 6y agoEnigmail was working perfectly for me. I use it frequently and never had any issue. Now I have to keep track of a second key chain. And honestly I don’t trust an app that specializes in email and views security as an add on rather than a priority.