Diff for "EMailClients/Thunderbird"

Differences between revisions 3 and 18 (spanning 15 versions)

https://www.thunderbird.net/

Thunderbird (since version 78 first released 2020-07) implements its own OpenPGP/MIME support, using the libraries RNP (https://github.com/rnpgp/rnp) and Botan.

The main advantage for Thunderbird users is that they do not have to install an additional application like Gpg4win on Windows. The main drawback is that Thunderbird has its own handling of key material which is separated from the rest of the operating system and other applications that are using GnuPG for example. Some abilities that GnuPG provides are missing, e.g. handling of hardware tokens like smardcards or usb devices.

Thunderbird can still be configured to use a system's GnuPG installation for private key operations see https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards .

The Thunderbird people have an FAQ about the new OpenPGP support.

History

Until version 68 (last release 2020-10), Thunderbird did not have OpenPGP/MIME functionality included. The external extension Enigmail provided it, which used GnuPG. A necessary and large change in how browser extensions can be implemented made Enigmail's technical implementation unfit for newer versions. See the explanation of Enigmail's maintainer. Enigmail's support for this version stopped 2021-10-01.

It is unknown in public what the main reasons for doing a new implementation instead of using GnuPG (and Gpg4win) were. One Mozilla developer wrote about licensing concerns, but other people have pointed out that GPGME is GNU LGPL and the GNU GPL of GnuPG itself allows for a combined distribution of Thunderbird and GnuPG.

Previously in 1999 and 2005, Mozilla rejected to include (already implemented) OpenPGP/MIME functionality because they were preferring S/MIME according to Werner Koch.

Hints

Experimental Subject Encryption

Thunderbird implements an experimental (non-standard) way that encrypts the normally unencrypted subject header line of an email, in a non-backward compatible way. This feature is active by default in Thunderbird.

Thunderbird replaces the subject of encrypted emails with three dots to protect users from accidentally disclosing sensitive information. So many other email clients will just see three dots like ... as the subject, where the sender added real information. Viewing emails with encrypted subjects in Thunderbird and other compatible email clients shows the original subject. Besides the loss of information, this feature may also break message filtering and searching on the server.

Disabling subject encryption

Thunderbird users may disable the feature by unchecking the option in the settings:

Account settings
Search the wanted account in the left pane
End-To-End-Encryption
Scroll to section Advanced settings
Uncheck Encrypt the subject of OpenPGP messages

It is also possible to use the Config Editor. This way is only recommended for advanced users, the risk of breaking anything is high!

Search for the following entries and changing them from true to false:

mail.identity.default.protectSubject
mail.identity.id1.protectSubject
and if you have multiple identities configured, repeat the last step for id2, id3, etc.

Background

In general: The subject of an email is information for its transport. And transport information in a decentral network - just like the writing on the outside of a postal mail envelope - cannot be protected in principle. When reflecting on this, if you need the confidentiality chose a subject that is plausible in context, but without sensitive contents, to best veil potential unwanted observers. (Your thinking is right: The more sensitive this is, the more you have to build up a plausible context for your unavoidable traces first.)

Details

For the reasoning why Thunderbird's implementation is suboptional, see January to March 2021 on gnupg-user, e.g.

Instructions

How to enable encryption

Result after completing this instruction

1. Click on the account name and then on "End-to-end Encryption"

2. Click on the button "Add Key..." on the right side of the window.

3. A window will be opened, where you can choose, if you want to import a key or to create a new key pair. In this instruction we explain how to import an existing key. For that click on the option "Import an existing OpenPGP Key" and on the button "Continue".

4. In the next window click on the button "Select File to Import...".

5. A window with the file manager appears. Here you have to navigate to the folder, where your key is in. Then select it and click on "Open".

6. Confirm with a click on "Continue".

7. Enter the password for the key and click on "Sign in".

8. Confirm with a click on "Continue".

9. Now you have to select the imported key by clicking on it.

How to use WKD

1. Open the window to compose an email

2. Enter an email address and click on "security".

3. Select the address, whose key is missing and click on "Manage keys for selected recipient..."

4. Click on "Discover new or updated key"

5. Choose, if you want to accept the key and click on "OK".

6. Now you can go back to the window with the addresses (see screenshot in step 3) to receive other addresses or go back to the compose window to write and send your email.

-  ⇤ ← Revision 3 as of 2021-12-02 09:33:55 → 
  Size: 3784
  Editor: bernhard
  Comment: + link to Enigmail support stop and correct date
+   ← Revision 18 as of 2023-09-13 19:40:42 → ⇥
  Size: 6832
  Editor: SebastianWagner
  Comment: [Switch off replacing the subject with three dots]: Update to current status (remove outdated information on obsolete TB versions), rewrite for clarity, display screenshot inline
-Deletions are marked like this.
+Additions are marked like this.
 Line 10:
-rest of the operating system and other applications that are using GnuPG.
They have an [[https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq|FAQ]].
Some abilities that GnuPG provides are missing, e.g. handling of hardware tokens
like smardcards or usb devices.
+rest of the operating system and other applications that are using GnuPG for example. Some abilities that GnuPG provides are missing, e.g. handling of 
hardware tokens like smardcards or usb devices.
-Line 15:
+Line 13:
-Thunderbird can still enable to use the system's GnuPG installation
+Thunderbird can still be configured to use a system's GnuPG installation
-Line 19:
+Line 17:
+The Thunderbird people have an [[https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq|FAQ about the new OpenPGP support]].
 Line 20:
-Until version 68 (last release 2020-10), Thunderbird did not have a Open~PGP/MIM~E functionality included,
but someone could use Enigmail which used GnuPG. A necessary and large change in how
+Until version 68 (last release 2020-10), Thunderbird did not have Open~PGP/MIM~E functionality included.
The external extension Enigmail provided it, which used GnuPG. A necessary and large change in how
 Line 28:
-[[https://mail.mozilla.org/pipermail/tb-planning/2019-December/007287.html|raised licensing issues]],
+[[https://mail.mozilla.org/pipermail/tb-planning/2019-December/007287.html|wrote about licensing concerns]],
 Line 37:
-=== Switch off the dots in subjects (incompatible subject header encryption)
+=== Experimental Subject Encryption
 Line 39:
-Unfortunately Thunderbird implemented an experimental way to try to protect the subject
header line of an email which is not backwards compatible but enabled by default.
+Thunderbird implements an experimental (non-standard) way that encrypts the
normally unencrypted subject header line of an email, in a non-backward compatible way.
This feature is active by default in Thunderbird.
-Line 42:
+Line 43:
-So many other email clients with just see three dots like {{{...}}} in the subject,
where the sender added information.
+Thunderbird replaces the subject of encrypted emails with three dots to protect users from accidentally
disclosing sensitive information.
So many other email clients will just see three dots like {{{...}}} as the subject,
where the sender added real information.
Viewing emails with encrypted subjects in Thunderbird and other compatible email clients shows the original subject.
Besides the loss of information, this feature may also break message filtering and searching on the server.
-Line 45:
+Line 50:
-We recommend to switch it off. This can be done with a hidden option since
Thunderbird 78.5.1, see https://support.mozilla.org/en-US/questions/1304451#answer-1375985 .
+==== Disabling subject encryption
-Line 48:
+Line 52:
-Transport information in a decentral network - just like the writing on the outside of
a postal mail envelope - cannot we protected in principle. When reflecting on this, chose
+Thunderbird users may disable the feature by unchecking the option in the settings:
* //Account settings//
* Search the wanted account in the left pane
* //End-To-End-Encryption//
* Scroll to section //Advanced settings//
* Uncheck //Encrypt the subject of OpenPGP messages//

{{subject_encryption_thunderbird.png}}

It is also possible to use the
[[https://support.mozilla.org/en-US/kb/config-editor|Config Editor]].
This way is only recommended for advanced users, the risk of breaking anything is high!

Search for the following entries and changing them from //true// to //false//:
* {{{mail.identity.default.protectSubject}}}
* {{{mail.identity.id1.protectSubject}}}
* and if you have multiple identities configured, repeat the last step for {{{id2}}}, {{{id3}}}, etc.

==== Background
In general: The subject of an email is information for its transport. 
And transport information in a decentral network - just like the writing on the outside of
a postal mail envelope - cannot be protected in principle. When reflecting on this, if you need
the confidentiality chose
-Line 55:
+Line 80:
-Line 57:
+Line 81:
-For version 91 (checked 2021-12-02) the FAQ still states that the encryption cannot be disabled
in the GUI: 
https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq#w_can-i-disable-the-encryption-of-the-email-subject
-Line 66:
+Line 86:
+== Instructions
===How to enable encryption
====Result after completing this instruction
{{thunderbird_enable_encryption_result.png}}
====1. Click on the account name and then on "End-to-end Encryption"
{{thunderbird_enable_encryption_1.png}}
====2. Click on the button "Add Key..." on the right side of the window.
{{thunderbird_enable_encryption_2.png}}
====3. A window will be opened, where you can choose, if you want to import a key or to create a new key pair. In this instruction we explain how to import an existing key. For that click on the option "Import an existing OpenPGP Key" and on the button "Continue".
{{thunderbird_enable_encryption_3.png}}
====4. In the next window click on the button "Select File to Import...".
{{thunderbird_enable_encryption_4.png}}
====5. A window with the file manager appears. Here you have to navigate to the folder, where your key is in. Then select it and click on "Open".
{{thunderbird_enable_encryption_5.png}}
====6. Confirm with a click on "Continue".
{{thunderbird_enable_encryption_6.png}}
====7. Enter the password for the key and click on "Sign in".
{{thunderbird_enable_encryption_7.png}}
====8. Confirm with a click on "Continue".
{{thunderbird_enable_encryption_8.png}}
====9. Now you have to select the imported key by clicking on it.
{{thunderbird_enable_encryption_9.png}}

===How to use WKD
====1. Open the window to compose an email
====2. Enter an email address and click on "security".
{{thunderbird_open_message_security.png}}
====3. Select the address, whose key is missing and click on "Manage keys for selected recipient..."
{{thunderbird_select_address_to_manage_keys.png}}
====4. Click on "Discover new or updated key"
{{thunderbird_discover_key.png}}
====5. Choose, if you want to accept the key and click on "OK".
{{thunderbird_import_received_key.png}}
====6. Now you can go back to the window with the addresses (see screenshot in step 3) to receive other addresses or go back to the compose window to write and send your email.