User: Password:
|
|
Subscribe / Log in / New account

Enigmail vs Thunderbird vs line-wrapping

Please consider subscribing to LWN

Subscriptions are the lifeblood of LWN.net. If you appreciate this content and would like to see more of it, your subscription will help to ensure that LWN continues to thrive. Please visit this page to join up and keep LWN on the net.

By Nathan Willis
February 12, 2014

There are plenty of security buffs who lament that it may be too late for PGP encryption to ever become common practice for email among the general public, but many of them continue to believe that PGP signatures on email still have a fighting chance. After all, the signature adds its value without making the message unreadable to those recipients who lack the proper software support. Yet "proper software support" is a tricky level to achieve, as users of Mozilla Thunderbird have known for a while. A longstanding problem in the way Thunderbird interacts with the PGP add-on Enigmail triggers false signature-mismatch warnings in certain situations (not all of which are under the user's control), illustrating yet again how difficult implementing security in the email realm can be.

In a recent blog entry about encouraging GnuPG usage among Debian Developers, Jo Shields wrote about the problem, telling readers to avoid Enigmail entirely:

Almost every single BADSIG in my inbox is due to Enigmail. Thunderbird will insert spurious line wraps and escape characters into your mail after signing, resulting in invalid signatures.

Such a claim might sound shocking, considering that Enigmail is one of the most popular Thunderbird add-ons and Thunderbird one of the most popular desktop email applications. Surely, if there was such a major bug, it would have gotten fixed quickly. But many others have pointed out the same problem over the course of several years—at least since 2007, and as recently as last year.

Essentially, the trouble happens when Enigmail attaches an inline PGP signature to an email in Thunderbird's HTML message composer. The HTML composer is a different component than the plain-text composer, and it performs some "clean up" on the message body after the user hits send. That is an obvious recipe for trouble, since it occurs after the signature was computed over the message. Any alterations, including those that are invisible to the user (such as white-space changes or replacing special characters with HTML character codes) will alter the hash value of the message, which is the element of the signature that is encrypted by the sender's private key.

In this case, the alteration that happens to the message body is automatic line-wrapping. Thunderbird's line-wrapping for HTML messages breaks lines that exceed 79 characters (or whatever the value of the mailnews.wraplength preference is set to), so not every message is affected. In an attempt to avert this trouble, Enigmail performs its own line-wrapping on the message body just before generating the signature, at mailnews.wraplength - 2.

Nevertheless, there are invariably some situations when a single "word" is longer than 77 characters; the simplest example is a lengthy URL. In these situations, the automatic line-wrapping Thunderbird performs after Enigmail has processed the message splits the long line at the mailnews.wraplength point when it is sent, therefore the signature no longer validates when the email recipient's PGP client checks it. Changing Thunderbird's line-wrapping behavior is not simple either; it requires changing several preferences. As Enigmail lead developer Patrick Brunschwig said in a 2009 comment thread (comment #10), "The problem behind it is that Mozilla is too clever -- it re-wraps the message after Enigmail has signed it, even though Enigmail already applied line wrapping with the same methods as HTML." Since Thunderbird provides a constrained API for extensions, there is nothing Enigmail can do. Thus, he continued, "the only solutions I have are: either use PGP/MIME or write plaintext messages."

Unfortunately, while support for inline PGP signatures is fairly widespread, support for PGP/MIME (which in essence makes the signature a message attachment) is less common—particularly with proprietary email clients. In addition, Thunderbird's default behavior is to compose replies in the same format as the original email; one can force it to reply to an HTML email with plain text by holding down the "Shift" key when punching the "Reply" button or by altering each account's composition settings, but both options seem like an unnecessary hassle. After all, as quite a few bug reporters have noted in the various bug reports about this topic, it is at the very least odd that Thunderbird auto-line-wraps HTML messages but does not do the same to plain-text messages. It would seem like HTML content could be sent as-is, leaving the receiver's email client to render the message in however many columns are available.

Plain-text emails are not problem-free either, however. Thunderbird's default is to send plain text in the format=flowed (RFC 2646) format, which can lose leading spaces; Enigmail tries to compensate for this by transforming leading spaces to "~". Moreover, Enigmail also dash-escapes plain text (as required by the OpenPGP specification), which regularly causes problems for people emailing software patches with signatures.

One way to look at the whole mess is that the root of the problem is the existence of two ways to include a PGP signature in a message (inline and through PGP/MIME), two code paths to compose email in Thunderbird (plain text and HTML), three programs that process the message between the user hitting "send" and the email leaving the machine (GnuPG, Enigmail, and Thunderbird), and multiple preferences that affect line-wrapping. There is certainly no shortage of opportunities for finger-pointing, but considering all of the variables involved, an equally defensible conclusion is that digital email signatures—despite their relatively small size on screen—ultimately cannot be simplified down to point-and-click ease.


(Log in to post comments)

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 3:25 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

*shrug* Could just remove HTML email drafting support. Seems like a reasonable compromise to me ;) .

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 8:42 UTC (Thu) by dd9jn (subscriber, #4459) [Link]

That is not just a compromise but a safer solution than everything else. Even with PGP/MIME HTML mail is a severe problem. There is no reason for HTML in mail - if you want a nice looking text, write a blog post and mail the URL. All mail clients are able to understand and render de-facto standard mail markup (*_/) and also detect URLs. The advantage of plain text mail is that you can easily grep and otherwise process it. With HTML mail this requires lots of complicated software and not just our nice Unix toolbox (yeah, QP and base64 makes it somewhat harder but it is still more simple than HTML). text/html alternatives are anyway to be ruled out because this sends two texts which might differ.

Enigmail should make sure never to send out HTML unless it is a real attachment.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 11:41 UTC (Thu) by Seegras (guest, #20463) [Link]

There is obviously an easy solution for most of the problems. Throw out HTML support for sending mails (just convert incoming ones to plain text).

Also solves a load of other problems such as web-bugs, makes some scams obvious and so on.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 17:26 UTC (Thu) by drag (subscriber, #31333) [Link]

This horse has left the barn a decade or so ago.

If I had to depend on some sort of html to text conversion or going text-only then that would mean that email would be largely useless for me as the vast majority of people I communicate with default to html formatting. Such is life.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 17:41 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

Actually, the vast majority are multipart/alternative so there is a text/plain available. IMO, mass mailings are the ones which are usually missing the text/plain part, but they're also usually be used usefully (e.g., mutt's HTML→ text converter and urlview). The insidious ones are those which are now using onclick= JS handlers instead of href=.

Also, I originally said that HTML *drafting* should be removed, not *support*. I personally use mutt, but I also still have bindings to default to w3m -dump if an email is mangled badly enough.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 20:55 UTC (Thu) by drag (subscriber, #31333) [Link]

I use mutt and I deal with a lot of html mail, so yeah I know multipart exists. (I shunt html email off to a browser so I can actually view the emails as intended)

The problem is that people often use html for a reason. Often they are trying to share graphs or screen shots, and quite often the colors and fonts they use for html have real meaning.

> Also, I originally said that HTML *drafting* should be removed, not *support*.

Having the inability to draft emails kinda defeats the purpose, doesn't?

If you force people to choose between being able to make professional looking emails, pretty fonts, or be able to share pictures of their kids (with descriptions inline) and crypto then that pretty much will destroy any chance that any significant number of people will use signing.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 22:21 UTC (Thu) by dd9jn (subscriber, #4459) [Link]

MIME is older than HTML and allows to use inline attachments. I remember that I used exmh about 20 years ago which rendered inline image nicely. But well, I better stop complaining about the state of mail use and be thankful that HTML mails allow for an easy spam filter.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 23:40 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

I just use plain text view most of the time. For attachments and such, I use 'v' (not sure if it's the default) in the message list to view attachments, then 'm' to use mailmap to display them. I guess the emails I usually deal with don't have much meaningful markup, so that's not an issue for me.

As for the drafting thing, it was half tongue-in-cheek, but I'd view it as a small victory :) .

bullshit!

Posted Feb 13, 2014 15:12 UTC (Thu) by HelloWorld (guest, #56129) [Link]

> There is no reason for HTML in mail - if you want a nice looking text, write a blog post and mail the URL.
It's none of your business what kind of email people want to send to each other. Having signatures only work for text emails is simply bad engineering.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 4:16 UTC (Thu) by salimma (subscriber, #34460) [Link]

What a timely post, this just happened to me a couple of days ago - ironically, no HTML was involved at all, I was following up on a Bugzilla email with a developer using email.

I must have triggered the HTML composer somehow, didn't think much about it and sent the mail off. Kaboom.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 4:20 UTC (Thu) by idupree (guest, #71169) [Link]

Since I only send plaintext email and do not need Outlook Express users to be able to read my PGP-signed mail, I am happy with PGP/MIME and the following Thunderbird configuration: http://www.idupree.com/2013/enigmail-and-format-flowed

The situation could certainly be a lot better.

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 8:51 UTC (Thu) by jezuch (subscriber, #52988) [Link]

> The HTML composer is a different component than the plain-text composer, and it performs some "clean up" on the message body after the user hits send.

This is insane. Instead of applying more and more cleverness the only sane solution is to make the cleanup be performed before signing. All the other "problems" mentioned in the article are completely irrelevant. *boggle*

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 13, 2014 17:06 UTC (Thu) by Koromix (guest, #71455) [Link]

Agreed, I'm having trouble understanding the problem. Either Thunderbird's plugin API provides a way to intercept/transform the message after cleaning or it doesn't and Enigmail developers should post a bug report about it.
Or maybe they did?

PGP/MIME

Posted Feb 13, 2014 11:24 UTC (Thu) by cesarb (subscriber, #6266) [Link]

When I last tried PGP/MIME (over a decade ago), messages sent with it appeared as a blank message in Outlook.

PGP/MIME

Posted Feb 13, 2014 11:49 UTC (Thu) by nowster (subscriber, #67) [Link]

You write as if this is a problem. ;-)

PGP/MIME

Posted Feb 13, 2014 14:00 UTC (Thu) by cesarb (subscriber, #6266) [Link]

When you are one of the few Linux users and most of your coworkers are using Outlook... Yeah, it was a problem.

(That was back when the latest version of MSIE was 6, and you had to develop for it, MSIE 5, and MSIE 5.5 which somehow was worse than the other two. Back when your site worked only with MSIE because it needed a Windows Media Player ActiveX control, but you still made as much of it as was possible work on Gecko, just so you could get decent JavaScript error messages. These were dark days.)

PGP/MIME

Posted Feb 13, 2014 12:56 UTC (Thu) by niner (subscriber, #26151) [Link]

I've sent email PHP/MIME signed for about a decade now. Apart from some users wondering about the unknown attachment, I've never had a problem.

PHP/MIME

Posted Feb 13, 2014 13:40 UTC (Thu) by mbunkus (subscriber, #87248) [Link]

Thank you for unintentionally making me laugh on an otherwise dreary day. I wonder if security with PHP/MIME is even worse than with other PHP stuff ;)

PHP/MIME

Posted Feb 13, 2014 13:49 UTC (Thu) by niner (subscriber, #26151) [Link]

Oh my what a typo *g*
I guess even a real PHP/MIME wouldn't make that much difference to PGP/MIME since AFAIK only one or maybe two people ever verified my signatures anyway.

PGP/MIME

Posted Feb 13, 2014 14:07 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

Personally, I've actually had more questions about inline signatures (IIRC, the blocks are also huge compared to others I've seen; not sure what part of my 4096 bit RSA key causes that though…I'd think 4096 bits is common enough; I also sign using SHA512). And tends to get quoted because trimming is apparently a freaking anethma to most people.

PGP/MIME

Posted Feb 13, 2014 17:28 UTC (Thu) by drag (subscriber, #31333) [Link]

Quoting is easy when you top post. You don't even have to read the email you are replying to!

Email gripes

Posted Feb 13, 2014 17:50 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

Well, when their complaint is "what's all that junk?" and they never remove it long after it's known what "junk" is referring to, *that's* when it's most annoying.

Also, splay threads are ridiculous, but I blame GMail for perpetuating that madness.

Splay threads

Posted Feb 20, 2014 15:22 UTC (Thu) by Max.Hyre (guest, #1054) [Link]

OK, I’ll bite. Wikipedia has nothing on “splay threads”, and Duckduckgo & Bing only reference your post... What’s a splay thread?

Splay threads

Posted Feb 20, 2014 17:00 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

It's what I call threads where people reply to the most recent message instead of the one that makes sense (e.g., in a "who can make $event?" email, replying to the original is probably best). Coupled with never trimming replies and HTML, it makes individual messages huge.

Is there another term for it?

Splay threads

Posted Feb 23, 2014 20:10 UTC (Sun) by dlang (subscriber, #313) [Link]

the type of thing caused by the gmail interface (also very common on web forums) where there is a 'reply' window at the bottom of the page that replies to the most recent message (frequently quoting the entire thread, but hidden to the person creating the message), and people use this reply window to reply to anything in the thread.

Splay threads

Posted Feb 23, 2014 20:35 UTC (Sun) by mathstuf (subscriber, #69389) [Link]

Yep. (Not sure if you're asking for clarification or restating what I said in clearer terms.)

PGP/MIME

Posted Feb 13, 2014 13:09 UTC (Thu) by dodocaptain (guest, #44818) [Link]

That used to happen a lot with the now (thankfully!) deprecated Outlook Express mail client - it would show a blank email and then two attachments, the signature and the email as a text file.

Caused me large amounts of grief when trying to do online auction purchases with home windows users who couldn't read my mail :-(

Enigmail vs Thunderbird vs line-wrapping

Posted Feb 14, 2014 19:27 UTC (Fri) by Fats (subscriber, #14882) [Link]

"an equally defensible conclusion is that digital email signatures—despite their relatively small size on screen—ultimately cannot be simplified down to point-and-click ease"

I don't agree, I don't see any reason why a good programmed email client can make this point-and-click easy. It just seems Thunderbird is not able implement it well.


Copyright © 2014, Eklektix, Inc.
This article may be redistributed under the terms of the Creative Commons CC BY-SA 4.0 license
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds