OpenPGP in Thunderbird [LWN.net]

OpenPGP in Thunderbird

Posted Sep 24, 2020 15:17 UTC (Thu) by tlamp (subscriber, #108540)
Parent article: OpenPGP in Thunderbird

The Thunderbird OpenPGP support has a few drawbacks, it forces one to maintain yet another keyring and doesn't allow the use of smart cards.

The first one is a nuisance, the second one makes it unusable for me personally.
I work with a few devices and want a safe way to use the same GPG key on all, a smart card is the only reasonable solution for that.

It is a lousy replacement for Enigmail.

to post comments

OpenPGP in Thunderbird

Posted Sep 24, 2020 17:05 UTC (Thu) by gnoutchd (guest, #121472) [Link] (2 responses)

TBird 78.x can delegate secret key operations (decryption, signing) to GnuPG. This was added specifically to support smartcards. I don't have a smartcard (yet), but I did want to keep my secret key in GnuPG, and this worked for me. See <https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards>. Does it not work for you?

OpenPGP in Thunderbird

Posted Sep 24, 2020 17:44 UTC (Thu) by kucharczyk (guest, #139572) [Link]

This does not work for me. I have an e-mail I am able to decrypt but not from withing Thunderbird. Maybe an issue with the e-mail itself? Another, unrelated, issue is something called nested signatures. I can't read some mailing list e-mails because Thunderbird won't decrypt them. It says "openpgp: unsupported feature: nested signatures".

OpenPGP in Thunderbird

Posted Sep 25, 2020 8:16 UTC (Fri) by tlamp (subscriber, #108540) [Link]

That actually works here, thank you for pointing me to it.

Weird, I did quite some searching for Thunderbird and smartcard support, but didn't find that article.

OpenPGP in Thunderbird

Posted Sep 26, 2020 13:08 UTC (Sat) by dd9jn (✭ supporter ✭, #4459) [Link]

I am not a TB user but I felt that I should known how the new OpenPGP integration works. I installed it yesterday on a Windows VM to get the experience of the majority of users. Despite all my critics given in personal discussions, I was positively surprised. The integration into the UI is nice and straightforward and easy to explain. There is none of the usual geeky gadgets and things are explained in a way many non-hackers can actually grasp.

Sure this is just a first step and there are lot of things which need to be addressed. The RNP library does all the complicated parts and I am confident that this library gets things right (we did some interop testing in the last years). From my brief test I see these missing things: 1. Allow import of offline keys (GnuPG extension but widely promoted), 2. Actually locally sign the keys instead of putting the trust information into some TB specific database, 3. Handle application/pgp-keys.

(FWIW, the first OpenPGP integration was written along with the then new mail code of Mozilla more than 20 years ago - unfortunately rejected by the Mozilla management because they didn't wanted any OpenPGP in their MUA.)