View Single Post
Old 19 Jun 2016, 06:24 PM   #9
zimmermanfan
Essential Contributor
 
Join Date: Aug 2010
Posts: 200
Quote:
Originally Posted by Mailfence View Post
Quote:
Originally Posted by zimmermanfan View Post
1) Does mailfence.com use any public keyrings, such as pgp.mit.edu? So that if a non-mailfence user publishes their public key somewhere, mailfence will find it?
> Yes, mailfence users can find and import other PGP public keys from public key servers (pgp.mit.edu...) via their integrated key store (into their key-ring) and can also publish their own public keys so that other users can find them as well. For more info. check out this "how-to" guide.
I asked "if a non-mailfence user publishes their public key somewhere, mailfence will find it?" Based on what you said, the correct answer is "No", mailfence ("MF") will not find it. The user must find it, and add it manually.

This may be good for security, but makes mailfence less usable for novices.

With hushmail, an expert non-hushmail user can tell a total novice to get a hushmail account, and the expert user can do all the key management on their end so that it /just works/ for the novice.

Suppose a MF user emails someone for the first time. If the key is not on their keyring, why not check pgp.mit.edu automatically, and offer to import the key on the condition that the user verifies the fingerprint?
Quote:
Originally Posted by Mailfence View Post
Now both of the recipients will have to add your public key in their integrated key stores (individually) to securely reply back to you - this will allow them to verify your public key in a much richer way (matching fingerprint....etc) instead of relying onto a centralized local key-server which not only is insecure but also contradicts with the concept of PGP on philosophical grounds (No centralization/or centralized authority).
Moreover, a fully featured integrated key store also enable our users to perform all the crypto-keys related operations (import/export/modify/revoke/delete...) by themselves and thus transfer the full control of their privacy into their own hands - and that is what our belief duly relies upon.
I screwed up the phrasing of my question, but you answered it well.

It's unclear how separate public keyrings protects your users. When a MF user composes an outbound message, what's to stop MF from substituting a different public key? Even if the user has their own public keyring, the webtool won't necessarily use it.
Quote:
Originally Posted by Mailfence View Post
When you import encrypted emails via IMAP - you will receive them in as-is manner and will have to export your private key (in your local machine/or any other device) to decrypt them.
Good answer.. that's what I would expect.
Quote:
Originally Posted by Mailfence View Post
> The JavaScript we use is very complex and compressed. LibreJS simply translates 'it's complex' by 'it's suspect' which we find unrealistic. Its analysis is too simple to handle most modern JavaScript frameworks.
FYI: we are planning to release the code of our front-end in a later phase which will further clarify this and other code-level concerns.
Bug report filed: https://savannah.gnu.org/bugs/?48266
zimmermanfan is offline   Reply With Quote