News for hackers. Stuff that matters.
Re:Proposal to start a new implementation of Thunderbird bas... by WalterBright on Thursday April 20, 2017 @08:12PM (#14162032)
It needs end-to-end encryption. This isn't hard to do. Add a field in the header for your public key. When receiving mail, store the sender's public key in the address book.

Then, when sending mail, if there's a public key for the recipient, then encrypt it. No user interaction is required.

Re:Proposal to start a new implementation of Thunderbird bas... by pjc50 on Friday April 21, 2017 @06:24AM (#14164330)
> This isn't hard to do

Yes it is. Or someone would have done it by now.

> When receiving mail, store the sender's public key

You mean "the public key associated with the inbound email". You don't know anything at this point about how it relates to the person you're intending to correspond with, because the key could be MITMd.

Also, this approach does nothing to solve the fact that most people would prefer webmail and mail synced across multiple devices, which is an even more painful key management problem.

Re:Proposal to start a new implementation of Thunderbird bas... by WalterBright on Friday April 21, 2017 @03:35PM (#14168678)
> because the key could be MITMd.

That's true, and my paper mail envelope could be steamed open, read, and resealed as well. I'm not saying this would result in perfect security, and anyone would be foolish to treat it as good enough to direct their U-boat fleet. But it would be pretty good for routine email.

As for the key exchange, if a user is worried about it, they could exchange keys in another way. The point about the built-in key exchange is that it happens by default.

> more painful key management problem.

It's only painful if you really need high security. I'd just like something better than postcard security.

Re:Proposal to start a new implementation of Thunderbird bas... by dboreham on Thursday April 20, 2017 @09:09PM (#14162294)
Hmm. I can just about remember Jim Barksdale personally telling every employee that the new E2E encryption feature (PEM probably?) in Messenger had to be dog food tested. In 1997.
Re:Proposal to start a new implementation of Thunderbird bas... by WalterBright on Thursday April 20, 2017 @10:24PM (#14162660)
Unencrypted email is like mailing all your correspondence on postcards.
Re:Proposal to start a new implementation of Thunderbird bas... by carussell on Friday April 21, 2017 @01:12PM (#14167377)
The Thunderbird codebase has nothing to do with the Netscape codebase you're referring to.
Re:Proposal to start a new implementation of Thunderbird bas... by dboreham on Friday April 21, 2017 @05:22PM (#14169527)
Interesting. Are you sure? I didn't remember a big re-write ever happening, and after poking around in the current codebase for a while I see lots of old code and familiar names. Are you referring to just the UI? The address book code (the part I had something to do with back then) looks very similar.
Re:Proposal to start a new implementation of Thunderbird bas... by cestith on Friday April 21, 2017 @11:51AM (#14166626)
S/MIME works fine with Thunderbird.