Thunderbird 78.x is great but has issues for advanced PGP users

Re:Thunderbird 78.x is great but has issues for advanced PGP... by anoncake on Friday November 27, 2020 @06:58AM (#25227927)

Instead of trying to reimplement GPG, they could have added the necessary APIs to WebExtensions.

Not directly related, but maybe Thunderbird shouldn't use Gecko to render emails. A smaller renderer with limited features may be sufficient and more secure.

[ Parent | on HN ]

Re:Thunderbird 78.x is great but has issues for advanced PGP... by tracker1 on Friday November 27, 2020 @09:45AM (#25229067)

Or... disable any JS runtime in a webview/iframe for the message. I get using an HTML rendering engine, I don't get ever enabling JS.

Worst offense was when Outlook (and Express) used the IE rendering engine with JS in "local" (unrestricted) trust mode. Melissa/ILoveYou etc...

[ Parent | on HN ]

Re:Thunderbird 78.x is great but has issues for advanced PGP... by anoncake on Saturday November 28, 2020 @08:12AM (#25237303)

That's about the bare minimum. Does any modern client not do that? But I think an HTML renderer that doesn't even have support for Javascript, audio and video tags, perhaps parts of CSS, etc. has a smaller attack surface.

[ Parent | on HN ]

Re:Thunderbird 78.x is great but has issues for advanced PGP... by tracker1 on Sunday November 29, 2020 @09:00AM (#25245119)

Automatic playing of audio or video, and no eval support in css would also be a good idea.

[ Parent | on HN ]