On Mon, Dec 28, 2015 at 10:07 AM, Kristian Fiskerstrand <k...@gentoo.org> wrote: >> On 28 Dec 2015, at 15:58, James Le Cuirot <ch...@gentoo.org> wrote: >> >> On Mon, 28 Dec 2015 09:42:40 -0500 >> Rich Freeman <ri...@gentoo.org> wrote: > >>> And this would be why I don't bother to sign my emails any longer. >>> The FOSS world is still stuck in the days when people ran X11-based >>> MUAs and stored their mail in conventional folders. I've yet to see a >>> decent browser-based MUA or Android client which does signing. >>> Squirrelmail does, but it is really lacking compared to something like >>> Gmail. >> >> I haven't tried the feature myself but K9 Mail, which is highly >> regarded, does it via APG on Android. > > iirc k9 doesnt support PGP/MIME (RFC3156), but some interesting things > happening with OpenKeychain > (https://www.openkeychain.org/k-9/ ) in that regard. We actually discussed it > a bit during last OpenPGP summit in zurich. >
K9 also doesn't support email tagging as far as I'm aware, and I don't believe there is a browser version of it either (I do require an MUA accessible by a browser, as this is how I compose 99% of my emails - I read this email on androids, and am replying from a browser right now). To some extent they can be forgiven for not supporting tagging, as I don't believe IMAP supports it either, so we need standards as well as FOSS clients to make it work. But, it isn't like I'm paying anybody to solve the problem, so we all make do, either living without features or without signatures as the case may be. > The main issue is key storage, though. For signatures you can use a dedicated > signing subkey, however you get in problem with encrypted emails as mobile > devices > are not really secure devices and should never have cryptographic material. > What could > work in this case is a NFC (or for that matter bluetooth, although it needs > to be properly > paired etc etc) channel with a separate device with a separate keychain and > display so > you can verify the request, and never actually expose private key material to > the cellphone. That concern is hardly unique to phones. PCs suffer just as much from this problem. The solution could potentially be the same. For signing it is a straightforward problem since there is nothing to be kept secret except the key material itself (just send the message to the signing device, and return the signature back). For encryption you have additional challenges if you want to be able to make any use of the plaintext without it getting stolen - once decrypted it is only secure as any device that comes in contact with it. And there is no reason that mobile and browser frameworks couldn't talk to such devices with the right standards. If it were up to me the government would hand out signing devices just as they hand out passports. It seems kind of silly in this day and age that we haven't solved the key-management problem and half of our commerce involves giving 16-digit numbers to everybody we do business with and asking them to keep them secret for us. -- Rich
