I ran into an issue with hardware 2FA enabled and a new phone.
One of my Ubikeys is always plugged into my desktop, the other is on my keychain for wireless authentication with my phone.
Apparently, only the most recently used hardware 2FA is allowed to authenticate wirelessly to add a new device. Since my other Ubikey wasn’t wireless the only recourse was to remove the hardware 2FA, add the phone and then re-add the hardware 2FA.
If you’re in Linux, you can use eCryptfs to setup a private encrypted directory, move the ~/.thunderbird directory into it and just leave a symlink to it in your unencrypted home directory. Then you can store your emails in plain text in the encrypted private directory.
It’s not even complicated to set up: most Linux distributions are setup so that the private directory is automounted upon login: when you’re not logged in, your data at rest is encrypted. It only becomes readable when you’re logged in.
Both my Thunderbird and Firefox directories are stored in my private directory.
This does not answer the question. OP wants to Thunderbird to decrypt PGP mails. Yes, it makes sense to use an encrypting fs, but we are still missing this thunderbird feature.
Honestly, I can’t think of a good reason. This is just how email has always worked. What Thunderbird stores locally is identical to message on the server. It’s not decrypted because no conversion happens when syncing mail.
I agree, it would make sense to keep plaintext emails locally or on a trusted server for practical reasons.
Protonmail now supports searching in the content of all your mail, though.
Or at least the web client. It will ask you to download all your mail, and it will make an encrypted search index on your computer.
That’s cool but I like to have a central client for all my email providers. I’ve decided to go to fastmail which is good enough for my threat model. The thing that really convinced me is their blog post.
The main thing I care about is the security of the text in transit, and the philosophy of the service I’m using. All respectable mail providers use TLS (even gmail and outlook) but I don’t like their advertiser dependent business model. Proton, tutanota, and I think startmail do respect privacy, but I believe it’s dumb to depend on an external server if you’re that paranoid about your communications that you need to have your email using PGP. Just encrypt your own stuff and tell the other party to do the same. Or self host everything.
That’s a paid service, right? I don’t know much about them, they may have other pros too, but proton also allows you to use your own email client if you’re in a plan.
I am annoyed by this too. The big limitation would have had you could not use IMAP as that is remote.
The other issue is implementation. It would be easy to forward or attach or just store unencrypted in an insecure way which may not be desirable. Frankly for what I do I would prefer Thunderbird decrypt on receipt but place all content in a vault. If one wanted to add some more restrictions one could make it hard to forward by accident mail that was originally encrypted.
The big issue with PGP has always been a combination of bad implementations and key distribution.
This may be a long shot, but it’s what I do, so it might be an option: Set up a crypto gateway like CipherMail which will automatically decrypt inbound email and sign/encrypt outbound. The result is that your Thunderbird will never get to see an encrypted email, decryption is handled transparently before it hit’s your inbox. Obviously, if you don’t trust your email provider, this is not an option.
This isn’t simple and hence not for everyone, also comes with dependencies on your email provider, but it works flawless for me ever since I set it up. I run my own email server, hence adding in CipherMail wasn’t a big deal.
I feel like you’d get this with the Protonmail Bridge. It acts as it a email provider on your local network, and handles the encryption stuff itself. I believe Thunderbird sees and stores the email it sees through that as plan text.
It provides pretty good translations, but it’s not particularly good for privacy. Obviously it’s better than Google, but their privacy policy isn’t great.
My main issue is they want credit card info to get an API key, which is required if you want to use it through (properly integrated) addons or whatever. The translations are pretty much magic though. Really good results most of the time.
In the case of Keepass, it is commonly said that it is best to have a database exclusively for your OTP.
For example, you have your passwords in a db called “My passwords” with an exclusive encryption password, and then another db called “My OTP’s” with its own encryption password, so if someone somehow get access to one, that person still won’t have access to the other, and therefore cannot enter your account.
Depends on what is secure enough to you. For me that is secure enough but I know a ton of people out there who would say it's not secure enough for them. So in the end it's up to you. Think about the risks and make a decision.
privacyguides
Oldest
This magazine is from a federated server and may be incomplete. Browse more on the original instance.