GNOME Bugzilla – Bug 222067
automatically verify gpg signatures
Last modified: 2006-06-07 14:24:53 UTC
Hi! Yet another gpg related user interface wishlist bug... I'd find it very convenient if evo would allow e-mail signatures to be verified automatically. As I'm on a permanent internet connection, key retrievals are not a problem for me (and, of course, for those who are not on a permanent connection, the option would have to be configurable) Thanks and greets from Switzerland -- vbi
Even if someone doesn't have a permanent connection they may want to automatically check signatures. After all, if you already have the user's key locally, there seems to be no reason not to check.
the reason signature checking is not auto-matic is because we have no way of making the user feel comfortable that the "valid sig" is not spoofed in HTML mail. with the current way, there can leave no doubt in the user's mind that the signature is for-real (tm).
I meant to add that this has nothing to do with auto-fecthing keys from a keyserver.
> the reason signature checking is not auto-matic is because we have no > way of making the user feel comfortable that the "valid sig" is not > spoofed in HTML mail. How about moving the signature check handling stuff for MIME signatures up into the header pane? You can't spoof this even in HTML mails? cheers -- vbi
The problem with that idea is that signatures are not limited to being for the whole message, they can legally be for individual MIME parts. So theoretically, each attachment could have its own signature as well as the message body.
If Evolution supports dynamic HTML pages (which I'm not sure about), it is still possible to forge Evolution's signature-checking behavior. Anyway, how about putting the signature information in the header field (visually: the gray frame atop of the message?) HTML has no access there, and there's one for which body part that can be signed.
it doesn't support dynamic html, so it cannot be spoofed. huh? the gray box only ever appears once for each message, not for each mime part. so no, that idea won't work.
*** bug 269371 has been marked as a duplicate of this bug. ***
NOTXIMIAN security this has nothing to do with evolution, but with your gpg settings - there you can add an automatical download of keys from keyservers. also see bug 261186 for this. shall this one be closed as NOTXIMIAN? at least depending on bug 217269 which is about adding a GUI for gpg/pgp key managing.
Apologies for any spam... cc'ing usability-maint on all Evolution usability bugs. Filter on EVO-USABILITY-SPAM to ignore.
Isn't this feature implemented as of evolution 2.6.1? It (sort of) works to me...
yes, as of like 2.2 or so.