Thunderbird:OpenPGP:Migration-From-Enigmail - Revision history

Arvidt: Added category Thunderbird_OpenPGP as agreed with Kai in Mozilla chat

2021-02-11T20:04:36Z

Added category Thunderbird_OpenPGP as agreed with Kai in Mozilla chat

← Older revision		Revision as of 20:04, 11 February 2021
Line 81:		Line 81:

	Thunderbird will not automatically import keys transferred with the Autocrypt email header mechanism. Thunderbird will not automatically enable encryption with correspondents based on Autocrypt email headers. The user needs to confirm the offer to import the attached key in an email, and then manually accept the use of the key, and also manually enable encryption in messages that are sent.		Thunderbird will not automatically import keys transferred with the Autocrypt email header mechanism. Thunderbird will not automatically enable encryption with correspondents based on Autocrypt email headers. The user needs to confirm the offer to import the attached key in an email, and then manually accept the use of the key, and also manually enable encryption in messages that are sent.

			[[Category:Thunderbird_OpenPGP]]

Kaie: Clarification about Enigmail migrator and pEp/junior mode.

2020-08-26T12:01:15Z

Clarification about Enigmail migrator and pEp/junior mode.

← Older revision		Revision as of 12:01, 26 August 2020
Line 32:		Line 32:
	Enigmail had offered multiple modes of operation. If you had started to use Enigmail in recent years, you might have been using Enigmail's Junior Mode, which was operated behind the scenes by pEp software. If you have frequently seen red squares, yellow triangles and green shields with Enigmail, then you were likely using that mode.		Enigmail had offered multiple modes of operation. If you had started to use Enigmail in recent years, you might have been using Enigmail's Junior Mode, which was operated behind the scenes by pEp software. If you have frequently seen red squares, yellow triangles and green shields with Enigmail, then you were likely using that mode.

	'''Thunderbird 78 does not support the Junior Mode.'''		'''Thunderbird 78 does not support the Junior Mode.''' (However, the aforementioned Enigmail migration Add-on is said to offer you the option to install newer pEp Software for Thunderbird. Note that Mozilla and Thunderbird are not affiliated with pEp.)

	Thunderbird's new OpenPGP implementation is more similar to Enigmail's classic mode of operation, which was configured in recent Enigmail releases with the setting "Force using S/MIME and Enigmail". If you have already been using Enigmail for many years, and you already had OpenPGP keys in Enigmail at the time the junior mode was offered for the first time, you have probably been using Enigmail's classic mode, and might have never seen Enigmail's alternative junior mode.		Thunderbird's new OpenPGP implementation is more similar to Enigmail's classic mode of operation, which was configured in recent Enigmail releases with the setting "Force using S/MIME and Enigmail". If you have already been using Enigmail for many years, and you already had OpenPGP keys in Enigmail at the time the junior mode was offered for the first time, you have probably been using Enigmail's classic mode, and might have never seen Enigmail's alternative junior mode.

Kaie: add a link to the optional mechanism to use smartcards

2020-08-24T20:22:42Z

add a link to the optional mechanism to use smartcards

← Older revision		Revision as of 20:22, 24 August 2020
Line 17:		Line 17:

	== GnuPG vs. RNP and key storage ==		== GnuPG vs. RNP and key storage ==
	Thunderbird no longer uses the external GnuPG software. Previously, all your own keys and the keys of other people were managed by GnuPG, and Enigmail offered you to view, use and manage them. Now that Thunderbird uses a different technology, it's necessary to perform a migration of your existing keys from GnuPG into Thunderbird's own storage (inside the Thunderbird profile directory). Thunderbird will uses its own copy of the keys, sharing your keys between Thunderbird 78 and GnuPG currently isn't supported. (~~TODO~~: ~~explain the smartcard situation~~.)		Thunderbird no longer uses the external GnuPG software. Previously, all your own keys and the keys of other people were managed by GnuPG, and Enigmail offered you to view, use and manage them. Now that Thunderbird uses a different technology, it's necessary to perform a migration of your existing keys from GnuPG into Thunderbird's own storage (inside the Thunderbird profile directory). Thunderbird will uses its own copy of the keys, sharing your keys between Thunderbird 78 and GnuPG currently isn't supported. (Exception: There is an [[Thunderbird:OpenPGP:Smartcards \| optional mechanism to use GnuPG with smartcards]]. It's disabled by default and needs more testing.)

	The migration functionality isn't provided by Thunderbird. Rather, an update for the Enigmail Add-on and Thunderbird 78 will be available, which no longer provides the usual functionality, but rather will help you to perform a migration of your existing keys.		The migration functionality isn't provided by Thunderbird. Rather, an update for the Enigmail Add-on and Thunderbird 78 will be available, which no longer provides the usual functionality, but rather will help you to perform a migration of your existing keys.

Kaie: one word change

2020-07-16T14:50:50Z

one word change

← Older revision		Revision as of 14:50, 16 July 2020
Line 64:		Line 64:
	Because Thunderbird continues to support the S/MIME email security technology, you'll find a new choice in the security or options menu, which allows you to control the encryption technology that you would like to use.		Because Thunderbird continues to support the S/MIME email security technology, you'll find a new choice in the security or options menu, which allows you to control the encryption technology that you would like to use.

	When receiving an email, ~~the~~ display the OpenPGP security status of a message, Enigmail used a line of text above the message sender information. This has been changed to work similarly to showing the status of S/MIME messages. Instead of a line of text, icons will be shown to visualize the state of the message.		When receiving an email, to display the OpenPGP security status of a message, Enigmail used a line of text above the message sender information. This has been changed to work similarly to showing the status of S/MIME messages. Instead of a line of text, icons will be shown to visualize the state of the message.

	A padlock in varying appearances is used to show the encryption status of a message you have received.		A padlock in varying appearances is used to show the encryption status of a message you have received.

Kaie: typo fixes

2020-07-16T14:44:02Z

typo fixes

← Older revision		Revision as of 14:44, 16 July 2020
Line 1:		Line 1:
	== Changes from Enigmail to Thunderbird 78 ==		== Changes from Enigmail to Thunderbird 78 ==

	This document is ~~inteneded~~ specifically for existing users of Enigmail, who want to start using Thunderbird 78 and its integrated OpenPGP functionality.		This document is intended specifically for existing users of Enigmail, who want to start using Thunderbird 78 and its integrated OpenPGP functionality.

	'''If you have never used the Enigmail Add-on, then you can skip this document.'''		'''If you have never used the Enigmail Add-on, then you can skip this document.'''
Line 60:		Line 60:

	== Other changes ==		== Other changes ==
	Previously, instead of sending your public key as an ~~attachement~~, Enigmail had the functionality to include your public key in a hidden email header according to the Autocrypt standard. This functionality currently isn't offered, but might be added in the future.		Previously, instead of sending your public key as an attachment, Enigmail had the functionality to include your public key in a hidden email header according to the Autocrypt standard. This functionality currently isn't offered, but might be added in the future.

	Because Thunderbird continues to support the S/MIME email security technology, you'll find a new choice in the security or options menu, which allows you to control the encryption technology that you would like to use.		Because Thunderbird continues to support the S/MIME email security technology, you'll find a new choice in the security or options menu, which allows you to control the encryption technology that you would like to use.

Kaie: Improve text based on suggestions from Berna

2020-07-16T14:31:42Z

Improve text based on suggestions from Berna

Kaie: Add structure and some small reordering, and some highlighting of important details

2020-07-16T14:05:02Z

Add structure and some small reordering, and some highlighting of important details

← Older revision		Revision as of 14:05, 16 July 2020
Line 1:		Line 1:
	Enigmail ~~and~~ Thunderbird 78 ~~HOWTO.~~		== Changes from Enigmail to Thunderbird 78 ==

	This document is inteneded specifically for existing users of Enigmail, who want to start using Thunderbird 78 and its integrated OpenPGP functionality~~. If you have never used the Enigmail Add-on, then you don't need this document to use OpenPGP with Thunderbird 78~~.		This document is inteneded specifically for existing users of Enigmail, who want to start using Thunderbird 78 and its integrated OpenPGP functionality.

			'''If you have never used the Enigmail Add-on, then you can skip this document.'''

			Due to required technology changes, you'll experience a lot of changes. We have tried to make the new OpenPGP functionality easier to understand and use, but on the other hand, some features will work differently than before, or might be missing.

			'''Before you update to Thunderbird 78, you should read this whole document, to understand the changes that you will see.'''

			== Experimental in 78.0, but stable in the near future ==
	If you're reading this before OpenPGP has been declared as a stable feature in Thunderbird 78.x (expected for the 78.2 release end of August 2020), then please consider to stay with Thunderbird 68 and Enigmail for another while, especially if you depend on the security of OpenPGP and are worried about correct behavior.		If you're reading this before OpenPGP has been declared as a stable feature in Thunderbird 78.x (expected for the 78.2 release end of August 2020), then please consider to stay with Thunderbird 68 and Enigmail for another while, especially if you depend on the security of OpenPGP and are worried about correct behavior.

	If ~~you are willing to experiment, or if the Thunderbird project has already declared OpenPGP as stable, then please read on.~~		If you're using an early release version of Thunderbird 78 the OpenPGP functionality is still disabled by default.

	~~Due to required technology changes,~~ you'~~ll experience a lot~~ of ~~changes. We have tried to make~~ the ~~new~~ OpenPGP functionality ~~easier to understand and use, but on the other hand, some features will work differently than before, or might be missing~~.

	If you~~'re using an early release version of Thunderbird 78, e.g. 78.0 or 78.1, and you are willing~~ to ~~experiment, the~~ OpenPGP ~~functionality might~~ still ~~be disabled by default. Use the TB~~ preferences, config editor~~, and~~ change the preference with the name "mail.openpgp.enable" to the value "true". Then restart Thunderbird. This will enable the user interface for OpenPGP.		If you would like to test while OpenPGP support is still experimental, you may open Thunderbird preferences, and use the config editor to change the preference with the name "mail.openpgp.enable" to the value "true". Then restart Thunderbird. This will enable the user interface for OpenPGP.

			== GnuPG vs. RNP and key storage ==
	Thunderbird no longer uses the external GnuPG software. Previously, all your own keys and the keys of other people were managed by GnuPG, and Enigmail offered you to view, use and manage them. Now that Thunderbird uses a different technology, it's necessary to perform a migration of your existing keys, to migrate them from GnuPG into Thunderbird's own storage (inside the Thunderbird profile directory). Thunderbird will uses its own copy of the keys, sharing your keys between Thunderbird 78 and GnuPG currently isn't supported. (TODO: explain the smartcard situation.)		Thunderbird no longer uses the external GnuPG software. Previously, all your own keys and the keys of other people were managed by GnuPG, and Enigmail offered you to view, use and manage them. Now that Thunderbird uses a different technology, it's necessary to perform a migration of your existing keys, to migrate them from GnuPG into Thunderbird's own storage (inside the Thunderbird profile directory). Thunderbird will uses its own copy of the keys, sharing your keys between Thunderbird 78 and GnuPG currently isn't supported. (TODO: explain the smartcard situation.)

	The migration functionality isn't provided by Thunderbird. Rather, an update for the Enigmail Add-on and Thunderbird 78 will be available, which no longer provides the usual functionality, but rather will help you to perform a migration of your existing keys.		The migration functionality isn't provided by Thunderbird. Rather, an update for the Enigmail Add-on and Thunderbird 78 will be available, which no longer provides the usual functionality, but rather will help you to perform a migration of your existing keys.

	Once you are using Thunderbird 78, Enigmail should update, and should offer you to migrate your keys. It should configure your email accounts to use the same keys that you had used previously.		Once you are using Thunderbird 78, Enigmail should update, and should offer you to migrate your keys. Note that this will work, even if OpenPGP is not yet stable. The migration process should configure your email accounts to use the same keys that you had used previously.

	Thunderbird doesn't use on-demand unlocking (key passwords) for your keys. Rather, the only way to password protect the use of your OpenPGP secret keys is to set up the global Master Password feature of Thunderbird, which you can find in Thunderbird's security preferences.		Thunderbird doesn't use on-demand unlocking (key passwords) for your keys. Rather, the only way to password protect the use of your OpenPGP secret keys is to set up the global Master Password feature of Thunderbird, which you can find in Thunderbird's security preferences.
Line 23:		Line 29:
	If you were using the ownertrust configuration for keys with GnuPG, this is handled differently in TB. The equivalent of marking a secret key as ownertrust ultimate is to use Thunderbird's OpenPGP key manager, open its details, and confirm that you accept it as a personal key. This flag will be automatically set by the migration. You might have to manually set it when importing a key using Thunderbird's key manager. The stable Thunderbird release is expected to ask you to set that flag at import time.		If you were using the ownertrust configuration for keys with GnuPG, this is handled differently in TB. The equivalent of marking a secret key as ownertrust ultimate is to use Thunderbird's OpenPGP key manager, open its details, and confirm that you accept it as a personal key. This flag will be automatically set by the migration. You might have to manually set it when importing a key using Thunderbird's key manager. The stable Thunderbird release is expected to ask you to set that flag at import time.

	~~Regarding the workflow to send encrypted emails:~~ Enigmail had offered multiple modes of operation. If you had started to use Enigmail in recent years, you might have been using Enigmail's ~~junior mode~~, which was operated behind the scenes by pEp software. If you have frequently seen red squares, yellow triangles and green ~~shapes~~ with Enigmail, then you were likely using that mode. Thunderbird 78 does not support the junior mode.		== Classic Mode vs. Junior Mode ==
			Enigmail had offered multiple modes of operation. If you had started to use Enigmail in recent years, you might have been using Enigmail's Junior Mode, which was operated behind the scenes by pEp software. If you have frequently seen red squares, yellow triangles and green shields with Enigmail, then you were likely using that mode.

			'''Thunderbird 78 does not support the Junior Mode.'''

			Thunderbird's new OpenPGP implementation is more similar to Enigmail's classic mode of operation, which was configured in recent Enigmail releases with the setting "Force using S/MIME and Enigmail". If you have already been using Enigmail for many years, and you already had OpenPGP keys in Enigmail at the time the junior mode was offered for the first time, you have probably been using Enigmail's classic mode, and might have never seen Enigmail's alternative junior mode.

	~~Thunderbird~~'s new OpenPGP implementation is more similar to Enigmail's classic mode of operation, which was configured in recent Enigmail releases with the setting "Force using S/MIME and Enigmail". If you have already been using Enigmail for many years, and you already had OpenPGP keys in Enigmail at the time the junior mode was offered for the first time, you have probably been using Enigmail'~~s classic mode, and might have never seen Enigmail~~'~~s alternative junior mode.~~ The remainder of this document will not talk about junior mode, but rather will only discuss Enigmail's classic mode.		'''The remainder of this document will not talk about junior mode, but rather will only discuss differences between Enigmail's classic mode and Thunderbird 78.'''

			== The workflow of sending encrypted email ==
	Enigmail had a lot of configuration choices to control the email encryption workflow.		Enigmail had a lot of configuration choices to control the email encryption workflow.

Line 47:		Line 59:
	Today, if you enable encryption for a message, then digital signing will be automatically enabled, too. And if digital signing is used, the option to attach your own public key to the message is automatically enabled, too. You may manually disable these options for an individual message, if desired.		Today, if you enable encryption for a message, then digital signing will be automatically enabled, too. And if digital signing is used, the option to attach your own public key to the message is automatically enabled, too. You may manually disable these options for an individual message, if desired.

			== Other changes ==
	Previously, instead of sending your public key as an attachement, Enigmail had the ability to include your public key in a hidden email header according to the Autocrypt standard. This functionality currently isn't offered, but might be added in the future.		Previously, instead of sending your public key as an attachement, Enigmail had the ability to include your public key in a hidden email header according to the Autocrypt standard. This functionality currently isn't offered, but might be added in the future.

Kaie: self-review, typo fixes and clarifications

2020-07-08T20:39:31Z

self-review, typo fixes and clarifications

Show changes

Kaie: Created page with "Enigmail and Thunderbird 78 HOWTO. This document is specifically for existing users of Enigmail, who want to start using Thunderbird 78 and its integrated OpenPGP functionali..."

2020-07-08T20:12:43Z

Created page with "Enigmail and Thunderbird 78 HOWTO. This document is specifically for existing users of Enigmail, who want to start using Thunderbird 78 and its integrated OpenPGP functionali..."

New page

Enigmail and Thunderbird 78 HOWTO.

This document is specifically for existing users of Enigmail, who want to start using Thunderbird 78 and its integrated OpenPGP functionality. If you have never used the Enigmail Add-on, you don't need this document to use OpenPGP with Thunderbird 78.

If you're reading this before OpenPGP has been declared as a stable feature in Thunderbird 78.x (expected for the 78.2 release end of August 2020), then please consider to stay with Thunderbird 68 and Enigmail for another while, especially if you depend on the security of OpenPGP and are worried about correct behavior.

If you are willing to experiment, or if the Thunderbird has already declared OpenPGP as stable, please read one.

Due to required technology changes, you'll experience a lot of changed. We have tried to make the new OpenPGP functionality easier to understand and use, but on the other hand, some features might no longer work as before, or might be missing.

Let's go through the various areas in order.

If you're using an early release version of Thunderbird 78, e.g. 78.0 or 78.1, and you are willing to experiment, the OpenPGP functionality might still be disabled by default. Use the preferences, config editor, and change the preference with the name "mail.openpgp.enable" to the value "true". Then restart Thunderbird. This will enable the user interface for OpenPGP.

Thunderbird no longer uses the external GnuPG software. Previously, all your own keys and the keys of other people were managed by GnuPG, and Enigmail simply offered you to view, use and manage them. Now that Thunderbird uses a different technology, it's necessary to perform a migration of your existing keys, to migrate them from GnuPG into Thunderbird's own storage (inside the Thunderbird profile directory). Thunderbird will uses its own copy of the keys, it's not easily possible to share your keys between Thunderbird 78 and GnuPG.

The migration functionality isn't provided by Thunderbird. Rather, an update for the Enigmail Add-on and Thunderbird 78 will be available, which no longer provides the usual functionality, but rather will help you to perform a migration of your existing keys.

Once you are using Thunderbird 78, Enigmail should update, and should offer you to migrate your keys. It should configure your email accounts to use the same keys that you had previously.

Thunderbird doesn't use on-demand unlocking for your keys. Rather, the only way to password protect the use of your OpenPGP secret keys is to set up the global Master Password feature of Thunderbird, which you can find in Thunderbird's security preferences. To enable Thunderbird to use your existing secret keys, you must unlock them to import them. This may require you to enter your password twice. First, to confirm that GnuPG is allowed to export the password. Second, to allow Thunderbird to access the raw key and copy it into Thunderbird's configuration storage. This is handled as part of the migration process, offered by the updated Enigmail Add-on, that acts as a migration tool.

If you were using the ownertrust configuration for keys with GnuPG, this is handled differently in TB. The equivalent of marking a secret key as ownertrust ultimate is to use Thunderbird's OpenPGP key manager, open its details, and confirm that you accept it as a personal key. This flag will be automatically set by the migration. You might have to manually set it when importing a key using Thunderbird's key manager. Future import procedures will ask you to set that flag at import time.

Regarding the workflow to send encrypted emails: Enigmail had offered multiple modes of operation. If you had started to use Enigmail in recent years, you might have been using Enigmail's junior mode, which was operated behind the scenes by pEp software. If you have frequently seen red squares, yellow triangles and green shapes with Enigmail, then you were likely using that mode. Thunderbird 78 does not support the junior mode.

Thunderbird's new OpenPGP implementation is more similar to Enigmail's classic mode of operation, which was configured in recent Enigmail releases with the setting "Force using S/MIME and Enigmail". If you have already been Enigmail for many years, and you already had OpenPGP keys in Enigmail at the time the junior mode was offered for the first time, you have probably been using Enigmail's classic mode. The remainder of this document will talk about this classic mode.

Enigmail had a lot of configuration choices to control the email encryption workflow.

Enigmail's "general preferences for sending" allowed a choice of "default" and "manual". The default settings allowed the opportunistic use of encryption, which could also manually be enabled using the "Automatically send encrypted" choice. Thunderbird 78 does not use an opportunistic mode. Rather, it uses a strict mode, where correspondent keys must be manually accepted, before they are used. This is also related to Enigmail's preference, which keys are accepted for sending encrypted messages. Enigmail's default was "all usable keys". Thunderbird's new behavior is closer to Enigmail's alternative choice "only trusted keys".

In order to send an encrypted message, Thunderbird requires that you accept each correspondent's key once. However, it attempts to make that process straightforward. When trying to send an encrypted message, and you haven't yet used a correspondent's key, you will be guided to review the keys that you already have available, and review, accept, and optionally verify them. If keys are missing, you'll be given the choice to discover them online on a WKD server, or on the keys.openpgp.org keyserver.

The Enigmail migration will help you by marking the keys of your correspondents as accepted, which you have previously certified (signed).

At this time Thunderbird does not support automatically accepting keys if you they carry your signature on it. This functionality might be added in a later time. Also, the Web of Trust functionality is not supported. In other words, with Enigmail and OpenPGP some keys of your correspondents might have been automatically accepted for use, if there was a chain of trust from your keys, along keys that you had signed, to the key you'd like to use. Instead, you are currently required to manually accept each recipient key that you'd like to use.

Enigmail offered to show you a prompt at the time you request to send the message, telling you whether the message will be encrypted, signed or not. At this time, Thunderbird does not provide this prompt. You should look at the message settings prior to sending the message, which is shown in the status bar of the composer window. Or you can open the dropdown menu next to the security button. The shown options will tell you if encryption and signing are enabled. Currently, if encryption is enabled for a message, you cannot send the message, unless you have valid keys available for each recipient (not revoked, not expired), and you have accepted at least one valid key for each recipient. The key availability for a message you are sending can be seen by clicking the security button, or by using the classic menu command "view message security info".

With Enigmail, if you attempted to send an encrypted message, but Enigmail couldn't automatically identify which key should be used to encrypt for a particular recipient, Enigmail would open a rather complex dialog, in which you could select the keys to use. Thunderbird will not. Rather, you need to have keys for each recipient, that contain the recipient's email address in of the key's user IDs. Thunderbird does not support using alternative keys that contain no email address, or keys that don't contain a matching email address.

Also, because Enigmail used GnuPG to encrypt, it was possible to use advanced configuration in a GnuPG configuration file, that controlled which keys will be automatically used based on recipient email addresses. At this time, Thunderbird does not offer an equivalent feature.

Enigmail offered a configuration mechanism named per-recipient-rules. Thunderbird does not support that feature at this time.

Today, if you encryption is enabled for a message, the digital signing will be automatically enabled, too. And if digital signing is used, the option to attach your own public key to the message is automatically enabled, too. You may manually disable these options for an individual message, if desired.

Previously, instead of sending your public key as an attachement, Enigmail had the ability to include your public in a hidden email header according to the Autocrypt standard. This functionality currently isn't offered, but might be added in the future.

Because Thunderbird continues to support the S/MIME email security technology, you'll find a new choice in the menu, which allows you to control the encryption technology that you would like to use.

When receiving an email, Enigmail had used a line of text above the message sender information, to display the OpenPGP status of a message. This has been reworked to be similar to the way that has been used to show the status of S/MIME. Instead of a line of text, icons will be shown to visualize the state of the message.

A padlock in varying appearance is used to show the encryption status of a message you have received.
A stamped envelope icon in varying appearance is used to show the digital signature status of a message you have received.
You may click the icons to view a more detailed explanation.

The signature status of a message depends on the status you have granted to the signer's key. A signature is treated as valid, if it is technically correct, if you have already imported the key, and if you have accepted to use the sender's key. You are given the choice to accept a correspondent's key without verification, if you prefer to avoid the more security fingerprint verification. The digital signature status icon will be different after verifying a sender's key.

When telling Thunderbird that you have verified a correspondent's key, Thunderbird will remember this information separately from the key. The classic way of remembering it is by adding a key certification to your corresponden't key (signing their key). This is not yet supported, but will likely added in the future version.

Enigmail offered a feature to define automatic message filters, that performed automatic actions based on the properties of an email, and could automatically decrypt a message, and store a decrypted message locally. Thunderbird does not support that at this time, the messages are kept encrypted, and will need to be decrypted each time you are reading them. As a consequence, at this time encrypted messages are not included in global searches and the message search index.

When receiving an email, Thunderbird will scan the message for attached keys. At this time, attachments of type application/pgp-keys and the autocrypt header are automatically processed. Key updates, for keys that you have previously imported, such as expiration extensions or revocations for keys, will be automatically imported at the time of opening a message, without the requirement for manual confirmation.

Other keys, which haven't been imported previously, will be offered for import. If a new key for the sender's email address is seen, although you have previously accepted a different key, Thunderbird will shown an extra warning.

Thunderbird will not automatically import keys transferred with the Autocrypt email header mechanism. Thunderbird will not automatically enable encryption with correspondents based on Autocrypt email headers. The user needs to confirm the offer to import the attached key in an email, and then manually accept the use of the key, and also manually enable encryption in messages that are sent.

← Older revision		Revision as of 14:31, 16 July 2020
Line 17:		Line 17:

	== GnuPG vs. RNP and key storage ==		== GnuPG vs. RNP and key storage ==
	Thunderbird no longer uses the external GnuPG software. Previously, all your own keys and the keys of other people were managed by GnuPG, and Enigmail offered you to view, use and manage them. Now that Thunderbird uses a different technology, it's necessary to perform a migration of your existing keys~~, to migrate them~~ from GnuPG into Thunderbird's own storage (inside the Thunderbird profile directory). Thunderbird will uses its own copy of the keys, sharing your keys between Thunderbird 78 and GnuPG currently isn't supported. (TODO: explain the smartcard situation.)		Thunderbird no longer uses the external GnuPG software. Previously, all your own keys and the keys of other people were managed by GnuPG, and Enigmail offered you to view, use and manage them. Now that Thunderbird uses a different technology, it's necessary to perform a migration of your existing keys from GnuPG into Thunderbird's own storage (inside the Thunderbird profile directory). Thunderbird will uses its own copy of the keys, sharing your keys between Thunderbird 78 and GnuPG currently isn't supported. (TODO: explain the smartcard situation.)

	The migration functionality isn't provided by Thunderbird. Rather, an update for the Enigmail Add-on and Thunderbird 78 will be available, which no longer provides the usual functionality, but rather will help you to perform a migration of your existing keys.		The migration functionality isn't provided by Thunderbird. Rather, an update for the Enigmail Add-on and Thunderbird 78 will be available, which no longer provides the usual functionality, but rather will help you to perform a migration of your existing keys.

	Once you are using Thunderbird 78, Enigmail ~~should~~ update, and ~~should~~ offer you to migrate your keys. Note that this will work, even if OpenPGP is not yet stable. The migration process ~~should~~ configure your email accounts to use the same keys that you had used previously.		Once you are using Thunderbird 78, Enigmail will update and will offer you to migrate your keys. Note that this will work, even if OpenPGP is not yet stable. The migration process will attempt to configure your email accounts to use the same keys that you had used previously. After the migration has completed, you should open Account Settings and the End-To-End Encryption tab, to verify the configuration.

	Thunderbird doesn't use on-demand unlocking (key passwords) ~~for~~ your keys. Rather, the only way to password protect the use of your OpenPGP secret keys is to set up the global Master Password feature of Thunderbird, which you can find in Thunderbird's security preferences.		Thunderbird doesn't use on-demand unlocking (key passwords) of your secret keys. Rather, the only way to password protect the use of your OpenPGP secret keys is to set up the global Master Password feature of Thunderbird, which you can find in Thunderbird's security preferences.

	To enable Thunderbird to use your existing secret keys, you must unlock them to import them. This may require you to enter your password twice. First, to confirm that GnuPG is allowed to export the password. Second, to allow Thunderbird to access the raw key and copy it into Thunderbird's configuration storage. This is handled as part of the migration process, offered by the updated Enigmail Add-on, that acts as a migration tool.		To enable Thunderbird to use your existing secret keys, you must unlock them to import them. This may require you to enter your password twice. First, to confirm that GnuPG is allowed to export the password. Second, to allow Thunderbird to access the raw key and copy it into Thunderbird's configuration storage. This is handled as part of the migration process, offered by the updated Enigmail Add-on, that acts as a migration tool.
Line 60:		Line 60:

	== Other changes ==		== Other changes ==
	Previously, instead of sending your public key as an attachement, Enigmail had the ~~ability~~ to include your public key in a hidden email header according to the Autocrypt standard. This functionality currently isn't offered, but might be added in the future.		Previously, instead of sending your public key as an attachement, Enigmail had the functionality to include your public key in a hidden email header according to the Autocrypt standard. This functionality currently isn't offered, but might be added in the future.

	Because Thunderbird continues to support the S/MIME email security technology, you'll find a new choice in the security or options menu, which allows you to control the encryption technology that you would like to use.		Because Thunderbird continues to support the S/MIME email security technology, you'll find a new choice in the security or options menu, which allows you to control the encryption technology that you would like to use.

	When receiving an email, the display the OpenPGP security status of a message, Enigmail used a line of text above the message sender information. This has been ~~reworked~~ to ~~be similar~~ to ~~the existing mechanism that shows~~ the status of S/MIME messages. Instead of a line of text, icons will be shown to visualize the state of the message.		When receiving an email, the display the OpenPGP security status of a message, Enigmail used a line of text above the message sender information. This has been changed to work similarly to showing the status of S/MIME messages. Instead of a line of text, icons will be shown to visualize the state of the message.

	A padlock in varying appearances is used to show the encryption status of a message you have received.		A padlock in varying appearances is used to show the encryption status of a message you have received.
Line 74:		Line 74:
	When telling Thunderbird that you have verified a correspondent's key, Thunderbird will remember this information separately from the key. The classic way of remembering it is by adding a key certification to your correspondent's key (signing their key). This is not yet supported, but will likely added in the future version.		When telling Thunderbird that you have verified a correspondent's key, Thunderbird will remember this information separately from the key. The classic way of remembering it is by adding a key certification to your correspondent's key (signing their key). This is not yet supported, but will likely added in the future version.

	Enigmail offered a feature to define automatic message filters, that performed automatic actions based on the properties of an email, and could automatically decrypt a message, and store a decrypted message locally. Thunderbird does not support ~~that~~ at this time, the messages are kept encrypted, and will need to be decrypted each time you are reading them. As a consequence, ~~at this time~~ encrypted messages are not included in global searches and the message search index.		Enigmail offered a feature to define automatic message filters, that performed automatic actions based on the properties of an email, and could automatically decrypt a message, and store a decrypted message locally. Thunderbird does not support this functionality at this time, the messages are kept encrypted, and will need to be decrypted each time you are reading them. As a consequence, encrypted messages are not included in global searches and the message search index.

	When receiving an email, Thunderbird will scan the message for attached keys. ~~At this time~~, attachments of type application/pgp-keys and the autocrypt header are automatically processed. Key updates, for keys that you have previously imported, such as expiration extensions or revocations for keys, will be automatically imported at the time of opening a message, without the requirement for manual confirmation. (Feature expected for 78.1.)		When receiving an email, Thunderbird will scan the message for attached keys. Currently, attachments of type application/pgp-keys and the autocrypt header are automatically processed. Key updates, for keys that you have previously imported, such as expiration extensions or revocations for keys, will be automatically imported at the time of opening a message, without the requirement for manual confirmation. (Feature expected for 78.1.)

	Other keys, which haven't been imported previously, will be offered for import. If a new key for the sender's email address is seen, although you have previously accepted a different key, Thunderbird will show an extra warning (new feature expected for 78.1).		Other keys, which haven't been imported previously, will be offered for import. If a new key for the sender's email address is seen, although you have previously accepted a different key, Thunderbird will show an extra warning (new feature expected for 78.1).

	Thunderbird will not automatically import keys transferred with the Autocrypt email header mechanism. Thunderbird will not automatically enable encryption with correspondents based on Autocrypt email headers. The user needs to confirm the offer to import the attached key in an email, and then manually accept the use of the key, and also manually enable encryption in messages that are sent.		Thunderbird will not automatically import keys transferred with the Autocrypt email header mechanism. Thunderbird will not automatically enable encryption with correspondents based on Autocrypt email headers. The user needs to confirm the offer to import the attached key in an email, and then manually accept the use of the key, and also manually enable encryption in messages that are sent.