gabriel rosenkoetter on Wed, 24 Apr 2002 15:03:08 -0400


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: Mutt & Pine & GnuPG & Mental Health (Re: Urban EW (was RE: Ricochet and various wireless (was: Re: [PLUG] key-signing Thursday?)))


On Wed, Apr 24, 2002 at 02:48:46PM -0400, ian reinhart geiser wrote:
> AFIK mutt is the only mailer that attaches the gpg sig as an attachment.

Not entirely true, but they're aren't many MUAs that use PGP/MIME.
(Yet.)

> KMail also wraps the entire message in the GPG signature.

Which is fine. But it ignores RFCs (2015 and 2440) about how PGP
messages can be sent in such a way that MUAs can safely notice they
exist automatically. (You wouldn't want your MUA trying to parse
every message for PGP data because it'd lead to the same kind of
insecurities that scripting Outlook does.) Just means that Pine
can't do it automatically.

> I think this came up before and it was decided that mutt was using an older 
> implementation while KMail and Pine where using the new standard.

That's flat-out wrong. RFC 2015 really is the right way to put PGP
in mail messages. The fact that pine (STILL!) can't deal with
multi-part MIME messages is (imho) just yet another reason to kick
it to the curb. See:

  http://www.washington.edu/pine/pine-info/2000.07/msg00120.html

The "newer" standard you're thinking of might be S/MIME, but that
uses SSL (and requires a certificate authority) as opposed PGP.

-- 
gabriel rosenkoetter
gr@eclipsed.net

Attachment: pgpo5wjiVtTiR.pgp
Description: PGP signature