Tickets :: Comment on [#5753] Minimize lacking PGP forward secrecy with webmail

Search Results: 5 of 24 [ <<First <Prev Next> Last>> ] [ Return to Search Results ]

* Your Email Address
* Spam protection	Enter the letters below: ._..__ . .. .. . \| [__)\|_/ \| \|\ / _\|_[__)\| \\|/\\| \/
Comment	> PGP lacks forward secrecy, i.e. once a secret key with corresponding > passphrase is known to an attacker, all prior and all future mails > can be decrypted if intercepted. Webmail applications are especially > vulnerable to keylogger (or looking over ones shoulders) attacks > because they are often used in insecure environments. Horde lets you > export the secret key thus one successfull attacks suffices to > compromise all prios and all future mails. I therefore suggest to > omit this "feature" (exporting of the secret key) in future versions. > > > > I think, it is not really important for users to export their secret > key. If they wish to have a copy on their harddisk, they should have > a secure place anyway and thus probably have the possibility to > generate a key pair on this system and import it into Horde > afterwards. If they want to change to a local mailsystem, they should > generate a new key anyway if it was possible to export the key > without their knowledge beforehand.
Attachment
Watch this ticket