GPG for email (and other stuff?)

i would like to have logs or timestamps regarding these talks, so i can reread them... too bad i missed those :-(

Is there a status on the progress?

What about making the mail app extensible with plugins? Then community could jump in and help building this.

I agree with @schmittlauch . The community is more then willing to contribute on this, so the more you open up your stuff (either through code or plugin support), the more featureful Sailfish becomes!

"Sailfish 3 has a deeper level of security" but still no PGP encryption for emails :/ https://blog.jolla.com/sailfish3/

I will wait for BUILD IN PGP, CalDav and WebDav. We would like to move from Adroid away with our business phones. Workarounds are not stable enough and often breaks after updates.

Sounds good. Universal encryption (GPG) which is compatible with different devices and operating systems.

Having drafts encrypted is really good and if they are not, it would be good to configure email client to store drafts locally.

That said, email is no place for storing passwords. Please do not use email as password storage, encrypted or not. Password managers may be incompatible with each other but the solution is to make them compatible, or export information to another manager. Certainly not switching to draft emails.

I don't see why not? GPG is about as strong encryption as you can get, and all encryption/decryption takes place on the local machine. With any good GPG email integration, the decrypted message will never be saved to disk, and obviously will never be uploaded unencrypted to the server. Good GPG integrations take encryption very seriously: some uses of GPG are for situations much more dangerous than just loosing your credit card number! From this point of view, IMAP is simply a cloud file storage with well working synchronization and vast platform support.

It is simply the wrong tool for the purpose. One reason is just given above, K9's lack of support for draft emails. One needs to actually be aware of such an implementation detail in a client application to be able to avoid it. Another simple reason is that the purpose of email is to send and receive mail, not to store changing documents to self. It only takes one simple 'oops' and you've emailed a password or even the whole collection of passwords somewhere it should not have been sent.

From a protocol point of view IMAP is close to a folder structure synchronised across locations. It's purpose is to serve email but it is possible to use it for other purposes, yes. It is possible to make an actual password manager that utilises IMAP as a storage / transfer protocol. Draft emails are not that implementation.

GPG is one of the best general purpose encryption tools there are. I use it every single day. That doesn't mean use of GPG magically makes something a good idea.

If you are intent on using your own manual management for passwords you can do it just as well outside the email client. You can use GPG for encryption and any number of solutions for synchronisation such as 'vcsh' over 'git' or something.

There are advantages to password managers that simply can't be had with the manual method:

• Strong password generation.
• Automatic single-purpose / single-site passwords.
• Site matching and auto-login
• Auto-fill outside browsers for some managers

• Synchronisation of password database*

  • *Meaning in a way that is secure and appropriate. I would not advocate for some cloud service but instead local storage and syncing in a secure manner that you can control such as direct local network / WIFI sync.

The gitlab issue is not available anymore. Have you given up on this?

No, I didn't give up but things are moving slowly. Some of the patches have been accepted upstream already but not all yet.

Ok, thanks. So one may still hope, that's a good sign.

How can one install the PGP suport from the command-line?

@ahappyhuman, thanks for being interesting in this. @Jaymzz is preparing a blog post to explain the technicalities. In essence, you have to install the following package : jolla-email-crypto-gnupg from official repositories.

a very good idea!

this solution is mediocre at best, in my experience on regular android devices i had to copy the text to apg to decrypt it and read it there. k9 would crash otherwise. also s/mime isnt supported. and the way attachments are handled is meh (not encrypted).

There is a better solution via Android now: R2Mail2. However, the full version app costs 5,5 € in the Google Play store, and you have to use this trick to get the license app installed. Name the license app at.rundquadrat.android.r2mail2license-1.apk. The good news is that Inline PGP and PGP/MIME work well (probably S/MIME too, but I haven't tested), and it is able to correctly map Sent, Drafts and Trash to the respective IMAP folders. It claims to support IMAP Idle (push email), though I haven't had time to test fully. Normal and draft mail can be encrypted and read both in R2Mail2 and in Thunderbird/Enigmail.

00prometheus: using a proprietary app for encrypted mail? nope thanks. K9mail works fine nowadays and pgp/mime support is on the way, still i would prefer if the jolla mail client would support it

Hi! I have a question to those who use k9: can I get k9 to notify me about incoming mails? The account is connected with IMAP. I use open key chain with it and it works fine. But it doesn't tell me when a new mail comes in :-(

Solved: it works with “Android notifications”, see http://www.jollausers.com/2015/02/sound-led-and-haptic-feedback-for-android-notifications/

Yes, I just came back from translate.sailfishos.org for missing italian translations and was pleasantly surprised by the new strings.

@hobarrera Shouldn't this be a comment instead of an answer?

It should be possible to use the Android gpg stuff (eg OpenKeyChain or APG) but there's an issue in AlienDalvik that prevents importing of pre-existing key files. If you try and select the importing option, the dialog only sees image files and won't recognise key files. I was going to add that as a bug report, but I'm thinking it may get flagged as a partial duplicate of this question?

No plans for this atm.

That's a pity.

I agree, looks like a app I (we) really need...

I already asked chrm on TMO but he's got no ressources to do a port :-( - it works perfect on my N9 - if anyone has the skills to port it ...