Thunderbird, Enigmail and OpenPGP

Today the Thunderbird project is happy to announce that for the future Thunderbird 78 release, planned for summer 2020, we will add built-in functionality for email encryption and digital signatures using the OpenPGP standard. This new functionality will replace the Enigmail add-on, which will continue to be supported until Thunderbird 68 end of life, in the Fall of 2020.

For some background on encrypted email in Thunderbird: Two popular technologies exist that add support for end-to-end encryption and digital signatures to email. Thunderbird has been offering built-in support for S/MIME for many years and will continue to do so.

The Enigmail Add-on has made it possible to use Thunderbird with external GnuPG software for OpenPGP messaging. Because the types of add-ons supported in Thunderbird will change with version 78, the current Thunderbird 68.x branch (maintained until Fall 2020) will be the last that can be used with Enigmail.

For users of Enigmail, Thunderbird 78 will offer assistance to migrate existing keys and settings. We are happy that Patrick Brunschwig, the long-time developer of Enigmail, has offered to work with the Thunderbird team on OpenPGP going forward. About this change, Patrick had this to say:

“It has always been my goal to have OpenPGP support included in the core Thunderbird product. Even though it will mark an end to a long story, after working on Enigmail for 17 years, I’m very happy with this outcome.”

Users who haven’t used Enigmail previously will need to opt in to use OpenPGP messaging, as encryption will not be enabled automatically. However, Thunderbird 78 will help users discover the new functionality.

To promote secure communication, Thunderbird 78 will encourage the user to perform ownership confirmation of keys used by correspondents, notify the user if the correspondent’s keys change unexpectedly, and, if there is an issue, offer assistance to resolve the situation.

It’s undecided whether Thunderbird 78 will support the indirect key ownership confirmations used in the Web of Trust (WoT) model, or to what extent. However, sharing of key ownership confirmations made by the user (key signatures), and interaction with OpenPGP key servers shall be possible.

If you have an interest in seeing more detailed plans on what is in store for OpenPGP in Thunderbird, check out our wiki page with more information.

22 responses

  1. Wiktor wrote on :

    Wow, this is great! Thunderbird has a huge market share among my contacts but the current Enigmail setup that requires GnuPG is a non-starter.

    The attached wiki page also looks very solid. Is there a mailing list or contact where one could comment on specific points?

    Thanks for making this happen!

    1. Ryan Sipes wrote on :

      Hey Wiktor, thanks for the positive feedback! We’re having a discussion on our mailing list tb-planning. Feel free to join in the discussion! We discuss all ideas for the future of Thunderbird there.

  2. Stefan Claas wrote on :

    This is great news! Please consider, for future generations of OpenPGP users, whatever trust model(s) you will implement, to honor, same as S/MIME does in Thunderbird, CA[1] signatures on owners public key blocks. I.e. please add to your key store also an option for the CA keys from Governikus, CAcert.org, and Heise. This would be IMHO a very good signal so that more CAs for OpenPGP protocol key usage can show up globally and people will have more trust in someone else’s public key block or digital signature, which the outdated and old WoT can never guarantee.

  3. Legume wrote on :

    There are so many other addons in the sea like fish that would benefit from being part of TB in its core.
    They are also in danger of being broken for good once the webextensions are mandatory.
    Have you considered absorbing other addons into mainline core TB as well or only the encryption stuff that very few people actually need?

    1. Ryan Sipes wrote on :

      Hey Legume,
      This is a great question. We have explored pulling many of the most popular add-on functionality into Thunderbird core. We’ll have a roadmap detailing what we’d like to pull in soon!

  4. Christian Nordmann wrote on :

    Hi,

    are there any plans or considerations to support OpenPGP-Smartcards?

    Obviously only the public keys are available for import in Thunderbird’s
    implementation of PGP as the private keys are stored on the smartcard.

    And as for all smartcard-based crypto those keys are not retrievable for
    use elsewhere.

    With regards,

    Christian

    1. Steven Falco wrote on :

      I currently use Enigmail with a Yubikey. So a smartcard interface is mandatory for me.

    2. Exception wrote on :

      I would also very much like to know the answer to that question.

      If OpenPGP smartcards are not supported I will unfortunately have to switch another mail client altogether.

  5. egrg5yhh wrote on :

    Hm…
    enigmail are not good idea
    better way will be integrate gpg2 on thunderbird native (no change doc in chains thunderbird gpg2)

    gpg and enigmail no have ‘only for you eyes’

    many troubles with servers (very slow, only few servers in whole internet)

    some gpg2 have hole for put very big key

    ….. no today only terminal and gpg no thunderbird

  6. treeshateorcs wrote on :

    right about time!

  7. Eric Moore wrote on :

    Including it in the core makes sense. However, what does this mean for the work with “pretty Easy privacy”?

    Gmail’s End-to-End Encryption project appears to be dead. Tutanota, ProtonMail and MailFence claim to provide true OpenPGP end-to-end encryption. That’s more than just supporting OpenPGP. Is there any explicit goal of interoperability with them? I’m thinking of stuff like how web of trust is handled and whether there are the necessary hooks so that IMAP/SMTP glue such as the ProtonMail bridge could work.

    Is Thunderbird going to use a open source encryption library that has passed an independent security audit? One of the reasons why I ask is that several of them (such as OpenPGP.js) have licenses incompatible with MPL.

    Its tough finding free S/MIME certificates nowadays. Actalis seems to be the only source for one that will last a year, the rest seem to be 30 day trials. Is S/MIME’s future in Thunderbird mainly for corporate use?

  8. john jones wrote on :

    how are you going to verify a key servers address ? with MITM becoming a issue maybe this would help:
    https://bugzilla.mozilla.org/show_bug.cgi?id=179519

    thanks

    John Jones

    1. M wrote on :

      @john jones
      https://gitlab.com/CardBook/CardBook/issues/77

    2. Oskar wrote on :

      DNSSEC & DANE was something that already didn’t work out in Firefox which shares code with TB in large parts.
      Doubt we will get anywhere near that, although i hope we will.
      Especially if we import stuff like DNS-over-HTTPS into TB.

  9. Suel wrote on :

    Hi,

    I don’t see in the wiki any consideration about support of OpenPGP card (https://openpgpcard.org/#card ) like Gnuk ( https://www.fsij.org/category/gnuk.html) , Nitrokey , Yubikey and any consideration about algorithm curve25519 and it’s support (Autokey is not yet curve 25519 compatible).
    I would be a very important regression for security not to support OpenPGP cards ! (two factors authentication, what’s you get and what’s you know)

    For keys verification don’t forget to support DANE and Ldaps models.

    Best regards

  10. Ben Bucksch wrote on :

    This is fantastic! Thanks for getting PGP included, and for getting Patrick Brunschwig on board. He’s a great guy and very competent developer. I would like to thank Patrick for his awesome work over all the years!

    Security-wise, I am also happy to read the following: “To promote secure communication, Thunderbird 78 will encourage the user to perform ownership confirmation of keys used by correspondents, [and] notify the user if the correspondent’s keys change unexpectedly”

    These 2 things are crucial for secure communication. If the key is not validated, somebody could be sitting in the middle. Even more important is the key change notification. Without that, somebody could get into the middle, read all messages, and the user would not notice.

    This is missing in most “secure messaging” applications with so-called “crypto”, and without this key change notification, there is no trusted communication possible. Thank you that you took attention to such details.

  11. snipsnipsnip wrote on :

    Yay to the built-in PGP 🙂

    Can you add link to the [announcement on developer.thunderbird.net](https://developer.thunderbird.net/add-ons/tb78) somewhere for the convenience to the other add-on developers? It took some time to find that.

  12. Arndt wrote on :

    Because in the last 20 years the percentage of end2end encrypted emails is still maybe 0.01%, please keep key management simple. I think WoT is really not helpful.

    Before worrying about MITM attacks, You should worry about the 99.99% of mails being not end2end encrypted and can be subject to mass surveillance, because it’s too complicated for users.

    I think keys should be updated/installed automatically. Unconfirmed keys should clearly be marked as not trustworthy and the user encouraged to verify the key via second chanel (telephone, website etc.) and manuelly confirm the key, so it gets “green”.

    Every encryption is better than no encryption.

    The user should be made clear, that the end2end encryption of Thunderbird does not aim to be very secure, but to make interception very expensive.

    A user with high security demand should be made clear to encrypt his data on an offline computer without user application like TB, but on command line like gnupg CLI.

    Maybe, received encrypted emails should even be stored only decrypted, so they are searchable and there is no danger of losing the private keys and then cannot read the mails anymore. So encryption would only be for the transfer. In this case, too: Currently mails are stored unencrypted _and_ transfered unencrypted, so even if only transfer would be encrypted, that would be much much better than now.

    As You see, I support the idea of RFC7435 (“Opportunistic Security”) and Autocrypt (https://autocrypt.org)

    Best regards,

    Arndt

  13. Victor Coss wrote on :

    Will you keep support for WKD (Web Key Directory)? I really like this recent addition to Enigmail and love how when you type in an e-mail when composing it automatically pulls down the authoritative key when available. MUCH better than using any key server and how PGP should of been from day 1.

  14. Suel wrote on :

    Hi,

    Why don’t you want to use as before gnupg. It’s very hard to develop cryptographic libraries and it would be a good idea to reuse gnupg as Mailvelopp do with it’s gpgme.js library (https://github.com/mailvelope/gpgmejs)

    You can find their explanations here : https://www.mailvelope.com/en/blog / GnuPG Integration

    It would be a regression not to support OpenPGP card and people i would have to question themselves about to use Thunderbird without openpgp card support or to migrate to Mailveloppe with Openpgp card support !

    Best regards

  15. Suel wrote on :

    Hi,

    I don’t see in the wiki any consideration about support of OpenPGP card (https://openpgpcard.org/#card ) like Gnuk ( https://www.fsij.org/category/gnuk.html) , Nitrokey , Yubikey and any consideration about algorithm curve25519 and it’s support (Autokey is not yet curve 25519 compatible).
    I would be a very important regression for security not to support OpenPGP cards ! (two factors authentication, what’s you get and what’s you know)

    For keys verification don’t forget to support DANE and Ldaps models.

    Best regards

  16. Daniel G wrote on :

    I wonder if this will have support for https://autocrypt.org seems created their own extension https://github.com/autocrypt-thunderbird/autocrypt-thunderbird