18200 - Messenger does not detect signed messages.

Status: VERIFIED INVALID

(MailNews Core :: MIME, defect, P3)

Description

[Kevin Berkheiser]

Messanger does not give any indication that a message it receives is signed.

Comment 1

[rhp (gone)]

Phil,
How are we handling these types of security related issues in the bug system?

- rhp

Comment 2

[Phil Peterson]

For mozilla, it's enough to just show the message, and ignore any signature
parts. So, unless we mangle the message somehow, I'd mark this invalid since it
describes a feature mozilla doesn't have.

There are people working on S/MIME and PGP, but it will be some time before I
expect to see any code from either group.

Comment 3

[rhp (gone)]

Following Phil's cue.

Comment 4

[Phil Peterson]

Rich, I realized I didn't answer your initial question directly:

US export law prohibits us from having *encryption* code in the public
code base. However, *signing* code can live in the public code base, assuming no
other legal/licensing problems.

Comment 5

[rhp (gone)]

Sorry...misunderstood last comment...this won't be something we handle with
Mozilla and the group that will is many months out.

- rhp

Comment 6

[lchiang]

To QA: when verifying this bug, just view a signed message in 5.0 to make sure
that the msg looks properly and does as Phil states in the comments.

Comment 7

[lchiang]

Verified with 1999-11-15-21-m11 Win32 build.  Signed message received in 5.0
does not show the signature icon.  Verified that the text comes through fine in
the body of the message.

Side note:  For encrypted messages, the body of the message is blank.  What
would happen if someone had my public key and sent me an encrypted message? This
person doesn't know I'm using 5.0.  And, I won't know it's encrypted. I'll just
get a message without any content.  Is there any way to let the user know what's
going on?

Comment 8

[Phil Peterson]

Filed bug 19064 to cover user feedback for messages we can't render