1998102 - Consider adding hkps://mail-api.proton.me to the default key server list

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, enhancement)

Description

[Magnus Melin [:mkmelin]]

See https://proton.me/blog/address-verification-pgp-support

We should consider adding hkps://mail-api.proton.me to the default keyserver list

Comment 1

[Magnus Melin [:mkmelin]]

Attachment: Bug 1998102 - Add hkps://mail-api.proton.me to the default key server list. r=kaie

Comment 2

[Kai Engert [:KaiE:]]

I think this is unnecessary, because Proton also hosts their keys on WKD, and we already query WKD.

Can you please check? Even without your patch, Thunderbird should already be able to find keys for proton mail users.

Comment 3

[Magnus Melin [:mkmelin]]

Well, duplication of key source is not necessarily bad. There are some benefits:

• "Refresh Online" doesn't use WKD, so refreshing for a Proton user won't work atm. xref bug 1735033.
• you get multiple sources (for upcoming confidence work)
• for future "trust keyserver" that's not possible if I have to trust WKD, which would seem somewhat less safe

Actually seems our wkd for proton isn't really what it should be either... https://searchfox.org/comm-central/rev/99bc428ec6be3c5bad4b5986765655ecf5bc1e47/mail/extensions/openpgp/content/modules/wkdLookup.sys.mjs#305-324

Comment 4

[Kai Engert [:KaiE:]]

Besides bug 2047358 the new implementation works with all the example email addresses that I have tested.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/ffae2ca378aa
Add hkps://mail-api.proton.me to the default key server list. r=kaie

Comment 6

[Martin Giger [:freaktechnik]]

Is this relnote worthy? Or does the WKD stuff already mostly cover protonmail for recipients without custom domain?

Comment 7

[Kai Engert [:KaiE:]]

Attachment: Bug 1998102 - Follow up to fix keyserver test. r=#thunderbird-reviewers

Comment 8

[Kai Engert [:KaiE:]]

reopen to fix tests

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/d2a4124c10b6
Follow up to fix keyserver test. r=mkmelin

Comment 10

[Magnus Melin [:mkmelin]]

Release Note Request (optional, but appreciated)
[Why is this notable]: Better interoperability with Proton mail users.
[Suggested wording]: Added the Proton Mail key server to the default keyserver list. Refreshing the key of a Proton Mail user will now work. We also removed an old, related workaround from before Proton had WKD support. As a consequence, keys for Proton hosted domains can now be found by Thunderbird using WKD.