28975 - Add preference to turn off auto-add of S/MIME senders' certs

Status: NEW

(MailNews Core :: Security: S/MIME, enhancement, P5)

Description

[Frank Hecker]

Today when a user receives an S/MIME signed message the certificate of the
sender is auto-added to the user's personal certificate database. Some users may
prefer that this not be done (just as some might object to auto-adding senders'
email address to their personal address book).

Thus I believe there should be a preference to allow users to turn off
auto-adding of senders' certificates.  This preference might be absolute (never
auto-add) or allow some flexibility (e.g., don't auto-add when reading signed
messages in a newsgroup, but do so for email messages).

If the preference is off (no auto-add) then there should be an alternate way to
get a sender's certificate into the database; for example, this could be done by
clicking on the "signed" icon and following a particular procedure. (Actually,
this may already be implemented -- I haven't checked.)

I believe that for ease of use by novice users the default preference should be
on, i.e., to auto-add by default. This makes it easier for people to get started
sending encrypted messages because they won't have to go through a separate
certificate lookup step if the sender has already sent them a signed message.

Comment 1

[Lisa Repka]

This is actually a PSM enhancement; NSS already provides an API that
lets the caller say whether or not to save the certificates when
verifying a signature.  PSM would have to provide the UI and the
management of the associated preference(s) and then pass the appropriate
boolean value when calling NSS to do the signature verification.

So, I was attempting to change the product from NSS to PSM, but
apparently I am not allowed to do that.  Instead, this comment will
have to suffice until lord gets around to reading it and can move
it himself.  (Presumably he has permission? ;-)

Comment 2

[Jerry Baker]

I haven't tried it yet, but at least Mozilla should not give us any problems if 
we make the cert database read-only. I do not, and will not, use S/MIME since I 
do not believe in its trust model. I would like to disable it altogether. NC 4.x 
gives all kinds of trouble if you make cert7.db read-only. At least let Mozilla 
not do this.

Comment 3

[Ben Bucksch (:BenB)]

repka, ask a module owner for to get the permission.

Comment 4

[Bob Lord]

This is also part of a larger goal of separating information about trust (CAs, 
trusted web sites), my personal certs/keys, and the s/mime cache.

Comment 5

[Lisa Repka]

Perhaps it is part of that larger goal, but I'd prefer to write up that
stuff as a separate "bug", if that is desired, and not try to lump it
all into here.  This is a pretty specific request, and one which could
be implemented without too much trouble as things are today, *without*
a lot of change in underlying infrastructure.  Even in the future world
we will want to do auto-saves of certs, and some people will not want
to do that, so it seems like a valid standalone request to me.

Adding cert-related folks to the cc list due to the controversy.

Comment 6

[Dawn Endico]

I just edited repka's bugzilla account so she can now freely edit bugs.
I'll let repka move the bug just to make sure it works.

Comment 7

[Bob Lord]

Assigning to chrisk, and moving to PSM based on Lisa's comments.

Comment 8

[John Unruh]

Changing QA contact to nitinp

Comment 9

[Bob Lord]

Setting target to 2.1.

Comment 10

[Stephane Saux]

Moving to future. Since S/MIME is not part of 2.1, there's little need for this.
removing nsenterprise keyword.

Comment 11

[John Unruh]

Mass assigning QA to ckritzer.

Comment 12

[Tom Mraz]

This one should get some attention as the S/MIME is in mozilla trunk now.

Comment 13

[Kai Engert (:KaiE:)]

Adding this pref would not be sufficient. Once you add that, you also need a way
to manually import a cert (from a message etc.), to enable the user to compose
an encrypted message to somebody.

Comment 14

[John Unruh]

*** Bug 171434 has been marked as a duplicate of this bug. ***

Comment 15

[Kai Engert (:KaiE:)]

There is already a global pref, whether to add email addresses to address book
or not. I suggest we could re-use the same pref for the decision, whether S/Mime
certs from incoming or outgoing mail messages are stored or not.

Comment 16

[Ben Bucksch (:BenB)]

I don't think that this is a good idea. A user might want to get the email
addresses added, but carefully examine the certs.

Comment 17

[John Unruh]

QA>Charles

Comment 18

[timeless]

jglick: can you please spec a way for users to manually add sender's certs?