Encryption failures fixed in popular PGP email security tool Enigmail

Users of Enigmail 1.7 are advised to upgrade to version 1.7.2 as soon as possible

Developers of the popular Enigmail email security extension for Thunderbird have fixed several issues that could have exposed messages users believed to be encrypted.

Enigmail provides a graphical user interface in the Mozilla Thunderbird and SeaMonkey programs that allows users to digitally sign and encrypt email messages using the OpenPGP standard.

The Enigmail Project released version 1.7.2 of the extension on Aug. 29 and briefly noted that the release fixes "several important bugs." The changelog did not contain additional details about the impact of the fixed issues, but included a link to the project's external bug tracker.

In addition to several non-security issues, the bug tracker lists a number of addressed bugs that could have serious security implications for users of the older Enigmail 1.7 version. One of them causes emails to be sent in unencrypted form when only BCC (blind carbon copy) recipients are specified.

Another issue causes drafts to be saved in plain text when writing a new email even when the email is marked for encryption automatically. If the IMAP protocol is used, the unencrypted drafts can be synchronized with the email server, exposing potentially sensitive information.

This behavior only happens when the system selects an email for encryption automatically based on an existing per-recipient rule or when the recipient's public key exists in the local key store. "If the email is manually marked to be encrypted (e.g. by clicking the yellow key symbol on the bottom-right) the drafts are correctly encrypted before being sent to the IMAP server," the bug entry notes.

Another bug can cause an incorrect encryption or signing status message to be displayed when composing a reply. "This especially happens if the compose window is not opened for the first time," another entry on the bug tracker notes.

A fourth issue that has been addressed can cause an upgrade from Enigmail 1.6 to 1.7 to break encryption. Email messages won't be encrypted if the "per recipient" setting is disabled under Key Selection, despite other key selection mechanisms like "by email" and "manual if missing" being enabled.

"When confirmation dialog is enabled you can even see that Enigmail wants to send an email unsigned/unencrypted despite having selected forced encryption," the corresponding bug entry says. "Otherwise it is silently sent unencrypted."

An Enigmail user who reported one of the encryption failures in version 1.7 on the project's support forum described the situation as "the biggest imaginable catastrophe."

"I am currently preparing a crypto class for journalists next week to teach them how to use safe email," the user wrote. "HOW am I going to explain that? A system tells the user in a separate window as well as in a menu line that everything will be encrypted but then it simply FORGOT to ENCRYPT and, ooops, their report will be intercepted and their source will be tortured?"

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags The Enigmail Projectsecurityencryptiondata protectionprivacy

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?