Memory Hole discussion / OpenPGP e-mail header protection

[Bjarni Runar Einarsson]

Hello!

Patrick Brunschwig <patrick at enigmail.net> wrote:
> > This allows for versioning and also binds the part to the message it
> > applies to, which was one of the questions raised in April.  I suspect
> > we'll want to rename from "memoryhole" to something less cool but more
> > descriptive sooner rather than later; "pgp-mime-headers" comes to mind?
> 
> The headers we protect are not PGP/MIME headers. I think something like
> "protected-headers" or "secure-headers" would be better.

I'm assuming this will be an extension to whatever RFCs discuss
PGP/MIME, which is why I used those words. In fact, if/when there is an
RFC for this, I'd vote for calling them rfc9999-headers. :-)


Patrick wrote on another thread:
> We should agree on certain specifics like how to display non-ASCII
> characters in the memory hole headers. I would vote against using RFC
> 2047, section 2 (e.g. =?UTF-8?blah?=), such that users can read the
> headers easily if their mailers would not yet understand memory hole.

I think I disagree. Although I applaud the sentiment (it's awesome that
we're considering usability here), my gut feeling is the headers should
be exactly like they are in the public header section. This will make
both the spec and the code to implement it much simpler, lowering the
bar to getting everyone to adopt this.

Showing the headers to the user at all is a backwards-compatibility hack
which should only be necessary for a relatively brief window in time, as
all the PGP plugins and mailers implement the new standard. Considering
how many folks we had in the room in April, I don't think I'm being
overly optimistic... :-)

Ideally once things are properly integrated, the visible duplicate
header section simply disappears and friendly green locks or checkmarks
appear in the MUA header display instead.

If users get annoyed by ugly extra header sections, maybe that will
encourage them to upgrade their tools.

Cheers!
 - Bjarni

-- 
Sent using Mailpile, Free Software from www.mailpile.is
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 213 bytes
Desc: OpenPGP Digital Signature
URL: </pipermail/attachments/20150628/89c84cf1/attachment-0001.sig>