pinentry's new window titles could be more (less?) informative

[Lukas Pitschl | GPGTools]

I would like to add here, that while I agree with Robert, that most users probably
ignore the dialog and simply enter the passphrase, I also believe that what Peter says
does make a lot of sense.

We would really love to see a more descriptive pinentry and have been planning in
the past, to add some context to it, based on the application it is used in.

For example, if I’m about to decrypt a message, switch to a different window and
a pinentry passphrase request comes up, I would like to see the purpose of it clearly explained.

Example:
Please enter passphrase to decrypt message „SUBJECT“ from „FROM"

In addition it should be possible to display the icon of the application requiring access to your secret key.

I also agree with Peter here that this is much more about providing the necessary context
for a passphrase request, rather than being a security feature.

Best,

Lukas
GPGTools

> Am 28.09.2017 um 20:42 schrieb Peter Lebbing <peter at digitalbrains.com>:
> 
> On 28/09/17 20:03, Robert J. Hansen wrote:
>> He turned it into a Firefox plugin that
>> would put a red warning banner at the top of the browser if you were
>> apparently being phished.
> 
> I remember you telling this before, it's a really neat study that gives
> good insights.
> 
> But I'm not convinced it can be transferred to this situation. Yes,
> people ignore large parts of their browser screen; in fact, I'm willing
> to bet this goes for a lot of windows, according to my n=1 usability
> study that is my personal experience. It goes especially for browsers,
> though, with all the useless cruft on websites. Navigational bars, by
> the way, can also be ignored until one needs to navigate a site. If I
> just followed a search engine hit to an interesting article, I don't
> care about anything around that article no matter how useful it might be
> in different circumstances. I automatically pay it no mind at all.
> 
> I don't think this pinentry feature will help identify an unwanted
> pinentry request when in fact the user is not surprised by being
> prompted for their key. They'll just think "ah, okay then" and type it
> in. I know I would seven times out of ten, and then I'm being nice to
> myself.
> 
> However, I think it's about when a user /didn't/ expect the pinentry,
> and is wondering where it came from. People have occasionally come on
> gnupg-users asking "why does my system keep asking me for my $#&%
> key?!", and then it, for instance, turned out they had forgotten they
> allowed their desktop environment's keyring manager to use GnuPG to
> encrypt their keyring. If the pinentry would have just indicated
> "gnome-keyring" (I'm not saying gnome-keyring supports this, it's just
> an example), they wouldn't have been bewildered and worried their system
> was doing bad stuff.
> 
> Basically, I don't think it's a security feature to catch malicious
> activity, like the phishing. It's just informational, which can be quite
> nice, having some information, knowing what's going on. It's there when
> you _look_ for it.
> 
> My 2 cents,
> 
> Peter.
> 
> --
> I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
> You can send me encrypted mail if you want some privacy.
> My key is available at <http://digitalbrains.com/2012/openpgp-key-peter>
> 
> _______________________________________________
> Gnupg-devel mailing list
> Gnupg-devel at gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnupg-devel

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: </pipermail/attachments/20170928/53919623/attachment-0001.sig>