Question for app developers, like Enigmail etc. - Identicons

[Stefan Claas]

On 12.06.17 16:31, Peter Lebbing wrote:
> I hadn't gotten round to answer your earlier questions yet, since I
> noticed a point I should first spend some effort and thinking on.
>
> On 12/06/17 16:14, Stefan Claas wrote:
>> And a question for this... If Mallory would get
>> somehow access to my Computer and replace one pub key from my
>> communication partners with a fake one and sets the trust level to
>> Ultimate. How can i detect this, if i'm not always looking at the
>> complete Fingerprint and compare it with a separate list?
> It is impossible to use any form of cryptography in a secure fashion
> when somebody is in a position to mess with the computer you're using it
> on. Worst is someone with administrator privileges, but somebody with
> the same privileges as you is already more than enough to completely
> subvert your security.
>
> They could alter your search path and put their own binaries in them.
> Any program you launch, be it GnuPG, your e-mail client, your shell, or
> any other program you use, could be replaced by something else. Same for
> your data files, as you point out.
>
> Your user account needs to be secure from evildoers. It depends on your
> threat model how you go about this.

I agree with you and it makes perfect sense, but then it would raise
another question. How should an average user of GnuPG, like me,
then handle this. I mean what you just said is not mentioned in
GnuPG tutorials and you can't expect that every GnuPG is trained
on that subject as well.

Would it then not be good if Enigmail, for the casual user, would
display a different color than green, for the explained scenario?

Regards
Stefan