Re: Feature suggestion. Indexing encrypted mail?

diff --git a/dc/ab1c5b965394db4d1747aac2e458a4cefec39a b/dc/ab1c5b965394db4d1747aac2e458a4cefec39a
new file mode 100644 (file)
index 0000000..5e22313
--- /dev/null
+++ b/dc/ab1c5b965394db4d1747aac2e458a4cefec39a
@@ -0,0 +1,94 @@
+Return-Path: <guyzmo@vilya.m0g.net>\r
+X-Original-To: notmuch@notmuchmail.org\r
+Delivered-To: notmuch@notmuchmail.org\r
+Received: from localhost (localhost [127.0.0.1])\r
+       by olra.theworths.org (Postfix) with ESMTP id 1E698431FBF\r
+       for <notmuch@notmuchmail.org>; Sun,  6 Apr 2014 02:17:12 -0700 (PDT)\r
+X-Virus-Scanned: Debian amavisd-new at olra.theworths.org\r
+X-Spam-Flag: NO\r
+X-Spam-Score: 1.775\r
+X-Spam-Level: *\r
+X-Spam-Status: No, score=1.775 tagged_above=-999 required=5\r
+       tests=[URIBL_BLACK=1.775] autolearn=disabled\r
+Received: from olra.theworths.org ([127.0.0.1])\r
+       by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024)\r
+       with ESMTP id qZdOscLZx9DN for <notmuch@notmuchmail.org>;\r
+       Sun,  6 Apr 2014 02:17:04 -0700 (PDT)\r
+Received: from mail.m0g.net (vilya.m0g.net [88.191.157.47])\r
+       by olra.theworths.org (Postfix) with ESMTP id 7CA37431FB6\r
+       for <notmuch@notmuchmail.org>; Sun,  6 Apr 2014 02:17:04 -0700 (PDT)\r
+Received: from localhost (localhost [127.0.0.1])\r
+       by mail.m0g.net (Postfix) with ESMTP id 88E8F3E08E7;\r
+       Sun,  6 Apr 2014 11:15:25 +0200 (CEST)\r
+X-Virus-Scanned: Debian amavisd-new at vilya.m0g.net\r
+Received: from mail.m0g.net ([127.0.0.1])\r
+       by localhost (sd-38500.dedibox.fr [127.0.0.1]) (amavisd-new, port 10024)\r
+       with ESMTP id U3SX+p5M-QyM; Sun,  6 Apr 2014 11:15:21 +0200 (CEST)\r
+Received: by mail.m0g.net (Postfix, from userid 1000)\r
+       id E41E93E24D6; Sun,  6 Apr 2014 11:15:20 +0200 (CEST)\r
+Date: Sun, 6 Apr 2014 11:15:16 +0200\r
+From: Guyzmo <guyzmo+notmuch@m0g.net>\r
+To: Jameson Graef Rollins <jrollins@finestructure.net>\r
+Subject: Re: Feature suggestion. Indexing encrypted mail?\r
+Message-ID: <20140406091516.GG26903@vilya.m0g.net>\r
+References: <86k3b3ybo6.fsf@someserver.somewhere>\r
+       <878urj1z3j.fsf@maritornes.cs.unb.ca>\r
+       <87txa7pp8z.fsf@servo.finestructure.net>\r
+MIME-Version: 1.0\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Disposition: inline\r
+Content-Transfer-Encoding: 8bit\r
+In-Reply-To: <87txa7pp8z.fsf@servo.finestructure.net>\r
+User-Agent: Mutt/1.5.22.1-rc1 (2013-10-16)\r
+Cc: notmuch@notmuchmail.org, Daniel Kahn Gillmor <dkg@debian.org>\r
+X-BeenThere: notmuch@notmuchmail.org\r
+X-Mailman-Version: 2.1.13\r
+Precedence: list\r
+List-Id: "Use and development of the notmuch mail system."\r
+       <notmuch.notmuchmail.org>\r
+List-Unsubscribe: <http://notmuchmail.org/mailman/options/notmuch>,\r
+       <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>\r
+List-Archive: <http://notmuchmail.org/pipermail/notmuch>\r
+List-Post: <mailto:notmuch@notmuchmail.org>\r
+List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>\r
+List-Subscribe: <http://notmuchmail.org/mailman/listinfo/notmuch>,\r
+       <mailto:notmuch-request@notmuchmail.org?subject=subscribe>\r
+X-List-Received-Date: Sun, 06 Apr 2014 09:17:12 -0000\r
+\r
+Hi!\r
+\r
+On Sat, Apr 05, 2014 at 12:09:32PM -0700, Jameson Graef Rollins wrote:\r
+> On Sat, Apr 05 2014, David Bremner <david@tethera.net> wrote:\r
+> > john.wyzer@gmx.de writes:\r
+> >> Would it be possible to add the configurable option to also decrypt\r
+> >> encrypted messages on the fly while indexing to make them searchable,\r
+> >> too?\r
+> > As far I understand an attacker could reconstruct the message from the\r
+> > index, so one question is whether the extra complexity in notmuch is\r
+> > worth the minimal extra security over decrypting on delivery and storing\r
+> > plaintext on the (presumably encrypted) disk. Of course decrypting on\r
+> > delivery may be inconvenient (or impossible). I have CCed the two people\r
+> > who have implemented most of the crypto related stuff in notmuch so they\r
+> > can comment.\r
+> Indexing encrypted email is a bit of a foot-gun, since, as David\r
+> mentions, it is apparently possible to reconstruct encrypted messages\r
+> From the index.  It therefore needs to be approached with care.\r
+> \r
+> I think decrypting on "delivery" (or mail fetch or whatever) sounds\r
+> difficult and unwieldy.  In either event, it seems out of the scope of\r
+> notmuch.  If a user figured out how to have that done, no changes to\r
+> notmuch would be needed afaict.\r
+[…]\r
+\r
+    I indeed agree with this view, and I think the best process would be\r
+to have the MUA decrypt and index an encrypted mail when the  user wants\r
+it to be indexed. So the user do not get really  highly  secret messages\r
+disclosable by the index, and for the others take that kind of risk.\r
+\r
+    That way you wouldn't need to keep the secret in  the  gpg-agent for\r
+too long, and/or need a password for an automated process.\r
+\r
+my two cents,\r
+\r
+-- \r
+Guyzmo\r