Re: Emacs/Mutt and Efail or OpenPGP is safer than S/MIME?

[Andreas Schwab]

On Mai 16 2018, Eli Zaretskii <address@hidden> wrote:

>> From: Andreas Schwab <address@hidden>
>> Cc: address@hidden,  address@hidden,  address@hidden
>> Date: Wed, 16 May 2018 19:15:09 +0200
>> 
>> On Mai 16 2018, Eli Zaretskii <address@hidden> wrote:
>> 
>> > E.g., Rmail renders HTML messages, but doesn't access external URL
>> > references, it creates a button out of each reference that the user
>> > needs to activate to cause Emacs to fetch the URL.
>> 
>> There is a difference between anchors that form links to other pages,
>> and elements like images that are part of the contents, but use external
>> references (instead of using data that is part of the message).  In
>> order to render the latter the external reference must be fetched.
>
> I agree that there's a difference, but a good MUA should treat them
> the same, and only download images after the user confirms.

There are other elements like style sheets that are needed for rendering
the whole message.  The point is that the rendering engine needs to
support such security measures in the first place.

> (And private/secret correspondence shouldn't include such external
> references in the first place, IMHO.)

Sadly, most people don't care enough.

Andreas.

-- 
Andreas Schwab, address@hidden
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."