Security bug in mail plugins

[Nicholas Cole]

I've discovered (I'm sure I'm not the first) a bug in
the gpgmail plugin, which integrates gpg with mail.app
on OS X.  If part of a message is a signed gpg/mime
message, the user is shown a display which gives an
impression that there is a valid signature for all of
the message and no warning that part of the message is
not signed. 

Mutt in similar circumstances appears to show only the
signed part, although the non-signed part can be seen
using "view attachments" (at least on my setup. 
Enigmail/Thunderbird, in the test I did, which was
simply to attach an entire signed message (using mutt)
to a new message, did not attempt to verify the
signature at all.

How do other mail clients deal with this issue?  And
what is the correct approach?  Is there anything that
can be done at the gpgme level to deal with this kind
of problem, or is it (as I assume) all down to the
plugin implementation to test for such cases?

Best wishes,

N.


	
	
		
___________________________________________________________ 
All new Yahoo! Mail "The new Interface is stunning in its simplicity and ease of use." - PC Magazine 
http://uk.docs.yahoo.com/nowyoucan.html