Future OpenPGP Support in Thunderbird

[André Colomb]

Hi Patrick, 

>The Thunderbird developers and I have therefore agreed that it's much
>better to implement OpenPGP support directly in Thunderbird. The set of
>functionalities will be different than what Enigmail offers, and at
>least initially likely be less feature-rich. But in my eyes, this is by
>far outweighed by the fact that OpenPGP will be part of Thunderbird and
>no add-on and no third-party tool will be required.

Great news overall and thanks for the announcement. Thunderbird with direct OpenPGP integration has long been overdue IMHO.

So according to the wiki page [1] I understand that the secret keys will be managed by Thunderbird. That is quite a limitation I think, in contrast to reusing a GPG agent of some sort. Depending on the chosen alternative, it might offer better OS integration, a long time proven secure process architecture, possible reuse with only one central key store and most of all integration with hardware tokens. I personally would not entrust my private keys to a mail application that also displays HTML and possibly executes JavaScript etc. after what we have seen with Efail for example.

So could you please elaborate or extend the wiki page to clear up how hardware tokens fit into the new picture?

Thanks and kind regards. 
André

[1]: https://wiki.mozilla.org/Thunderbird:OpenPGP:2020
--
Greetings...
From: Andre Colomb <acolomb at schickhardt.org>