Well yes this is why I’m asking. My JP26 is also running it, and I can’t find anything related to en/decryption in the mail app, even though a dev said it would be included. Surely we’re missing something here.
I implemented the decryption, and it was working for the test emails I tried it on. As @ohnonot mentioned, you need to install the jolla-email-crypto-gnupg which will pull the rest of the required packages.
Then, emails are flagged on reception as signed or encrypted. This flag is cached. As far as I remember, previously received emails will thus not be treated properly. Only the newly received ones.
With all the packages installed, if newly encrypted emails does not show a lock in the email list in the application and does not trigger a passphrase dialog to decrypt the email, then there is a bug. Send me a PM so we can look at it, or write a bug report in the forum.
I’m also aware of the venerable age of the GnuPG stack in SailfishOS. Upgrading it is not an option at the moment, for licencing policy of Jolla. @nephros mentioned RNP as a possible replacement. I’m investigating it.
3 Likes
I see, thanks for you work.
However in that case I actually recommend people with the need to vide code one for themselves. It really only takes an hour to match most the functionality of jolla mail (as the tricky heavy lifting is already open source).
Personally I use ECC for my key and I think the native gpg does not support. setting aside security.
I dm’ed @dcaliste about the issue and they confirmed it was actually a bug that should be fixed in the next release. In the meantime, they suggested this workaround:
In the meantime, if you want to get the decryption running in the email application, and you feel ok with editing files, you can correct the
/usr/share/jolla-email/pages/DecryptItem.qmlfile: remove all occurrences ofemail.canDecrypt(more precisely, change the boolean expressions where they appear, considering thatemail.canDecryptevaluates totrue).
No need to create your own mail app, when you can help make the existing one better.
For reference, the full setup is:
Install jolla-email-crypto-gnupg.
Import your pgp private key with gpg2 –import key.pgp (it’s not possible to import pgp keys from the keys settings menu).
Do the above fix.
The mail app should now show a decrypt option above encrypted mails.
If I understand correctly there is legal issue preventing the jolla-email-crypto-gnupg to be updated. I am not entirely sure what we can do to help make existing one better.
Vulnerable encryption is worse than no encryption in most network threat models, because their traffic will standout over others and easier to be detected.
The installed gnupg version has no effect on traffic that anyone else can detect. It’s only used for decrypting after all, and the protocol itself is not vulnerable. The real risk would be if the person doing the encrypting were using a vulnerable version.
I think the only real risk of using a potentially vulnerable gnupg version to decrypt, is that someone could manage to send back different text than was actually in the file.
Your actual emails are still encrypted securely regardless.
Is there now a solution for setting up mailbox.org ???
I can’t set it up. Other email work. My old Xperia 10 III works just fine with mailbox, my friends new one doesn’t set it up. ( but it did work some weeks ago).
On mine, where it’s working, I cannot set up another mailbox.org account. Same “account needs update” issue.
Any help?
I am using Thunderbird in Android and it works.
I am using mailbox.org on my xa2 (Version: 5.1.0.11) and recently used the same settings to setup the mail account on my J26 (Version: 5.2.0.17) without any problems. Server Settings: ssl port 993 imap 465 for ssl smtp. username for incomming mails: username@mailbox.org // username for outgoing mails: username@mailbox.org (authentification necessary). Passwords was my usual login password - I did not setup any app specific passwords and no 2FA.
My mailbox account has no special security settings. The page for encryption states: “PGP im Webmailer“→ “Einfach und intuitiv mit dem Guard“ activated.
“Verschlüsselter Versand”→ deactivated
I’m on sfos version 5.1 you are on ?
Indeed, creating a new account with mailbox.org on 5.1 is broken.
It’s mainly my fault, but a bit also from mailbox… When connecting to their POP or IMAP servers, the server advertises the capability to connect with XOAUTH2 authentication method, while it’s actually not implemented on their side.
I’ve hardened a bit the detection of the authentication method, but the fix is in 5.2… If you want to have it working in 5.1, you need to modify a QML file:
Apply the following changes to /usr/share/accounts/ui/email.qml:
diff --git a/ui/email.qml b/ui/email.qml
index fe51229..379e4b9 100644
--- a/ui/email.qml
+++ b/ui/email.qml
@@ -89,6 +89,7 @@ AccountCreationAgent {
setConfig("imap4/downloadAttachments", 0)
setConfig("imap4/servicetype", "source")
setConfig("imap4/acceptUntrustedCertificates", settings.acceptUntrustedCertificates ? 1 : 0)
+ setConfig("imap4/authentication", '2') // Prefers PLAIN mechanism
} else {
setConfig("incomingServerType", 1)
setConfig("customFields/showMoreMails", "false")
@@ -99,6 +100,7 @@ AccountCreationAgent {
setConfig("pop3/servicetype", "source")
setConfig("pop3/autoDownload", 1)
setConfig("pop3/acceptUntrustedCertificates", settings.acceptUntrustedCertificates ? 1 : 0)
+ setConfig("pop3/authentication", '2')
}
setConfig("smtp/smtpusername", settings.outgoingUsername)
@@ -116,6 +118,7 @@ AccountCreationAgent {
setConfig("smtp/authFromCapabilities", settings.outgoingRequiresAuth ? 1 : 0)
setConfig("smtp/servicetype", "sink")
setConfig("smtp/acceptUntrustedCertificates", settings.acceptUntrustedCertificates ? 1 : 0)
+ setConfig("smtp/authentication", '2')
//required to test configuration
checkCredentials = true
5 Likes
wow, thank you, but I don’t think I can do that… is it possible to create a patch in patchmanager for this situation ?
but maybe I’ll try your “Hack” thanks.
In case something goes wrong when editing the file, you can still reinstall the package that contains it with :
devel-su pkcon install --allow-reinstall jolla-settings-accounts-extensions-email
1 Like
I installed my mailbox.org account last week on 5.2 without much trouble (just entering the password).
I was able to receive emails, but when trying to send a mail yesterday I was prompted to re-register my account.
Entering the password did not change the error message, but deleting the account and then adding it once more did.
Since then, sending and receiving works.
Okay, this works for me, but It is asking me for the passphrase everytime.
I created the file “gpg-agent.conf” in “~/.gnupg” with
default-cache-ttl 86400
max-cache-ttl 86400
But it changes nothing. What should I do?
Thanks
Hmm for me it only asked the password once, now it’s only a confirm popup once the first time I open the mail app after a reboot. I didn’t change any settings, I don’t have a gpg-agent.conf at all, so I’m not sure why it’s different.
There is a setting stored in /desktop/sailfish/secrets/storeGnuPGPassphrases that tells the passphrase entry dialog to cache or not in an encrypted data base the passphrase.
Use dconf read /desktop/sailfish/secrets/storeGnuPGPassphrases to know the value. If unset, the default value taken by the dialog is true. If you want to change it, use dconf write /desktop/sailfish/secrets/storeGnuPGPassphrases true and dconf reset /desktop/sailfish/secrets/storeGnuPGPassphrases to, well, reset it.
The passphrase is cached, by its ID, in an encrypted collection named GnuPG from the org.sailfishos.secrets.plugin.encryptedstorage.sqlcipher plugin. See secrets-tool command-line tool from sailfishsecrets-tool package. Once cached, you can remove your passphrase from this database using secrets-tool --delete-key org.sailfishos.secrets.plugin.encryptedstorage.sqlcipher GnuPG *cacheID*.