#158 phrase "UNTRUSTED good signature" is dangerously misleading

[Ximin Luo]

Please see discussion at:

http://lists.gnupg.org/pipermail/gnupg-devel/2013-July/027793.html

The offending phrase is Enigmail-specific; it does not originate from GnuPG:

http://lists.gnupg.org/pipermail/gnupg-devel/2013-July/027799.html

Suggested phrasing improvement is "UNVALIDATED Good signature".

[Patrick Brunschwig]

I would vote for "unverified" good signature

[Ximin Luo]

I thought of that too, but it might be confusing since the operation on signatures are called sign/verify, and "good signature" means it was verified correctly, so "unverified good signature" seems weird, and overloads that term.

Another suggestion was "Good signature from UNVERIFIED key". But I prefer still "unvalidated" because that is consistent with PGP's terminology - "Validity is confidence that a public key certificate belongs to its purported owner" - and avoids overloading the term "verify".

[Daniel Kahn Gillmor]

On Sun 2018-02-11 16:08:10 +0000, Patrick Brunschwig wrote:

Enigmail no longer displays "UNTRUSTED" / "REVOKED KEY" / "EXPIRED
KEY". A signature is either valid or invalid. The color of the status
bar indicates if the key is still valid & trusted (green) or not
(cyan)

please do not require that a key be "trusted" in order for the message
signature to be green. Doing so encourages users to "trust" keys that
they receive mail from, but marking a key as "trusted" in GnuPG
indicates that you're willing to rely on identity certifications from
that key, which is the equivalent to marking an X.509 certificate as a
root CA.

 --dkg

[Patrick Brunschwig]

Enigmail no longer displays "UNTRUSTED" / "REVOKED KEY" / "EXPIRED KEY". A signature is either valid or invalid. The color of the status bar indicates if the key is still valid & trusted (green) or not (cyan)

[Patrick Brunschwig]

"Trusted" was meant in the sense of having signed the key (not owner trust).

[Daniel Kahn Gillmor]

ok, thanks for the clarification. Please do not use the term "trusted"
in enigmail to mean "valid", though. Doing so just encourages people to
mark the key as "trusted", because the terminology is the same, but the
effect is quite different. it's hard enough for most people to
understand what's going on as it is, and it only gets worse if their
tools reuse the same term for two different things. :/

      --dkg