Signature's e-mail should be cross-checked with sender's address
OpenPGP addon for Mozilla Thunderbird
Brought to you by:
pbrunschwig
Menu
▾
▴
#267 Signature's e-mail should be cross-checked with sender's address
wont-fix
nobody
None
1.6.0
Enhancement
24.4.0
2.0.22
All
---
nobody
2015-01-31
2014-04-02
No
Enigmail always displays info about the key of a good signature. However, it does not display a warning when the signature's key's e-mail address is different from the e-mail's "From" address.
Enigmail does display the name and email address of the signing key. I think it's up to the user to check if that was the sender's email.
I just want to say that as an Engimail user, it is NOT obvious that verifing the sender is the same as the signer is the responsibility of the end user. I think most end users would also expect Engimail to already do this. Therefore, I think you should treat this as a major bug and not an enhancement.
I know a couple of people sending emails from another email address than the one(s) of their signing keys. Therefore I suggest the warning shouldn't be "too red", as it may well be intended behavior.
However, coming from #377, that issue would probably be visible to more users, if this feature request was implemented...
We decided in the Enigmail team that we won't fix this. This feature is very often used intentionally without trying to spoof anything.