Hello,
note: this report contains screenshots - please use the web-interface, if they're not shown in your eMail setup.
After upgrading to enigmail 2.0, a warning on private keys pops up.
The text is cut off. After resizing, the full dialog is:
Here, thunderbird is showing a dialog about non-trusted private keys. Having created all keys by myself and not being aware of any compromise, I see these usability issues:
- The Level appears to be info (blue "i", no yellow "!"), although the message looks serious
- I don't see why these keys are classified as non-trusted. Are they compromised?
- Did upgrading enigmal screw sth. up? Were they trusted before?
- There's a checkbox for not showing the dialog anymore. If its safe, to check this box, why does it pop up in the first place? If its not safe to do so, why is it there? What's the security / privacy impact on checking this box?
- The box suggests to mark these keys as trustful. Why doesn't this happen automatically? What's the point for having the user's consent?
- The dialog recommends to set "verlassen Sie sich auf die Zertifikate", but there's no option / link / button to do so.
- The dialogs allows to open the key management dialog, but this appears to be a dead end. There's no "verlassen Sie sich auf die Zertifikate" button directly visible.
Trying to be constructive:
- If there's an actual issue with these keys, suggest revoking 'em. If not, showing that these keys cannot be trusted is misleading.
- In this dialog, the user has two options 1) establish trust, 2) hide the dialog forever. Novice users need some support in making this decision and in establishing trust if needed.
- If "verlassen Sie sich auf die Zertifikate" is a reasonable default, then a marked checkbox could support applying this. Here, the user should be informed on negative side-effects and harmful secenarios.
- As far as I understand, this info happens to due gpg having no owner trust level defined for these keys. The actual consequence is, that these keys cannot be used for designing and may be imported maliciously
HTH,
Greetz, yansz
