Re: Automatically decrypt fetched PGP/Mime mail?

--===============1969734056959700503==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="+bHtJhyLn7P4Vxo3"
Content-Disposition: inline


--+bHtJhyLn7P4Vxo3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 25, 2024 at 11:10:31AM +0200, Carlos E. R. wrote:
> On 2024-06-25 03:55, q17nsisr--- via Fetchmail-users wrote:
> > Greetings fetchmail-users mailing list!!
> >=20
> > My mail fetching setup currently looks like this:
> > remote mail server <-> fetch <-> local maildir <-> local mail server <-=
> local e-mail client
> >=20
> > Where email on the remote mail server is pgp/mime encrypted with the su=
bject header hidden or replaced as supported by several of the email servic=
es listed below:
> > https://www.privacyguides.org/en/email/ - Encrypted Private Email Recom=
mendations - Privacy Guides
> > https://www.privacyguides.org/en/email-aliasing/ - Email Aliasing - Pri=
vacy Guides
> >=20
> > I would like to alter the "... <-> fetch <-> local maildir <-> ..." par=
t of my mail fetching setup so that the fetched email is automatically decr=
ypted during or after the fetching process and before this mail is seen by =
the local mail server or email client.
> > Does anyone on this mailing list have any advice or tips for doing this?
>=20
> Probably adding procmail and maybe formail.

SCNR, but I would really, really, really strongly recommend against using p=
rocmail
in the year 2024. Maildrop has a clear, easy to learn syntax, and it makes =
it much
harder to make a mistake writing a rule or to forget about any kind of unsp=
ecified
default behavior.

Also, I think the real issue here would be the fact that unattended decrypt=
ion
would mean that there is a copy of the OpenPGP key that is either stored so=
mewhere
unprotected (no passphrase), or is loaded into some kind of agent, again,
unprotected in memory. In either case this opens an avenue of attack for
Somebody(tm) to use that unprotected copy of the key, either for decrypting
other encrypted material they have obtained, or, if the key has multiple
capabilities, even for signing things.

Once that is dealt with (and "I don't care" is a way to deal with it, albeit
one that I would very strong discourage), there is also the interesting asp=
ect of
making sure that the decrypted messages do NOT go into the same maildir or
IMAP folder or whatever as any unencrypted messages received, because then
there would be no way to tell if a certain message was encrypted and decryp=
ted or
just looks like one. There is also an additional interesting aspect that
OpenPGP messages have more data in the OpenPGP structure, such as integrity
hashes, possibly a signature from the sender, etc, and some of that data may
be lost if only the decrypted copy is saved.

G'luck,
Peter

--=20
Peter Pentchev  [email protected] [email protected] [email protected]
PGP key:        https://www.ringlet.net/roam/roam.key.asc
Key fingerprint 2EE7 A7A5 17FC 124C F115  C354 651E EFB0 2527 DF13

--+bHtJhyLn7P4Vxo3
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEELuenpRf8EkzxFcNUZR7vsCUn3xMFAmZ6j+QACgkQZR7vsCUn
3xPzNRAAmIGhGdOQ1l1+O3EfA+vbZF7o/WONMoGTd/ShOVldPeCI+JyubXbcempE
bt0gcs6ee/EZ2KJydSBYuli26ZdZyFOTME/7rnh93S4XyaU6dl8ImJi3APjf/IHf
nofLxR11sQg/RCW9aKdflzxOPN29DiNkYVfWdSPVI0TMt3TmDXjkXxku4N35fUiY
hCNL52B53eOlbOdbks0uT3sdIPdM4Dy98RWOJ+iNXx1WjOSuNSE2Fa/pB4cib2fj
90C8H9wy85YjUiu2YhOXJUMU1EnxcMcygjGyD9CYUM5omddh1o+/vIJCGRIceE3M
x8YGiW1gdEQxL6irvNJI4tPmOHKLLOw4Iac2D2kKXazb3J6TskGAf54S7W8+fE74
Zn7WV4+PE3dXnZSayrYpfyK0j7SOfYwrF02NvzFyh44HGgT+tdmndiUhKhWqqhcx
NglIhX5lFt2O1VlCCBMzGrpFlLCKI4nOjNBrNfiUQ0CFJBO7zhUFs5osySOCXl8q
7Kfy0azscptZz7NnILMvd+MpycB5fTFggtFV3ZPM9V/lGtzsaxkHpLNlFwdoVPXw
cIyD7K5EakYo5e874C7HP2WyZjVBnbGZGiAzc2cUJLk5oTAVY81dxDG1/LhjzmzV
df9CKXxPhMYnfDzeqGjKNUUMvxMH4N3sLjhoe9nZ0j2xAYbKYgo=
=cm+d
-----END PGP SIGNATURE-----

--+bHtJhyLn7P4Vxo3--


--===============1969734056959700503==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1969734056959700503==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-users

--===============1969734056959700503==--