[neomutt-devel] Message security; protected header fields

[Alejandro Colomar]

Hi Werner,

On Sat, Apr 20, 2024 at 02:10:28PM +0200, Werner Koch wrote:
> Hi,
> 
> I only had a brief look into this thread but stumbled upon this:
> 
> > *7:   BCCs should be hidden recipients.
> 
> [BCCs shold be separate mails of course.]
> 
> Using a hidden recipient is a major hassle for everyone with more than a
> single key and in particular when several smartcards.  As a BCC
> recipient you would be forced to do trial decryption and swap smartcards
> over and over.  This is the very reason why I once introduced the
> --skip-hidden-recipients optin and franly I use it for years now and
> disable it only when needed.

Thanks for the feedback!  That would be my favourite approach as a user,
although as a programmer I wanted to avoid it, since it would need big
work.

Richard, I guess we should first change neomutt(1) to send separate
mails for BCC in non-encrypted mode, which will already be a pain, and
then probably the encrypted thing will follow.  AFAIK, it's sending a
single mail, isn't it?  That would already be an improvement, because at
the moment, since it sends a single message, I see no Bcc: field when
receiving a Bcc message, which makes me wonder why I receive them.
Having a separate mail in which the Bcc field is set would be a nicer
UX.

I'll put this thing at the end of the queue of things I want to do.  In
the meantime, users will have to live with the fact that BCC encrypted
mail leaks the BCCs.  :-)

> Salam-Shalom,

Have a lovely day!
Alex

>    Werner
> 
> -- 
> The pioneers of a warless world are the youth that
> refuse military service.             - A. Einstein

-- 
<https://www.alejandro-colomar.es/>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://mailman.neomutt.org/pipermail/neomutt-devel-neomutt.org/attachments/20240420/7216d0e2/attachment.sig>