fred avolio's musings

I’ve written and lectured many times about e-mail security. Sometimes, I discuss securing e-mail systems. I rarely discuss protecting e-mail against modification or eavesdropping, because it seems we just don’t care. See what I’ve written in the past at my Secure E-mail Collection. And recently, I blogged E-mail Security: We Still Don’t Bother

I also have written about my love affair with the Eudora e-mail client, but thoughts of moving over to Thunderbird.

But, I like Thunderbird’s interface. I like its being free. I like its older brother, Firefox. I recommend moving to Thunderbird to others. I almost moved a while back. But, there were some speed bumps, blogged here. But, recently I decided to slowly give it another try.

So far, things are working smoothly. I’ve not cut over to using it instead of Eudora, yet. But, I find some interesting security features. Recall, in the aforementioned E-mail Security: We Still Don’t Bother, my friend Dave wrote,

I am disappointed that I have to give up PGP but could not reasonably continue to purchase $100-200 worth of email and security software for the purpose of communicating with 9 people. What a sad indictment on the state of email security, huh?

Well, I’ve got Thunderbird with PGP and S/Mime now. It was fairly straightforward. First, S/MIME: Thunderbird comes with it. I followed the instructions for Getting an S/MIME certificate. I got mine from Thawte. Then I followed those for installing the certificate. And it just worked.

For PGP, I used the Thunderbird Enigmail plugin. But first, I installed GPG (in this case, for Windows), using the installer I found at www.gnupg.org. It installed smoothly.

if you are not going to install existing key rings you can skip the next step.

I then downloaded my secret and private PGP key rings, and used GPG from the command line to read convert them to GPG from PGP. (I did this in the GnuPG folder.) Once I did this, I installed the Enigmail extension to Thunderbird, restarted it and imported the key files using Enigmail’s key manager.

If you are new to all this, you’ll use Enigmail to create your first key pair and store it.

This will be your decryption and signing key pair. Since I had one already, I needed to fiddle with Thunderbirds configuration file to point to my key. Actually, I had created a keypair, and had a horrible time trying to get it to use my old one. But, finally I figured it out. So, go ahead and generate a new one. Ff you want to use the old one, edit the prefs.js file (in your Thunderbird identity folder), and edit the “mail.identity.id3.pgpkeyId” value to have your key ID. Mine looks like this:
user_pref(“mail.identity.id3.pgpkeyId”, “0x3521CEA0”);

A restart of Thunderbird, and everything is working. If only people actually used encrypted mail…

Okay, I spoke too soon. There are imcompatibilities I cannot figure out between GPG and PGP Personal Privacy 6.5.2 that I run. GnuPG can decrypt and verify a PGP signed and encrypted file. And GnuPG can handle one that GnuPG signs and encrypts. But, PGP cannot decrypt a GPG-encrypted file. I get the error “An error has occurred : encrypted session key is bad”. So, what is Mom and Pop supposed to do? Arrrrg!

I was unclear in explaining how I did some of the above. I used Firefox to get my certificate. Following Mozilla instructions, which say, “If you use Firefox to get your certificate and take the Netscape/Messenger option, a certificate silently installs into Firefox.” I got a Netscape/messenger certificate from Thawte. It works fine with Tbird.

I just got a PGP ecrypted message from a Thunderbird/Enigmail user, Jason Wyman. He wrote, Just wanted to let you know that I have PGP set up with Enigmail in Thunderbird and it is working GREAT for me. I’ve had a lot of time to fiddle with several different set ups as I’ve “converted” my friends and clients at work. With me using PGP Desktop 9.0 and Mail.app on my PowerBook, it decrypted and authenticated great. Thanks, Jason!

Jason wrote back: I just noticed you updated your blog with an excerpt from my email to you. I was going to suggest that you post this email address along with my PGP key for anyone who may need help…. I’d be happy to help. I believe it’s very important that more people begin to take their privacy seriously. This would be an opportunity for me to help others make their own lives a little more secure. You can contact Jason and get his public PGP key at http://home.comcast.net/~jason.wyman/ or at keyserver http://keyserver.pgp.com/.

I’ve meant to mention ths, and keep forgetting to do so. Early on when scoping out whether to go to the Mac platform, I found a terrific article, and implemented everything it said. It is 8 Ways to Protect Your Mac Right Now, by Kirk McElhearn.

I cannot believe anyone reading this has not heard of the “Nigerian Scam” (also called 419 after the Nigerian anti-fraud statute). The most common, that I receive every once in a while, has to do with someone — a widow or son of the recently assassinated political leader someone-or-other in some African nation. (I suppose they assume, rightly, that Americans especially won’t have a clue of this particular person exists, was recently assassinated, etc.) There are millions of dollars in a bank account and the sender of the email heard about your integrity doing an Internet search. They suggest a money laundering scheme for which the recipient gets %10 just for playing… er, helping.”

I just read a fascinating piece on this at news.yahoo.com/s/latimests/20051020/ts_latimes/iwilleatyourdollars describing this in interesting detail.

I promised I’d describe moving to Mac e-mail in this installment. I’ll cover what I tried, what I found, what I ended up using, and why. This is one in a series, the whole of which can be perused at blog.avolio.com/search/label/pc2mac. (In preparation for this topic, I blogged about e-mail systems I have known over the years.)

What I Used on the PC.
I have used Eudora for many years. I’ve liked its look and feel. I like the filtering and labeling. I like that the mailboxes are stored in ASCII format. This allows me to get at my e-mail on my system, even when connected from my Linux server. So, the easy thing would have been to just use Eudora on the Mac. For some reason —I do not know why—I decided I might try a change.

Apple’s Mail Application
I heard that Tiger’s mail application (cleverly called “Mail”) was slow. I played with it a bit, but then decided I’d try Thunderbird.

Thunderbird
I’d tried Thunderbird, the Mozilla client, few times before. I liked it and recommended it, so I figured, why not try it on the Mac?

I’d used it before to remotely access my e-mail from other day job. I’d migrated my wife and daughter at a Maryland university to it. But, I had never migrated from Eudora. That proved to be a problem. Although, Eudora mailboxes are easily readable, Eudora does non-standard things. I’ve written about problems with Eudora storing attachments differently, etc. before, as I mentioned. I found a terrific tool called Eudora Rescue, which did as it said and it allowed me to migrate.

I used Thunderbird for a few weeks. In this move, I made a a major change. My goal with e-mail has always been for availability. I want my email available on my mobile computer (my PowerBook, now), and on a server. In the past, I did the following:

• Read email to my computer using POP3
• Synchronize my notebook PC files with my desktop PC
• Remotely SAMBA-mount my desktop PC’s folder on my in-house Linux server

So, the e-mail was saved in two places, and I could access the mailboxes from any remote system if I had to, with an SSH connection to my Linux server.

As the Wikipedia entry says, “POP3 and its predecessors are designed to allow end users with intermittent connections such as dial-up connections to retrieve email when connected, and then to view and manipulate the retrieved messages without needing to stay connected.” This fit my needs very well, with the above-mentioned steps. This is known as “disconnected” mode. (Most POP3 clients have a “leave mail on server” option.)

The change I made was to move to using IMAP.

• Good—worked; flexible; fast; worked fine “disconnected;” though not as many “labels” as Eudora, good enough.
• Bad—Could not figure out how to just use the keyboard, though it may be my being new to the Mac (I like the mouse—but, really, why not have a 2 or 3 button mouse? —but, not all the time).

Mulberry
A friend, and former DEC colleague, Dr. Brian K. Reid, put me on to Mulberry. He cares as much about e-mail as I do, so, I figured I’d try it. In fact, it was this move that took me to using IMAP. See, I had a devil of a time importing from Thunderbird to Mulberry. Its “Import” function was greyed out. I used a conversion tool, but it did not work. A group of learned friends all basically told me the same thing: “Use Thunderbird to copy your mailboxes to an IMAP server. Then use Mulberry to copy them back from that IMAP server to your local computer.” So, I did, and started using Mulberry and IMAP. I set things up to work in “disconnected” mode, meaning that all the mailboxes stay on my email server (I put them in a hierarchy in my home directory on my Linux server, under a directory “Mail/”), and copies of all mailboxes get synchronized with/onto my Powerbook.

This meets me requirements mentioned earlier. I can always, if needed, SSH into my email server and read any of my email messages; they are stored in mailboxes in mbox format (so, I can use UCB Mail to read them if needed).

Mulberry had everything I wanted, including great filtering and labeling, but it was way too complex with way too little documentation. My friend who recommended it, had said, “Mulberry is not simple to configure. In fact, it has so damn many options and modes that it can be a big pain to learn.” He was right, and I gave up on it.

Mail.app
I’ve settled on the native email client, Mail. (One benefit of an IMAP client is there is no conversion step; the email on the server just reads in to the file locations of the new client.) I like it. Searchlight is integrated into Mail. Things just work. Rules for filtering are pretty good, although there are no labels to speak of. (I was used to labeling emails as, for example, “list,” for mailing lists, “save,” “read,” “action,” etc.) I miss that, but can live without it. I benefited from an article called Tweaking Tiger Mail, by Giles Turnbull. Right now, the only negative feelings I have towards the native Mail.app, is that I would like to do complex searches. Mail.app uses the ubiquitous Searchlight, and it allows Boolean expressions in a search, but you are limited to Booleans in one field. For example, I want to look for all messages containing “Joe” or “Mary” (easy to do) that are from my wife or from me and that contain one or more attachments. (Don’t ask me why, it’s just an example.) There is no way I can see to make such complex query.

Nevertheless, for now I happy with the native Mail application, and am sticking with it.

Other discovered coolness.
I keep finding more cool and useful things on the Mac. First, Mac OS allows one to remap or modify some of the keys. In “System preferences,” in “Keyboard & Mouse,” select “Modifier Keys…” I selected “No action” for the “Caps Lock.” This is the first time I had a computer that allowed me to do this.

It’s been a few month’s since I ditched my Windows PC for a PowerBook. I’ve no regrets. In fact, I am happy for the change. I do still sometimes use a Windows machine when I must (running my copy of QuickBooks for my business account or at my other day job). When I do that, my left hand usually hits the wrong keys for a while, but I do not consider this a problem.

Next time: calendars and address books.

Also, check out Interview with Tony Bove, Author of Just Say No to Microsoft.