Request for comments on autocrypt translation strings

[Kevin J. McCarthy]

On Sun, Aug 04, 2019 at 08:54:26AM +0200, Petr Pisar wrote:
>I did not study the Autocrypt specification, only their About and FAQ. Maybe
>therefore some messages are difficult to understand for me:

Hi Petr,

It may be helpful to also look at 
<https://muttmua.gitlab.io/mutt/manual-dev.html#autocryptdoc> in the 
manual.

>msgid "Create an initial autocrypt account?"
>
>This sounds like an account of some on-line service. If it is about 
>creating a record in the autocrypt directory, why not call it a record 
>or an entry?  I don't like the word "account".

Account is the terminology used by Autocrypt in their specification. 
I'd really rather not change it at this point, because the database, 
data structures, interface, and Autocrypt all call it that.

>msgid "Generating autocrypt key..."
>
>Does the new feature use a completly new and separate PGP key from a 
>key the users already has in his private GPG keyring?

Yes, and it does so in a separate keyring stored in $autocrypt_dir.

>I did not study Mutt implementation, but I really don't like the 
>concept that MUA silently replaces recipient's keys based on what it 
>gets in an unsigned e-mail header.

The implementation is not silently replacing keys.  I've taken some 
measure of care to partition autocrypt from the wot in storage and 
implementation.  The feature is not automatically included at 
compile-time, and not automatically enabled in the muttrc.  If enabled, 
the Autocrypt is on a separate line in the compose menu and defers to 
normal GPG operations.

>This completely undermines a web of trust. I understand that it's good 
>enough for oportunistic encryption, but if a user already has an 
>established trust or relies on trust-on-first-use, then the silent 
>unverified key change kills it. If it indeed operates like that, then 
>that's a reason why I won't use it. It downgrades my security.

I understand your personal feelings, but honestly I didn't send this 
here to engage in a discussion of the merits of Autocrypt.  You're 
welcome to email mutt-dev if there is an implementation issue you'd like 
to discuss.

-- 
Kevin J. McCarthy
GPG Fingerprint: 8975 A9B3 3AA3 7910 385C  5308 ADEF 7684 8031 6BDA
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.mutt.org/pipermail/mutt-po/attachments/20190804/41264055/attachment.asc>