0
$\begingroup$

There is a feature in Thunderbird under Account Settings > Security, in it are two options one can use: digital signing and encryption. What's the difference between it and Enigmail? Are they both equally secure or is the other more secure and reliable? As I understand it, one do need to have CA or S/MIME from a third party to use that secure feature from Thunderbird? Is it advisable to use that than Enigmail or can I combine the two?

$\endgroup$
0
$\begingroup$

What's the difference between it and Enigmail?

They're using different signature / encryption standards.
The Thunderbird built-in uses S/MIME which relies on the CA PKI.
Enigmail implements OpenPGP which relies on the web-of-trust and TOFU.

Are they both equally secure or is the other more secure and reliable?

It depends.
There's a lot of configuration going on under the hood with OpenPGP and S/MIME and depending on the settings both formats can be (in)secure. The rest of security just depends on personal preference and actual usage. The security part relies on whether you can be bothered to actually get your own key signed and sign other people's keys with OpenPGP and whether you trust the CA model with S/MIME. If you don't mind your encrypted message to be put into an attachment then there's no issue with S/MIME and if you do mind, OpenPGP can put it encoded into the message.

As I understand it, one do need to have CA or S/MIME from a third party to use that secure feature from Thunderbird?

Yes and No.
You don't need to get a certificate from a centrally trusted CA to use S/MIME. You may as well roll your own CA and install it to all recipients or just use a self-signed certificate that needs to be explicitely trusted by other parties.
However, if you are not a company targeting internal emails only with S/MIME, you really should get an S/MIME certificate signed by a trusted CA, because otherwise other people have no guarantee that you're actually the one (or the even the address) who you claim to be.

Is it advisable to use that than Enigmail or can I combine the two?

In theory, yes, in practice though it depends on the user-interface and the implementation to see whether nested encryption is possible. Nested signatures are no problem at all. Using both in the sense of "I write to Phil using Enigmail and to Bob using S/MIME", this is no problem at all.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.