en: reword security warnings (enc 5c3bffb)

[enc-live.git] / en / index.html

diff --git a/en/index.html b/en/index.html
index e015b2d7edfe2cb1084fdaaab6d241496c125707..5371ffe77540297dd4f544882279d395aaf235f1 100644 (file)
--- a/en/index.html
+++ b/en/index.html
@@ -39,8 +39,7 @@ href="//static.fsf.org/nosvn/enc-dev0/img/favicon.ico" />
 <li><a href="/sq">Shqip - v4.0</a></li>
 <li><a href="/sv">svenska - v4.0</a></li>
 <li><a href="/tr">Türkçe - v4.0</a></li>
-<li><a
-href="https://libreplanet.org/wiki/GPG_guide/Translation_Guide"><strong><span
+<li><a href="https://libreplanet.org/wiki/GPG_guide/Translation_Guide"><strong><span
 style="color: #2F5FAA;">Translate!</span></strong></a></li>
 </ul>
 
@@ -235,7 +234,13 @@ so, skip this step.</p>
 <p>If not, search "Enigmail" with the search bar in the upper right. You
 can take it from here. Restart your email program when you're done.</p>
 
-<p>Make sure you're installing the latest version of Enigmail. As of May, 2018, this is version 2.0.5.</p>
+<p>There are major security flaws in versions of GnuPG prior to 2.2.8, and
+Enigmail prior to 2.0.7. Make sure you have GnuPG 2.2.8 and Enigmail 2.0.7,
+or later versions.</p>
+
+<p>Note: As of June 18, 2018, GnuPG 2.2.8 is unavailable for Debian stable and
+testing.</p>
+
 
 <!-- ~~~~~~~~~ Troubleshooting ~~~~~~~~~ -->
 <div class="troubleshooting">
@@ -654,6 +659,11 @@ using GnuPG, even if they can't figure out what you're saying. When you
 send attachments, Enigmail will give you the choice to encrypt them or not,
 independent of the actual email.</p>
 
+<p>For greater security against potential attacks, you can turn off
+HTML. Instead, you can render the message body as plain text. In order
+to do this in Thunderbird, go to View &gt; Message Body As &gt; Plain
+Text.</p>
+
 </div><!-- End .main -->
 </div><!-- End #step-headers_unencrypted .step-->
 
@@ -825,15 +835,15 @@ and choosing Key Properties. It's good practice to share your fingerprint
 wherever you share your email address, so that people can double-check that
 they have the correct public key when they download yours from a keyserver.</p>
 
-<p class="notes">You may also see public keys referred to by their key ID,
-which is simply the last eight digits of the fingerprint, like C09A61E8 for
-Edward. The key ID is visible directly from the Key Management window. This
-key ID is like a person's first name (it is a useful shorthand but may not be
-unique to a given key), whereas the fingerprint actually identifies the key
-uniquely without the possibility of confusion. If you only have the key ID,
-you can still look up the key (as well as its fingerprint), like you did in
-Step 3, but if multiple options appear, you'll need the fingerprint of the
-person to whom you are trying to communicate to verify which one to use.</p>
+<p class="notes">You may also see public keys referred to by a shorter
+key ID. This key ID is visible directly from the Key Management
+window. These eight character key IDs were previously used for
+identification, which used to be safe, but is no longer reliable. You
+need to check the full fingerprint as part of verifying you have the
+correct key for the person you are trying to contact. Spoofing, in
+which someone intentionally generates a key with a fingerprint whose
+final eight characters are the same as another, is unfortunately
+common.</p>
 
 </div><!-- End .main -->
 </div><!-- End #step-identify_keys .step-->