href="//static.fsf.org/nosvn/enc-dev0/img/favicon.ico" />
</head>
-<body><iframe src="//static.fsf.org/nosvn/banners/2017fundraiser/" width="100%" height="100%" scrolling="no" style="overflow: hidden; border: 0 none; display: block;"></iframe>
+<body>
<!-- ~~~~~~~~~ GnuPG Header and introduction text ~~~~~~~~~ -->
<header class="row" id="header"><div>
<p>If not, search "Enigmail" with the search bar in the upper right. You
can take it from here. Restart your email program when you're done.</p>
+<p>Enigmail versions prior to 2.0.6 have serious security issues. Make sure to install version 2.0.6 or later.</p>
+
<!-- ~~~~~~~~~ Troubleshooting ~~~~~~~~~ -->
<div class="troubleshooting">
send attachments, Enigmail will give you the choice to encrypt them or not,
independent of the actual email.</p>
+<p>For greater security against potential attacks, you can turn off
+HTML. Instead, you can render the message body as plain text. In order
+to do this in Thunderbird, go to View > Message Body As > Plain
+Text.</p>
+
</div><!-- End .main -->
</div><!-- End #step-headers_unencrypted .step-->
wherever you share your email address, so that people can double-check that
they have the correct public key when they download yours from a keyserver.</p>
-<p class="notes">You may also see public keys referred to by their key ID,
-which is simply the last eight digits of the fingerprint, like C09A61E8 for
-Edward. The key ID is visible directly from the Key Management window. This
-key ID is like a person's first name (it is a useful shorthand but may not be
-unique to a given key), whereas the fingerprint actually identifies the key
-uniquely without the possibility of confusion. If you only have the key ID,
-you can still look up the key (as well as its fingerprint), like you did in
-Step 3, but if multiple options appear, you'll need the fingerprint of the
-person to whom you are trying to communicate to verify which one to use.</p>
+<p class="notes">You may also see public keys referred to by a shorter
+key ID. This key ID is visible directly from the Key Management
+window. These eight character key IDs were previously used for
+identification, which used to be safe, but is no longer reliable. You
+need to check the full fingerprint as part of verifying you have the
+correct key for the person you are trying to contact. Spoofing, in
+which someone intentionally generates a key with a fingerprint whose
+final eight characters are the same as another, is unfortunately
+common.</p>
</div><!-- End .main -->
</div><!-- End #step-identify_keys .step-->
projects / enc.git / blobdiff