Giters

mailvelope / mailvelope

Browser extension for OpenPGP encryption with Webmail

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Trust model

c8k opened this issue · comments

commented

Many of you probably know the web of trust, which is used to calculate the validity of a key. When WKD was developed a new trust model was created. It used aspects from the web of trust and adds some aspects like the source of a key. For example, a key which was retrieved via WKD has some basic trust because the email provider who maintains the WKD server can confirm that a key belongs to a person. Also, email provider usually have more secure servers than private maintainer.
It would be a great enhancement for the security, if Mailvelope would contain such a trust model and display different levels of trust. Here are some reasons:

  1. Users are aware that not all keys can be trusted and not all keys provide the same security.
  2. Users can decide which level of trust is necessary for which use case, so they choose to use only keys with a higher level for more confidential messages.
  3. Mailvelope can automatically prefer keys with the highest level of trust, when users encrypt or sign a message.