mailvelope / mailvelope

Browser extension for OpenPGP encryption with Webmail

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Sender can decrypt a message

namhoang1999 opened this issue · comments

commented

I just found out that the sender can decrypt a message that was encrypted with the recipient's public key.

So I first encrypt an arbitrary message (both works with/without the signature). I copied the encrypted message to the decryption section. Then a message popup asking for the password to the sender's key, I entered my password and it did decrypt it.

This is probably trivial since the sender knows the message content anyway, but why is the sender allowed to do this? and why is the sender's key used? AFAIK PKC can only decrypt a message with the recipient's private key. Please let me know if i'm understanding anything wrong.

image

You can use this setting if you do not want to encrypt messages with your default key.