2

When I'm composing a new message in Thunderbird, I enter an email address - let's say [email protected] - I press Tab to jump to the subject field and now my application firewall (LittleSnitch on a Mac) tells me that Thunderbird is trying to connect to example.com. Why? The same thing is happening on Windows machines.

How can I stop Thunderbird from "ruining my privacy"?

Improve this question
3
  • Welcome to Super User! What exactly is LittleSnitch telling you? Which port is Thunderbird trying to connect on?
    – bertieb
    May 30, 2018 at 9:03
  • @bertieb Thank you! Port 443. I think it has something to do with autoconfig, as the Thunderbird Developer Tools tell me the requested URL is https://example.com/.well-known/openpgpkey/hu/someweirdstring. Okay, next suspect: Enigmail?
    – Pimon
    May 30, 2018 at 9:28
  • I'm not entirely sure I get the privacy side of this. I mean, it's the same domain in the end.
    – u1686_grawity
    May 30, 2018 at 11:21

1 Answer 1

Reset to default
2

This is a feature of Key Discovery

Thunderbird is trying to access a URL along the lines of:

https://example.com/.well-known/openpgpkey/hu/someweirdstring

This is to look up an OpenPGP key associated with the address(es) you've typed in the To: field:

(preamble)

This memo describes a method to associate OpenPGP keys with a mail address and how to look them up using a web service with a well-known URI.

(...intervening sections snipped...)

To form the URI, the following parts are concatenated:

o The scheme "https://",

o the domain-part,

o the string "/.well-known/openpgpkey/hu/",

o and the above constructed 32 octet string.

For example the URI to lookup the key for [email protected] is:

https://example.org/.well-known/openpgpkey/hu/iy9q119eutrkn8s1mk4r39qejnbu3n5q

From OpenPGP Web Key Service, '3.1 Key Discovery'.

What is the culprit?

You say you have the Engimail add-on installed:

Enigmail is an add-on to the mail client of Mozilla Thunderbird and SeaMonkey allowing users to access the authentication and encryption features provided by GnuPG. Thus Enigmail enables Mozilla Thunderbird and SeaMonkey to send and receive digitally signed and/or encrypted messages using the OpenPGP standard.

Enigmail supports (among other things), "OpenPGP key management interface"

from What is Enigmail.

I couldn't find support for key lookup specifically after a cursory search, but it is likely Enigmail supports this.

How can I protect my privacy?

You have a number of options:

  • let your application firewall block the requests
  • disable Enigmail

or,

  • let the lookups continue, on the basis you are emailing someone at that domain anyway
Improve this answer
3
  • Thanks for this explanation! It seems as if disabling "Autocrypt" and disabling "automatically send encrypted" (in the non-junior-expert-settings of Enigmail) stops automatic key discovery.
    – Pimon
    May 30, 2018 at 10:23
  • My pleasure, it was an interesting question :) If you're happy for me to, I will edit those settings into the answer (or you can add you own answer) for future reference- comments are notionally temporary!
    – bertieb
    May 30, 2018 at 10:27
  • After a few more days with Enigmail, I noticed that disabling Autocrypt and "automatically send encrypted" doesn't resolve this issue. I'll investigate a little.
    – Pimon
    Jun 25, 2018 at 11:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .