Workaround for Exchange-corrupted PGP/Mime structure

[Daniel Kahn Gillmor]

On Wed 2019-11-20 17:10:40 -0500, Brian Sniffen wrote:
> Yeah, these have been fantastic for me too.  MSFT has no intention of
> fixing PGP or MIME support; it's been well over a decade.  

I'm unwilling to accept this situation, and i hope that other people
will join me in exerting pressure on MSFT to fix this.

fwiw, there are versions or configurations of Exchange (or of their
SMTP/submission subsystem) that *do not* introduce this failure, and
I've had some success in getting MSFT to adjust the version or
configuration of Exchange used by some clients that can demonstrate that
their sent mail is being mangled, to the point where the messages are no
longer being mangled.

While i've documented the mangling publicly:

   https://tools.ietf.org/html/draft-dkg-openpgp-pgpmime-message-mangling-00#section-4.1

I would *really* like to see MSFT publicly acknowledge this as a
flaw/vulnerability in specific versions/configurations of their
products, so that we can push people running vulnerable
versions/configurations to upgrade/change.

If you know anyone whose messages are being mangled in this way, i would
appreciate being put in touch with them, so that i can help them (as a
customer) push Microsoft into a better position.

If you've encountered any message like this while running notmuch from
git master, you should be able to identify those messages with:

    notmuch search property:index.repaired=mixedup

Feel free to reply to me off-list if you have identified anyone who
might be interested in trying to improve the situation (or if you
yourself are interested in doing this).  I might be able to help you
figure out specific ways to push Microsoft to avoid causing this failure
in the future.

      --dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://notmuchmail.org/pipermail/notmuch/attachments/20191121/c2185363/attachment.sig>