-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathindex.html
2329 lines (2217 loc) · 189 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<style>
/*! normalize.css v2.1.3 | MIT License | git.io/normalize */
/* ==========================================================================
HTML5 display definitions
========================================================================== */
/**
* Correct `block` display not defined in IE 8/9.
*/
article,
aside,
details,
figcaption,
figure,
footer,
header,
hgroup,
main,
nav,
section,
summary {
display: block;
}
/**
* Correct `inline-block` display not defined in IE 8/9.
*/
audio,
canvas,
video {
display: inline-block;
}
/**
* Prevent modern browsers from displaying `audio` without controls.
* Remove excess height in iOS 5 devices.
*/
audio:not([controls]) {
display: none;
height: 0;
}
/**
* Address `[hidden]` styling not present in IE 8/9.
* Hide the `template` element in IE, Safari, and Firefox < 22.
*/
[hidden],
template {
display: none;
}
/* ==========================================================================
Base
========================================================================== */
/**
* 1. Set default font family to sans-serif.
* 2. Prevent iOS text size adjust after orientation change, without disabling
* user zoom.
*/
html {
font-family: sans-serif; /* 1 */
-ms-text-size-adjust: 100%; /* 2 */
-webkit-text-size-adjust: 100%; /* 2 */
}
/**
* Remove default margin.
*/
body {
margin: 0;
}
/* ==========================================================================
Links
========================================================================== */
/**
* Remove the gray background color from active links in IE 10.
*/
a {
background: transparent;
}
/**
* Address `outline` inconsistency between Chrome and other browsers.
*/
a:focus {
outline: thin dotted;
}
/**
* Improve readability when focused and also mouse hovered in all browsers.
*/
a:active,
a:hover {
outline: 0;
}
/* ==========================================================================
Typography
========================================================================== */
/**
* Address variable `h1` font-size and margin within `section` and `article`
* contexts in Firefox 4+, Safari 5, and Chrome.
*/
h1 {
font-size: 2em;
margin: 0.67em 0;
}
/**
* Address styling not present in IE 8/9, Safari 5, and Chrome.
*/
abbr[title] {
border-bottom: 1px dotted;
}
/**
* Address style set to `bolder` in Firefox 4+, Safari 5, and Chrome.
*/
b,
strong {
font-weight: bold;
}
/**
* Address styling not present in Safari 5 and Chrome.
*/
dfn {
font-style: italic;
}
/**
* Address differences between Firefox and other browsers.
*/
hr {
-moz-box-sizing: content-box;
box-sizing: content-box;
height: 0;
}
/**
* Address styling not present in IE 8/9.
*/
mark {
background: #ff0;
color: #000;
}
/**
* Correct font family set oddly in Safari 5 and Chrome.
*/
code,
kbd,
pre,
samp {
font-family: monospace, serif;
font-size: 1em;
}
/**
* Improve readability of pre-formatted text in all browsers.
*/
pre {
white-space: pre-wrap;
}
/**
* Set consistent quote types.
*/
q {
quotes: "\201C" "\201D" "\2018" "\2019";
}
/**
* Address inconsistent and variable font size in all browsers.
*/
small {
font-size: 80%;
}
/**
* Prevent `sub` and `sup` affecting `line-height` in all browsers.
*/
sub,
sup {
font-size: 75%;
line-height: 0;
position: relative;
vertical-align: baseline;
}
sup {
top: -0.25em;
}
sub {
bottom: -0.25em;
}
/* ==========================================================================
Embedded content
========================================================================== */
/**
* Remove border when inside `a` element in IE 8/9.
*/
img {
border: 0;
}
/**
* Correct overflow displayed oddly in IE 9.
*/
svg:not(:root) {
overflow: hidden;
}
/* ==========================================================================
Figures
========================================================================== */
/**
* Address margin not present in IE 8/9 and Safari 5.
*/
figure {
margin: 0;
}
/* ==========================================================================
Forms
========================================================================== */
/**
* Define consistent border, margin, and padding.
*/
fieldset {
border: 1px solid #c0c0c0;
margin: 0 2px;
padding: 0.35em 0.625em 0.75em;
}
/**
* 1. Correct `color` not being inherited in IE 8/9.
* 2. Remove padding so people aren't caught out if they zero out fieldsets.
*/
legend {
border: 0; /* 1 */
padding: 0; /* 2 */
}
/**
* 1. Correct font family not being inherited in all browsers.
* 2. Correct font size not being inherited in all browsers.
* 3. Address margins set differently in Firefox 4+, Safari 5, and Chrome.
*/
button,
input,
select,
textarea {
font-family: inherit; /* 1 */
font-size: 100%; /* 2 */
margin: 0; /* 3 */
}
/**
* Address Firefox 4+ setting `line-height` on `input` using `!important` in
* the UA stylesheet.
*/
button,
input {
line-height: normal;
}
/**
* Address inconsistent `text-transform` inheritance for `button` and `select`.
* All other form control elements do not inherit `text-transform` values.
* Correct `button` style inheritance in Chrome, Safari 5+, and IE 8+.
* Correct `select` style inheritance in Firefox 4+ and Opera.
*/
button,
select {
text-transform: none;
}
/**
* 1. Avoid the WebKit bug in Android 4.0.* where (2) destroys native `audio`
* and `video` controls.
* 2. Correct inability to style clickable `input` types in iOS.
* 3. Improve usability and consistency of cursor style between image-type
* `input` and others.
*/
button,
html input[type="button"], /* 1 */
input[type="reset"],
input[type="submit"] {
-webkit-appearance: button; /* 2 */
cursor: pointer; /* 3 */
}
/**
* Re-set default cursor for disabled elements.
*/
button[disabled],
html input[disabled] {
cursor: default;
}
/**
* 1. Address box sizing set to `content-box` in IE 8/9/10.
* 2. Remove excess padding in IE 8/9/10.
*/
input[type="checkbox"],
input[type="radio"] {
box-sizing: border-box; /* 1 */
padding: 0; /* 2 */
}
/**
* 1. Address `appearance` set to `searchfield` in Safari 5 and Chrome.
* 2. Address `box-sizing` set to `border-box` in Safari 5 and Chrome
* (include `-moz` to future-proof).
*/
input[type="search"] {
-webkit-appearance: textfield; /* 1 */
-moz-box-sizing: content-box;
-webkit-box-sizing: content-box; /* 2 */
box-sizing: content-box;
}
/**
* Remove inner padding and search cancel button in Safari 5 and Chrome
* on OS X.
*/
input[type="search"]::-webkit-search-cancel-button,
input[type="search"]::-webkit-search-decoration {
-webkit-appearance: none;
}
/**
* Remove inner padding and border in Firefox 4+.
*/
button::-moz-focus-inner,
input::-moz-focus-inner {
border: 0;
padding: 0;
}
/**
* 1. Remove default vertical scrollbar in IE 8/9.
* 2. Improve readability and alignment in all browsers.
*/
textarea {
overflow: auto; /* 1 */
vertical-align: top; /* 2 */
}
/* ==========================================================================
Tables
========================================================================== */
/**
* Remove most spacing between table cells.
*/
table {
border-collapse: collapse;
border-spacing: 0;
}
.go-top {
position: fixed;
bottom: 2em;
right: 2em;
text-decoration: none;
background-color: #E0E0E0;
font-size: 12px;
padding: 1em;
display: inline;
}
/* Github css */
html,body{ margin: auto;
padding-right: 1em;
padding-left: 1em;
max-width: 60em; color:black;}*:not('#mkdbuttons'){margin:0;padding:0}body{font:13.34px helvetica,arial,freesans,clean,sans-serif;-webkit-font-smoothing:subpixel-antialiased;line-height:1.4;padding:3px;background:#fff;border-radius:3px;-moz-border-radius:3px;-webkit-border-radius:3px}p{margin:1em 0}a{color:#4183c4;text-decoration:none}body{background-color:#fff;padding:30px;margin:15px;font-size:14px;line-height:1.6}body>*:first-child{margin-top:0!important}body>*:last-child{margin-bottom:0!important}@media screen{body{box-shadow:0 0 0 1px #cacaca,0 0 0 4px #eee}}h1,h2,h3,h4,h5,h6{margin:20px 0 10px;padding:0;font-weight:bold;-webkit-font-smoothing:subpixel-antialiased;cursor:text}h1{font-size:28px;color:#000}h2{font-size:24px;border-bottom:1px solid #ccc;color:#000}h3{font-size:18px;color:#333}h4{font-size:16px;color:#333}h5{font-size:14px;color:#333}h6{color:#777;font-size:14px}p,blockquote,table,pre{margin:15px 0}ul{padding-left:30px}ol{padding-left:30px}ol li ul:first-of-type{margin-top:0}hr{background:transparent url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAYAAAAECAYAAACtBE5DAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyJpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEzNDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNSBNYWNpbnRvc2giIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6OENDRjNBN0E2NTZBMTFFMEI3QjRBODM4NzJDMjlGNDgiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6OENDRjNBN0I2NTZBMTFFMEI3QjRBODM4NzJDMjlGNDgiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDo4Q0NGM0E3ODY1NkExMUUwQjdCNEE4Mzg3MkMyOUY0OCIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDo4Q0NGM0E3OTY1NkExMUUwQjdCNEE4Mzg3MkMyOUY0OCIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PqqezsUAAAAfSURBVHjaYmRABcYwBiM2QSA4y4hNEKYDQxAEAAIMAHNGAzhkPOlYAAAAAElFTkSuQmCC) repeat-x 0 0;border:0 none;color:#ccc;height:4px;padding:0}body>h2:first-child{margin-top:0;padding-top:0}body>h1:first-child{margin-top:0;padding-top:0}body>h1:first-child+h2{margin-top:0;padding-top:0}body>h3:first-child,body>h4:first-child,body>h5:first-child,body>h6:first-child{margin-top:0;padding-top:0}a:first-child h1,a:first-child h2,a:first-child h3,a:first-child h4,a:first-child h5,a:first-child h6{margin-top:0;padding-top:0}h1+p,h2+p,h3+p,h4+p,h5+p,h6+p,ul li>:first-child,ol li>:first-child{margin-top:0}dl{padding:0}dl dt{font-size:14px;font-weight:bold;font-style:italic;padding:0;margin:15px 0 5px}dl dt:first-child{padding:0}dl dt>:first-child{margin-top:0}dl dt>:last-child{margin-bottom:0}dl dd{margin:0 0 15px;padding:0 15px}dl dd>:first-child{margin-top:0}dl dd>:last-child{margin-bottom:0}blockquote{border-left:4px solid #DDD;padding:0 15px;color:#777}blockquote>:first-child{margin-top:0}blockquote>:last-child{margin-bottom:0}table{border-collapse:collapse;border-spacing:0;font-size:100%;font:inherit}table th{font-weight:bold;border:1px solid #ccc;padding:6px 13px}table td{border:1px solid #ccc;padding:6px 13px}table tr{border-top:1px solid #ccc;background-color:#fff}table tr:nth-child(2n){background-color:#f8f8f8}img{max-width:100%}code,tt{margin:0 2px;padding:0 5px;white-space:nowrap;border:1px solid #eaeaea;background-color:#f8f8f8;border-radius:3px;font-family:Consolas,'Liberation Mono',Courier,monospace;font-size:12px;color:#333}pre>code{margin:0;padding:0;white-space:pre;border:0;background:transparent}.highlight pre{background-color:#f8f8f8;border:1px solid #ccc;font-size:13px;line-height:19px;overflow:auto;padding:6px 10px;border-radius:3px}pre{background-color:#f8f8f8;border:1px solid #ccc;font-size:13px;line-height:19px;overflow:auto;padding:6px 10px;border-radius:3px}pre code,pre tt{background-color:transparent;border:0}.poetry pre{font-family:Georgia,Garamond,serif!important;font-style:italic;font-size:110%!important;line-height:1.6em;display:block;margin-left:1em}.poetry pre code{font-family:Georgia,Garamond,serif!important;word-break:break-all;word-break:break-word;-webkit-hyphens:auto;-moz-hyphens:auto;hyphens:auto;white-space:pre-wrap}sup,sub,a.footnote{font-size:1.4ex;height:0;line-height:1;vertical-align:super;position:relative}sub{vertical-align:sub;top:-1px}@media print{body{background:#fff}img,pre,blockquote,table,figure{page-break-inside:avoid}body{background:#fff;border:0}code{background-color:#fff;color:#333!important;padding:0 .2em;border:1px solid #dedede}pre{background:#fff}pre code{background-color:white!important;overflow:visible}}@media screen{body.inverted{color:#eee!important;border-color:#555;box-shadow:none}.inverted body,.inverted hr .inverted p,.inverted td,.inverted li,.inverted h1,.inverted h2,.inverted h3,.inverted h4,.inverted h5,.inverted h6,.inverted th,.inverted .math,.inverted caption,.inverted dd,.inverted dt,.inverted blockquote{color:#eee!important;border-color:#555;box-shadow:none}.inverted td,.inverted th{background:#333}.inverted h2{border-color:#555}.inverted hr{border-color:#777;border-width:1px!important}::selection{background:rgba(157,193,200,0.5)}h1::selection{background-color:rgba(45,156,208,0.3)}h2::selection{background-color:rgba(90,182,224,0.3)}h3::selection,h4::selection,h5::selection,h6::selection,li::selection,ol::selection{background-color:rgba(133,201,232,0.3)}code::selection{background-color:rgba(0,0,0,0.7);color:#eee}code span::selection{background-color:rgba(0,0,0,0.7)!important;color:#eee!important}a::selection{background-color:rgba(255,230,102,0.2)}.inverted a::selection{background-color:rgba(255,230,102,0.6)}td::selection,th::selection,caption::selection{background-color:rgba(180,237,95,0.5)}.inverted{background:#0b2531;background:#252a2a}.inverted body{background:#252a2a}.inverted a{color:#acd1d5}}.highlight .c{color:#998;font-style:italic}.highlight .err{color:#a61717;background-color:#e3d2d2}.highlight .k,.highlight .o{font-weight:bold}.highlight .cm{color:#998;font-style:italic}.highlight .cp{color:#999;font-weight:bold}.highlight .c1{color:#998;font-style:italic}.highlight .cs{color:#999;font-weight:bold;font-style:italic}.highlight .gd{color:#000;background-color:#fdd}.highlight .gd .x{color:#000;background-color:#faa}.highlight .ge{font-style:italic}.highlight .gr{color:#a00}.highlight .gh{color:#999}.highlight .gi{color:#000;background-color:#dfd}.highlight .gi .x{color:#000;background-color:#afa}.highlight .go{color:#888}.highlight .gp{color:#555}.highlight .gs{font-weight:bold}.highlight .gu{color:#800080;font-weight:bold}.highlight .gt{color:#a00}.highlight .kc,.highlight .kd,.highlight .kn,.highlight .kp,.highlight .kr{font-weight:bold}.highlight .kt{color:#458;font-weight:bold}.highlight .m{color:#099}.highlight .s{color:#d14}.highlight .na{color:#008080}.highlight .nb{color:#0086b3}.highlight .nc{color:#458;font-weight:bold}.highlight .no{color:#008080}.highlight .ni{color:#800080}.highlight .ne,.highlight .nf{color:#900;font-weight:bold}.highlight .nn{color:#555}.highlight .nt{color:#000080}.highlight .nv{color:#008080}.highlight .ow{font-weight:bold}.highlight .w{color:#bbb}.highlight .mf,.highlight .mh,.highlight .mi,.highlight .mo{color:#099}.highlight .sb,.highlight .sc,.highlight .sd,.highlight .s2,.highlight .se,.highlight .sh,.highlight .si,.highlight .sx{color:#d14}.highlight .sr{color:#009926}.highlight .s1{color:#d14}.highlight .ss{color:#990073}.highlight .bp{color:#999}.highlight .vc,.highlight .vg,.highlight .vi{color:#008080}.highlight .il{color:#099}.highlight .gc{color:#999;background-color:#eaf2f5}.type-csharp .highlight .k,.type-csharp .highlight .kt{color:#00F}.type-csharp .highlight .nf{color:#000;font-weight:normal}.type-csharp .highlight .nc{color:#2b91af}.type-csharp .highlight .nn{color:#000}.type-csharp .highlight .s,.type-csharp .highlight .sc{color:#a31515}
</style>
<!-- ACTUALLY NECESSARY STYLE STARTS HERE --->
<style>
img {
border: 2px solid #777;
}
.fluo_green_bgnd {
background-color:#b5ff91;
color:black;
}
.fluo_green_frame {
border-style:solid;
border-width:8px;
border-color:#b5ff91;
padding-left:1em;
padding-right:1em;
padding-top:0.1em;
padding-bottom:0.1em;
}
.fluo_orange_bgnd {
background-color:#ffce91;
color:black;
}
.fluo_orange_frame {
border-style:solid;
border-width:8px;
border-color:#ffce91;
padding-left:1em;
padding-right:1em;
padding-top:0.5em;
padding-bottom:0.5em;
}
.lightblue_frame {
border-style:solid;
border-width:8px;
border-color:#74a5cc;
padding-left:1em;
padding-right:1em;
padding-top:0.5em;
padding-bottom:0.5em;
}
.notEssent_security_bgnd_fg {
background-color:#8396cf;
color:white;
}
.notEssent_security_frame {
border-style:dotted;
border-width:8px;
border-color:#8396cf;
padding-left:1em;
padding-right:1em;
padding-top:0.5em;
padding-bottom:0.5em;
}
.notEssent_CLI_bgnd_fg {
background-color:#cf8384;
color:white;
}
.notEssent_CLI_frame {
border-style:dotted;
border-width:8px;
border-color:#cf8384;
padding-left:1em;
padding-right:1em;
padding-top:0.5em;
padding-bottom:0.5em;
}
.notEssent_gpg_bgnd_fg {
background-color:#accf83;
color:white;
}
.notEssent_gpg_frame {
border-style:dotted;
border-width:8px;
border-color:#accf83;
padding-left:1em;
padding-right:1em;
padding-top:0.5em;
padding-bottom:0.5em;
}
/* unused ATM */
.text2uppercase {
text-transform:uppercase;
}
</style>
<!-- ACTUAL CONTENT STARTS HERE --->
<h1 id="mailpile-post-installation-tutorial"><em>Mailpile</em> post-installation tutorial</h1>
<p><small>Ver. 2021-03-14 19:15:40 UTC (first preview release: 2020-10-06) – Based on <em>Mailpile</em> 1.0.0rc6<br />
GitHub repository: <a href="https://github.com/greenpark-code/Mailpile_tutorial" class="uri">https://github.com/greenpark-code/Mailpile_tutorial</a><br />
Community: <a href="https://community.mailpile.is/t/mailpile-tutorial-for-newcomers/597" class="uri">https://community.mailpile.is/t/mailpile-tutorial-for-newcomers/597</a></small></p>
<div class="lightblue_frame">
<ul>
<li><a href="#Disclaimers"><strong>Disclaimers</strong></a></li>
<li><a href="#Introduction"><strong>Introduction</strong></a>
<ul>
<li><a href="#breakthrough"><strong>Breakthrough</strong></a></li>
<li><a href="#OpenIssues"><strong>Open issues</strong></a></li>
<li><a href="#notIssuesToBeAwareOf"><strong>Non-issues to be aware of</strong></a></li>
<li><a href="#WishList"><strong>Wish List</strong></a>
<ul>
<li><a href="#InListsOfEmails"><strong>In lists of emails</strong></a></li>
</ul></li>
<li><a href="#EncryptionMadeEasy"><strong>Encryption made easy for non-tech savvies</strong></a></li>
<li><a href="#Tags"><strong>Tags</strong></a></li>
<li><a href="#Design"><strong>Design</strong></a></li>
<li><a href="#EasySetup"><strong>Easy installation and setup</strong></a></li>
<li><a href="#MultipleAccounts"><strong>Multiple email accounts</strong></a></li>
</ul></li>
<li><a href="#HandsOn"><strong>Hands-on session</strong></a>
<ul>
<li><a href="#StartingMailpile"><strong>Starting <em>Mailpile</em></strong></a></li>
<li><a href="#FirstTimeSetup"><strong>First-time setup</strong></a></li>
</ul></li>
<li><a href="#AboutKeysAndSecurity"><strong>About keys and security – not essential to use <em>Mailpile</em></strong></a>
<ul>
<li><a href="#TypesOfKeys"><strong>Types of keys</strong></a></li>
<li><a href="#HigherSecurity"><strong>Higher security: superposing encryption levels</strong></a></li>
<li><a href="#otherCommTools"><strong>Other communication tools than email</strong></a></li>
<li><a href="#keysTheft"><strong>Keys theft</strong></a></li>
<li><a href="#keysInHardwareDevice"><strong>Keeping secret subkeys on a hardware device</strong></a>
<ul>
<li><a href="#CreatingKeysMovingToHwDevice"><strong>Creating keys and moving them to the hardware device</strong></a>
<ul>
<li><a href="#hackersVisit_symptomA"><strong>Possible attack, symptom A</strong></a></li>
</ul></li>
<li><a href="#UnblockingYubikey"><strong>Unblocking the <em>Yubikey</em> after repeated introduction of the wrong PIN/passphrase</strong></a>
<ul>
<li><a href="#hackersVisit_symptomB"><strong>Possible attack, symptom B</strong></a></li>
</ul></li>
</ul></li>
<li><a href="#KeepingSecretsStoredApart"><strong>Keeping secret subkeys stored apart and making them available when necessary</strong></a></li>
<li><a href="#OverYourShoulder"><strong>Over your shoulder</strong></a></li>
<li><a href="#airGapped"><strong>"Air-gapped"</strong></a></li>
<li><a href="#PerfectlySuitable"><strong><em>Mailpile</em> perfectly suitable if you also need to decrypt/encrypt apart</strong></a></li>
</ul></li>
<li><a href="#backToHandsOn"><strong>Back to our hands-on session</strong></a>
<ul>
<li><a href="#accessingEmailAccount"><strong>Accessing an email account</strong></a></li>
<li><a href="#MoreAccounts"><strong>More accounts</strong></a>
<ul>
<li><a href="#CopyOfTheRemoteFoldersStructureInSidebar"><strong>Copy of the remote folders structure and content is accessible in the sidebar</strong></a></li>
<li><a href="#MailpileWithGMail"><strong>Configuring <em>Google Mail</em> accounts in <em>Mailpile</em></strong></a></li>
</ul></li>
<li><a href="#MovingEmailsToTheTrash"><strong>Moving emails to the trash</strong></a></li>
<li><a href="#UsingTags"><strong>Using tags</strong></a>
<ul>
<li><a href="#CreatingATag"><strong>Creating a tag</strong></a></li>
<li><a href="#MovingEmailsToATag"><strong>Moving emails to a tag</strong></a></li>
<li><a href="#OrganizingSidebar"><strong>Organizing Your Sidebar</strong></a></li>
<li><a href="#EditingTagsSettings"><strong>Editing tags settings</strong></a></li>
</ul></li>
<li><a href="#LogoutShutdownOrDirectlyShutdown"><strong>Logout + shutdown or directly the latter</strong></a></li>
<li><a href="#BackupOfMailpileSettings"><strong>Backup of <em>Mailpile</em> settings</strong></a></li>
<li><a href="#tagsAsAttributes"><strong>Tags as attributes</strong></a></li>
<li><a href="#nestedTags"><strong>Nested tags (subtags)</strong></a>
<ul>
<li><a href="#tagAutomation"><strong>(Tag Automation)</strong></a></li>
</ul></li>
<li><a href="#removingTagsFromEmails"><strong>Removing tags from emails</strong></a></li>
<li><a href="#ComposingAndSendingAnEmail"><strong>Composing and sending an email</strong></a></li>
</ul></li>
<li><a href="#Mailpile_CLI"><strong>The Command Line Interface (CLI) – not essential to use <em>Mailpile</em></strong></a>
<ul>
<li><a href="#clearingTheCLI"><strong>Clearing the CLI space</strong></a></li>
<li><a href="#GettingHelp"><strong>Getting help, switching output format</strong></a></li>
<li><a href="#SearchingExporting"><strong>Searching, exporting emails</strong></a>
<ul>
<li><a href="#SettingNumOfResultsPerPage"><strong>Setting the number of results per page</strong></a></li>
<li><a href="#ChangingSortOrderCLI"><strong>Changing sort order of search results in the CLI</strong></a></li>
</ul></li>
<li><a href="#deletingEmails"><strong>Definitive deletion of emails</strong></a>
<ul>
<li><a href="#EnablingDeletion"><strong>In the GUI: enabling deletion of emails</strong></a></li>
<li><a href="#SettingDaysInTrash"><strong>In the GUI: setting the number of days in the trash before automatic definitive deletion of emails</strong></a></li>
<li><a href="#ImmediatelyEmptyingTrash"><strong>Immediately emptying the trash (or part of it) using the CLI</strong></a></li>
</ul></li>
<li><a href="#TaggingUntaggingUsingTheCLI"><strong>Tagging and untagging emails using the CLI</strong></a>
<ul>
<li><a href="#MovingToTheTrashUsingTheCLI"><strong>Moving emails to the trash using the CLI</strong></a></li>
<li><a href="#MovingOutOfTheTrashUsingTheCLI"><strong>Moving emails out of the trash using the CLI</strong></a></li>
</ul></li>
</ul></li>
<li><a href="#gpgExamples"><strong>Appendix: a few examples with <em>GnuPG</em> on the command line – not essential to use <em>Mailpile</em></strong></a>
<ul>
<li><a href="#ListingPubKeys"><strong>Listing the public keys in the keyring</strong></a></li>
<li><a href="#ListingSecretKeys"><strong>Listing the secret keys in the keyring</strong></a></li>
<li><a href="#ExportingPubKey"><strong>Exporting a public key from the keyring</strong></a></li>
<li><a href="#ExportingSecretsFromKeyring"><strong>Exporting secret keys or subkeys from the keyring (not if held in a hardware device)</strong></a></li>
<li><a href="#Importing"><strong>Importing public or secret keys or subkeys or a revocation certificate</strong></a></li>
<li><a href="#EncryptingSigning"><strong>Encrypting, signing</strong></a></li>
<li><a href="#Decrypting"><strong>Decrypting</strong></a></li>
<li><a href="#DetachSig"><strong>Creating a detached signature and verifying one</strong></a></li>
<li><a href="#TextSignatureAtTheBottom"><strong>The term "signature" is possibly confusing</strong></a></li>
<li><a href="#TemporarilyAnotherKeyring"><strong>Temporarily using another keyring</strong></a></li>
<li><a href="#BeforeSigningKeys"><strong>Before signing somebody else's keys...</strong></a></li>
</ul></li>
<li><a href="#__footnotes__"><strong>NOTES</strong></a></li>
</ul>
</div>
<p><br> <a name="Disclaimers"></a></p>
<h1 id="disclaimers">Disclaimers</h1>
<div class="fluo_green_frame">
<p>This tutorial comes with no warranties whatsoever, I'm not a <em>Mailpile</em> expert nor a certified security expert, I've quoted <em>Wikipedia</em> on a few important points and I'm discussing what my own approach is, also mentioning why certain aspects of it actually constitute one of various possible <strong>bets</strong> about possible attacks.</p>
<p>If reading this document you realize that you can't evaluate this information enough to be able to conclude that it promotes awareness of possible security problems, then you should probably do some research on your own and/or find a knowledgeable person that you can trust.</p>
<hr />
<p>This tutorial isn't in any way proceeding from the team of <em>Mailpile</em> developers, it's only my best effort to share hopefully useful information while encouraging more persons to use this powerful email client. All evaluations and opinions expressed here are solely mine.</p>
<p>NOT BEING ONE OF THE DEVELOPERS AND NOT HAVING CONTACT WITH THEM, I MIGHT AS WELL BE IGNORING USEFUL INFORMATION OR EVEN GETTING SOMETHING WRONG.</p>
<p>I can not guarantee that I'll be always in condition to update this tutorial in the future, but you can always fork it and improve it.</p>
<hr />
<p>In a nonessential <a href="#keysInHardwareDevice">section below</a>, I mention an optional device to hold keys, to hopefully raise the security level against keys theft. I'm not getting <em>any compensation whatsoever</em> from the maker. Again: I'm just sharing possibly useful info. That device happens to be the one I <em>bought</em>, I can't say anything about any others.</p>
</div>
<p>If you want to jump hands-on on <em>Mailpile</em>, at least don't miss:</p>
<ul>
<li><a href="#imagWithAddTagTechnicalSettings">this picture</a> which could save you <em>some</em> time</li>
<li><a href="#essentialPoints">this frame</a> with a very few important points</li>
</ul>
<p><a name="Introduction"></a></p>
<h1 id="introduction">Introduction</h1>
<p>Why <em>Mailpile</em> is so extremely interesting and what should be kept in mind while starting to use it.</p>
<p><a name="breakthrough"></a></p>
<h2 id="breakthrough">Breakthrough</h2>
<p><a href="http://www.mailpile.is"><strong><em>Mailpile</em></strong></a> is a wonderful email client available for <em>Linux</em>, <em>MacOS</em> and <em>Windows</em>.</p>
<p>I've been using <em>Thunderbird</em>+<em>Enigmail</em> during years by now, but <em>Mailpile</em> has winning features.</p>
<p><strong>One of its most innovative and important characteristics is that <span class="fluo_green_bgnd">it can very quickly search through encrypted emails</span> without having to decrypt them.</strong> This breakthrough was implemented by mean of a search index.<sup>[<a href="#fn1" id="fnref1">1</a>]</sup></p>
<p><em>Mailpile</em> enables you to <strong><em>easily</em></strong> send and receive encrypted emails (believe it or not, despite all the info and caveats reported here LOL).</p>
<p><strong>It keeps your settings and email messages encrypted in your local storage</strong>, optionally also the messages you received unencrypted. You don't need to keep your signatures in separate unencrypted files, easy to read for any intruder.<sup>[<a href="#fn2" id="fnref2">2</a>]</sup></p>
<p><em>Mailpile</em> interacts with the servers of your email service providers, copying emails and folders to your local storage.</p>
<p>Optionally, <em>Mailpile</em> removes your emails from the remote servers, <em>not</em> by default (although that would be the philosophy that the project leader recommends to embrace, keep your emails on your computer<sup>[<a href="#fn3" id="fnref3">3</a>]</sup>).</p>
<p><span class="fluo_orange_bgnd">I still need to find clarifications on a few things, I'll mark them with this color and add "<strong>[needs clarification]</strong>".</span></p>
<div class="fluo_orange_frame">
<p>Disabling "Leave mail on server" in the email accounts settings<sup>[<a href="#fn4" id="fnref4">4</a>]</sup>, my emails are actually disappearing from the remote Inbox folders, although not always at once. I'll see if I can find a way through the GUI or the CLI to:</p>
<ul>
<li>immediately delete emails on remote servers and compact remote folders</li>
<li>check what's the actual situation in remote folders.</li>
</ul>
<p>I can do both things connecting in webmail with a browser (I use <em>Firefox</em> and <em>Vivaldi</em>) or with <em>Thunderbird</em>. <span class="fluo_orange_bgnd"><strong>[needs clarification]</strong></span></p>
I understand that the developers had to respect priorities during this certainly <em>huge</em> amount of work, and that not all functionalities are already accessible through the Graphical User Interface (or GUI), nor a full documentation is available. <strong>But it's evident that the development has been done with high quality in mind. Just to mention one point: the search engine performance is <a href="#astonishingSearchEngine">astonishing</a>.</strong>
</div>
<p><a name="OpenIssues"></a></p>
<h2 id="open-issues">Open issues</h2>
<div class="fluo_green_frame">
<p>Here's the <a name="GitHubMailpileIssues"></a><a href="https://github.com/mailpile/Mailpile/issues">GitHub page for <em>Mailpile</em> issues</a>. I've read a bunch of them, I think that it is possible that some of the issues which appear to be still open have been resolved through other fixes by now. The current development status looks better <em>hands on</em> than on that page.</p>
<p>Again, I'm using version 1.0.0rc6, which means the 6<sup>th</sup> candidate to become release 1.0.0.</p>
<ul>
<li>If you get a "Template Not Found" text (I got it twice in over one month now), try reloading <a href="http://localhost:33411" class="uri">http://localhost:33411</a>, and if that doesn't work, logout from the GUI and login again and you should be fine.</li>
<li>Emails sent with <em>Mailpile</em> with digital signature but not encrypted, received in <em>Thunderbird</em> ver. 68.10.0 + <em>Enigmail</em> ver. 2.1.6, might result in a message "Unverified signature". <strong>Signed <u><em>and encrypted</em></u> emails do not present this problem.</strong> It might be more likely to happen when <em>forwarding</em> emails with attachments. Reported <a href="https://github.com/mailpile/Mailpile/issues/2274">here on <em>GitHub</em></a>. I'd normally <em>also encrypt</em> when sending to anybody who is in condition to check signatures (but sometimes you do not know).</li>
<li>There is a sporadic issue with the <code>search</code> command in the CLI, <a href="#searchSideEffect">see below</a>.</li>
<li>Another issue to take into account: compatibility with python 3 not achieved yet, it has been <a href="https://github.com/mailpile/Mailpile/issues/2263">mentioned on <em>GitHub</em></a>.</li>
<li><a name="newEmailNotAppearing"></a>Reported <a href="https://github.com/mailpile/Mailpile/issues/2272">here on GitHub</a>: occasionally <em>Mailpile</em> was not showing a new incoming email which presence on remote servers <em>Thunderbird</em> wasn't failing to reveal. It was happening occasionally with only one of various accounts. A new email arriving into that account (even if sent from the same account, with <em>Mailpile</em> itself or another client) caused <em>Mailpile</em> to immediately correctly show all emails arrived into that account.<br />
As the report says, there's <strong>possibly a workaround:</strong> add a second source disabling the first one, easily done in the GUI.<sup>[<a href="#fn6" id="fnref6">6</a>]</sup> Then, in case no new emails are appearing in that account, disable the currently active source and enable the other one, and of course let <em>Mailpile</em> connect to the server again.<br />
<strong>Although nobody else has reported that issue, which is happening with vivaldi.net, this is definitely <em>the</em> only real single important issue in my opinion at the moment, I hope it will be looked into soon, I would be able to recommend <em>Mailpile</em> more effectively.</strong><sup>[<a href="#fn7" id="fnref7">7</a>]</sup></li>
<li>Icons <a name="toolbarIconsBadlyPositioned"></a>in the toolbar can be badly positioned if the toolbar isn't long enough. <strong>Enlarging the GUI window horizontally</strong> helps, if possible (<a href="#mouseHoverHintsInTheWay">below</a> there is mention of another reason for it).</li>
<li>There <a name="timeoutWLargeEmails"></a>might be a timeout opening large emails (also mentioned <a href="#timeoutAlsoMentionedHere">here in this doc</a>), it has been reported <a href="https://github.com/mailpile/Mailpile/issues/2050">here in <em>GitHub</em></a>, I'll add a workaround to this tutorial as soon as I have one.</li>
</ul>
</div>
<p><a name="notIssuesToBeAwareOf"></a></p>
<h2 id="non-issues-to-be-aware-of">Non-issues to be aware of</h2>
<ul>
<li><p><span class="fluo_green_bgnd"><strong>NOTICE:</strong> if you send an email <u><em>to yourself</em></u> from <em>Mailpile</em> itself, <em>Mailpile</em> won't show it in the <em>Inbox</em>, you'll only see it among <em>Sent</em> emails, despite the fact that by default <em>Mailpile</em> sends a copy to your account.</span></p>
<p>(<u><em>To yourself</em></u> meaning: <u>using <em>Mailpile</em> to send</u> from one to another of the email accounts you have configured in <em>Mailpile</em>, or to the same one from which you are sending.<br />
You <em>will</em> see that email in <em>Mailpile</em>'s Inbox if you have sent it from another client, e.g. <em>Thunderbird</em>, even if sent from one of the email addresses that you have also configured in <em>Mailpile</em>.)</p>
<p><strong>This can be confusing <em>at first</em>, but it actually makes it easier to handle your emails both in webmail <em>and</em> with <em>Mailpile</em>, while avoiding to see duplicates of all emails you send, despite having a copy on remote servers.</strong><br />
(You can choose at any moment <em>not</em> to send a copy to yourself, and <em>not</em> to leave emails on remote servers.)<br />
<br />
<strong><em>JackDca</em> <a href="https://community.mailpile.is/t/mailpile-tutorial-for-newcomers/597/4?u=greenpark">kindly shared in-depth knowledge</a></strong>, <span class="fluo_green_bgnd"><strong>it does not happen with <em>any</em> ISP:</strong></span></p>
<blockquote>
<p>Regarding <strong>send(ing) an email to yourself from Mailpile</strong>, the behaviour depends on the ISP that you are using. Mailpile uses the Message-ID in the email metadata. Emails that have the same Message-ID are treated as duplicates and are not shown.<br />
Some ISPs replace the Mailpile-generated Message-ID of an outgoing email with their own, with the result that the received email will be shown in the Inbox.<br />
Other ISPs retain the Message-ID assigned by Mailpile so that the received email is ignored as a duplicate.</p>
</blockquote></li>
<li>When you add an email account and connect to its server, <em>Mailpile</em> by default starts downloading <em>all</em> emails in it, starting with the most recent ones, it doesn't at the moment offer an option to limit the synchronization to the last <em>n</em> days.<br />
It has been <a href="https://github.com/mailpile/Mailpile/issues/1098">suggested on <em>GitHub</em></a> to implement the option to limit download to the last <em>n</em> days. The project leader answered explaining that it isn't straightforward to implement that feature without having to parse all emails, considering that certain servers do not maintain an index on date-time.<br />
</li>
<li>I can't see pictures linked to remote storage embedded in emails, despite explicitly asking <em>Mailpile</em> to let me view those pictures.<sup>[<a href="#fn8" id="fnref8">8</a>]</sup><br />
<strong>I think it isn't an issue but a render feature not yet implemented.</strong><br />
There's an easy <strong>workaround: <a href="#saveMessageBody">save the email</a> and open it in your browser</strong>.<br />
It is actually the best thing to do, call it good practice. <em>Your browser</em> is what you use to surf the web with some protection against malign code, with your preferite plugins, and you might launch a <a href="#separateFirefoxInstance"><strong>completely separate session</strong></a> so an attack wouldn't directly arrive into your email client.<br />
</li>
<li><span class="fluo_orange_bgnd">I'll see if I can find a way</span> to tell <em>Mailpile</em> "please <strong>do check right now if there are any new incoming emails"</strong>.<sup>[<a href="#fn9" id="fnref9">9</a>]</sup> Often, when going online after some time offline, <em>Mailpile</em> with default source settings checks right away if there are incoming emails, but sometimes it doesn't. At worst, apparently, it's a matter of 5 minutes.<sup>[<a href="#fn10" id="fnref10">10</a>]</sup><br />
</li>
<li><span class="fluo_orange_bgnd">I'll see if I can find a way</span> to <strong>modify the format of a previously typed in e-mail address</strong>. For instance: I'm sending an e-mail, I type in the recipient's address, let's say [email protected] and, after realizing that only "info" shows up (unless hovering the mouse cursor), I decide to type in a differently formatted address, for instance:
<ul>
<li>Some Group <a href="mailto:[email protected]">[email protected]</a></li>
<li>"Some Group" <a href="mailto:[email protected]">[email protected]</a></li>
</ul>
but <em>Mailpile</em> will always reduce it to what I had typed before, showing just "info". <span class="fluo_orange_bgnd"><strong>[needs clarification]</strong></span><br />
</li>
<li><span class="fluo_orange_bgnd">I'll see if I can find a way</span> to <strong>change word wrap settings</strong>.
<ul>
<li>I don't always like the outcome of word wrapping (checking how my emails sent with <em>Mailpile</em> look in Thunderbird).</li>
<li>Saving a draft email implies wrapping. Retaking it, adding some text and sending can let the previous parts wrapped and the new one not wrapped.</li>
</ul>
I'd like to be able to just switch it off. <span class="fluo_orange_bgnd"><strong>[needs clarification]</strong></span><br />
</li>
<li>Mouse <a name="mouseHoverHintsInTheWay"></a>hover <strong>hints</strong> in the GUI sometimes get <strong>in the way</strong> of mouse operations, e.g. when deactivating digitally signing one mail. Simply <strong>enlarging horizontally</strong> my browser window solves it (<a href="#toolbarIconsBadlyPositioned">above</a> there is mention of another reason for it). </li>
<li>I can't edit the text signature at the bottom from inside a new email (something <em>Thunderbird</em> allows).<br />
For specific recipients, I might want to modify my signature at the bottom, e.g. omit my cell phone number or PGP related lines.<br />
Apparently <em>Mailpile</em> obliges me to change the signature in the profile. <span class="fluo_orange_bgnd"><strong>[needs clarification]</strong></span></li>
<li><p><strong>It's <a name="nothingElseWhileDeleting"></a>possibly good practice not to do anything else while <em>Mailpile</em> is permanently deleting emails</strong>. (Today I launched the delete command in the CLIto immediately delete various emails from my huge <em>GMail</em> setup, which was probably going to take a few seconds on this old computer, with fully encrypted index. So, after launching the delete command, I immediately started doing something else via <em>Mailpile</em>'s the GUI. The GUI worked fine but I got a message in the CLI that the delete operation had failed. I launched it again without doing anything else and it went through just fine.)</p></li>
</ul>
<p><a name="WishList"></a></p>
<h2 id="wish-list">Wish List</h2>
<p>I might be adding a few items in the future, but for now this is quite a short list.</p>
<p><a name="InListsOfEmails"></a></p>
<h3 id="in-lists-of-emails">In lists of emails</h3>
<ul>
<li>When the sender is one of the accounts I've configured in <em>Mailpile</em>, I'd like to see the recipient instead of the sender as a priority.</li>
<li>I'd like to be able to switch to date-hour visualization always, yyyy-mm-dd hh:mm:ss (or without seconds), instead of "Friday" or "10 hours".</li>
</ul>
<p><a name="EncryptionMadeEasy"></a></p>
<h2 id="encryption-made-easy-for-non-tech-savvies">Encryption made easy for non-tech savvies</h2>
<p><strong><em>Mailpile</em> can create and manage encryption keys for you, if you prefer, or it can use your own pre-existent keys.</strong></p>
<div class="fluo_green_frame">
<p>You can choose whether or not to let <em>Mailpile</em> memorize your keys passphrase, both for keys created by <em>Mailpile</em> and pre-existent keys.</p>
<p>Would it be more secure to type in the keys passphrase when <em>Mailpile</em> requires it once in a while?</p>
<p>That's <strong>quite a bet</strong>, I don't know if there are more chances that my keystrokes can be recorded at some point or that the encryption with which <em>Mailpile</em> saves my settings gets compromised (or even that a <a href="https://en.wikipedia.org/wiki/Side-channel_attack">side channel attack</a> grabs my secret keys <em>anyway</em>).<sup>[<a href="#fn11" id="fnref11">11</a>]</sup></p>
<p>The possibility to use <strong>a hardware device to hold your secret keys</strong> is <a href="#keysInHardwareDevice">mentioned below</a> in this document.</p>
</div>
<p><a name="Tags"></a></p>
<h2 id="tags">Tags</h2>
<p><em>Mailpile</em>'s GUI enables you to <a href="#UsingTags">classify selected messages</a> by a simple mouse-button click. <strong>Tags</strong> can work in two ways:</p>
<ul>
<li><strong>categories</strong> (like folders)</li>
<li><strong>attributes</strong> (cross-folders groups)</li>
</ul>
<p>Tags can also be <strong>nested</strong> one inside another. It is an extremely flexible tool to keep your messages organized.</p>
<p><a href="#Mailpile_CLI">From the CLI</a>, it is also possible to <a href="#TaggingUntaggingUsingTheCLI">tag and untag emails</a>.<br />
CLI + tags = a <em>powerful</em> mean to classify or trash or immediately delete huge amounts of emails.</p>
<p><a name="Design"></a></p>
<h2 id="design">Design</h2>
<p>The GUI is <em>beautifully</em> designed, keeping functionality in mind. One of <em>Mailpile</em> creators is a real designer.<sup>[<a href="#fn12" id="fnref12">12</a>]</sup></p>
<p><a name="EasySetup"></a></p>
<h2 id="easy-installation-and-setup">Easy installation and setup</h2>
<p>The installation procedure was very quick and easy on <em>Ubuntu Linux</em> 18.04<sup>[<a href="#fn13" id="fnref13">13</a>]</sup>, following the instructions on their <a href="http://www.mailpile.is">website</a> to add their repository.<sup>[<a href="#fn14" id="fnref14">14</a>]</sup></p>
<p><a name="MultipleAccounts"></a></p>
<h2 id="multiple-email-accounts">Multiple email accounts</h2>
<p><em>Mailpile</em> can handle multiple email accounts, I'm not losing this important feature switching from <em>Thunderbird</em>.</p>
<div class="fluo_green_frame">
<p>If you are not already used to having multiple email accounts in the same client at once, you might end up answering from one account an email you had received into another account.</p>
<ul>
<li>If you are using different accounts to simply keep things tidy and clearer for you, that's not a big deal.</li>
<li>If it's a matter of life and death, a mistake might put you in <strong>DANGER</strong>.<br />
In general, consider triple checking from which account you are sending an email, or consider handling one account at a time.<sup>[<a href="#fn15" id="fnref15">15</a>]</sup>
</div></li>
</ul>
<p><a name="HandsOn"></a></p>
<h1 id="hands-on-session">Hands-on session</h1>
<p>Again: I am using <em>Mailpile</em> 1.0.0rc6, which means the 6<sup>th</sup> candidate to become release 1.0.0.</p>
<p><strong>Here is a basic post installation startup tutorial.</strong></p>
<p>When I started this tutorial, I would have liked to have more emails to test on already, but with <em>Thunderbird</em> I used to <em>remove</em> emails from remote servers. I <em>enthusiastically</em> wanted to make this tutorial anyway, because I know quite a few different groups of persons who would be glad to use <em>Mailpile</em>, for instance a few journalists, and a friend in a humanitarian non-profit organization that was needing something exactly like <em>Mailpile</em>, to make a transition towards better protection of their supporters' privacy and financial data, while staying compatible with their pre-existent email services <em>and</em> being able to search through encrypted emails.</p>
<p><a name="StartingMailpile"></a></p>
<h2 id="starting-mailpile">Starting <em>Mailpile</em></h2>
<p>On Linux, I start <em>Mailpile</em> from the terminal window:</p>
<p><em>image 1</em><br />
<img src="pictures/mailpile__img_001.jpg" alt="img 1" /></p>
<h2 id="section"><br></h2>
<p><br> By default, <em>Mailpile</em> launches my web browser to be used as the Graphical User Interface.<sup>[<a href="#fn16" id="fnref16">16</a>]</sup></p>
<div class="fluo_green_frame">
<p>The fact that our <strong>web browser</strong> is used as the GUI empowers us to have <strong>various tabs open and connected to <em>Mailpile</em> at the same time, in order to keep going with various tasks</strong>. For instance, I could be preparing an email while searching in others or checking if any new incoming emails need an urgent replay.</p>
</div>
<p>Notice the URL: <strong><a href="http://localhost:33411/">localhost:33411</a></strong></p>
<p>"localhost" means that the web browser itself is connected to <em>Mailpile</em> which is running <em>locally</em> on my own machine, this browser tab does not connect directly to a remote server.</p>
<p><em>Mailpile</em> in turn is connecting to the remote servers of my email service providers, if possible, or it is enabling me to <strong>work on my emails in local storage, while staying offline</strong>.</p>
<p><em>image 2</em><br />
<img src="pictures/mailpile__img_002.jpg" alt="img 2" /></p>
<h2 id="section-1"><br></h2>
<br>
<p class="fluo_green_frame">
In the terminal window, you'll see that <em>Mailpile</em> also has a Command Line Interface (or just CLI).<sup>[<a href="#fn17" id="fnref17">17</a>]</sup>
</p>
<p>This is the command I've used to tell <em>Mailpile</em> <strong>"please send <em>now</em> the emails which already are in the Outbox"</strong>, when I was too impatient to wait during at most 90 seconds, which is the default interval for <em>Mailpile</em> to check if there are any emails in the Outbox:<sup>[<a href="#fn18" id="fnref18">18</a>]</sup><br />
<code>sendmail</code><enter></p>
<p>I can also access the Command Line Interface via the GUI, clicking the <strong><em>Settings and Tools</em></strong> gear icon in the upper right corner and then the <strong><em><> CLI</em></strong> button. I prefer the terminal window, which gives me more lines visible at the same time. Both ways, however, I can scroll up to see previous output.</p>
<p><strong>This document includes <a href="#Mailpile_CLI">a section</a> showing how to search and export emails or search and delete emails with the Command Line Interface.</strong></p>
<p><em>image 3</em><br />
<img src="pictures/mailpile__img_003.jpg" alt="img 3" /></p>
<p>Now let's go back to the GUI.</p>
<h2 id="section-2"><br></h2>
<p><br> <a name="FirstTimeSetup"></a></p>
<h2 id="first-time-setup">First-time setup</h2>
<p>I'll choose my preferred language and click the <strong><em>Begin</em></strong> button.</p>
<p><em>image 4</em><br />
<img src="pictures/mailpile__img_004.jpg" alt="img 4" /></p>
<h2 id="section-3"><br></h2>
<p><br> <a name="password"></a>I'm asked to type a password. Afterwards, the same password will be <em>necessary</em> to unlock the whole setup with my settings and emails.</p>
<p>It can actually be a passphrase made of various words separated by spaces. <em>Mailpile</em> itself suggests a sequence of words, I prefer to <em>create my own sequence</em> some of which modified from any vocabulary (avoiding obvious substitutions which would be part of hackers' dictionaries anyway), including uppercase and lowercase letters, numbers and special characters. After checking that no smartphone cameras or webcams are around, <strong>I write it down on paper first (no cameras around) and type it in afterwards, and keep the paper somewhere safe during the first few days.</strong> (The same when I <a href="#changePassword">change</a> it.)</p>
<p>But you might have other methods.</p>
<p><strong>Just don't lose or forget it!</strong></p>
<p><em>image 5</em><br />
<img src="pictures/mailpile__img_005.jpg" alt="img 5" /></p>
<h2 id="section-4"><br></h2>
<p><br></p>
<p><em>image 6</em><br />
<img src="pictures/mailpile__img_006.jpg" alt="img 6" /></p>
<p>After typing in the same password twice, I'm going to click the <strong><em>Set Mailpile Password</em></strong> button.</p>
<h2 id="section-5"><br></h2>
<p><br> And I'm ready to go.</p>
<p><em>image 7</em><br />
<img src="pictures/mailpile__img_007.jpg" alt="img 7" /></p>
<h2 id="section-6"><br></h2>
<p><br></p>
<p><em>image 8</em><br />
<img src="pictures/mailpile__img_008.jpg" alt="img 8" /></p>
<h2 id="section-7"><br></h2>
<p><br> On my first login, I am guided through the few easy basic setup steps.</p>
<p><em>image 9</em><br />
<img src="pictures/mailpile__img_009.jpg" alt="img 9" /></p>
<h2 id="section-8"><br></h2>
<p><br></p>
<p><em>image 10</em><br />
<img src="pictures/mailpile__img_010.jpg" alt="img 10" /></p>
<p>I scroll down...</p>
<h2 id="section-9"><br></h2>
<p><br> <a name="stronglyEncryptIndex_slow"></a></p>
<p><em>image 11</em><br />
<img src="pictures/mailpile__img_011.jpg" alt="img 11" /></p>
<p>My personal choice here is to change the above defaults as in the next picture, <strong>BUT</strong> you should read <a href="#warningSlow">this note</a> before deciding.</p>
<h2 id="section-10"><br></h2>
<p><br> <a name="SecurityAndPrivacySettingsModifiedFromDefaults"></a></p>
<p><em>image 12</em><br />
<img src="pictures/mailpile__img_012.jpg" alt="img 12" /></p>
<p>(Later, I've created a <a href="#MailpileFolderDefaultLocation">separate <em>Mailpile</em> setup</a> with my <a href="#MailpileWithGMail"><em>GMail</em></a> accounts (which I'd like to progressively abandon). <em>Mailpile</em> fetched <em>some</em> years of emails. My PC is <a href="#FastDespiteManyEmails">not too slow</a> for these settings, even with over 46k emails exceeding 14 GB.)</p>
<p>And I'll click the <strong><em>Save Settings</em></strong> button.</p>
<div class="fluo_green_frame">
You might want to read <a href="#UseSharedGnuPGkeychain">below</a> about the third setting I'm modifying: <strong><em>Use shared GnuPG keychain for PGP encryption keys</em></strong>
</div>
<h2 id="section-11"><br></h2>
<p><br></p>
<p><em>image 13</em><br />
<img src="pictures/mailpile__img_013.jpg" alt="img 13" /></p>
<h2 id="section-12"><br></h2>
<p><br></p>
<p><em>image 14</em><br />
<img src="pictures/mailpile__img_014.jpg" alt="img 14" /></p>
<p>I'll type in the name I want to be displayed with this email address and the email address itself.</p>
<h2 id="section-13"><br></h2>
<p><br></p>
<p><em>image 15</em><br />
<img src="pictures/mailpile__img_015.jpg" alt="img 15" /></p>
<p>And I'll click the <strong><em>Next</em></strong> button.</p>
<h2 id="section-14"><br></h2>
<p><br></p>
<p><em>image 16</em><br />
<img src="pictures/mailpile__img_016.jpg" alt="img 16" /></p>
<br> <a name="essentialPoints"></a>If you <strong>lack</strong> the <strong>time or will</strong> to read the following "not essential" section, then read this frame content (but I'd recommend that someday you read the part you are skipping now):<br />
<div class="fluo_green_frame">
<p>If anything more complicated than "normal"<sup>[<a href="#fn19" id="fnref19">19</a>]</sup> unencrypted emails means no encryption at all for you, then let's choose the easiest way for now, <em>any</em> level of security on your emails is better than none.</p>
<ol style="list-style-type: decimal">
<li>Check out <a href="#separateFirefoxInstance">this recommendation</a>.</li>
<li><strong>Remember <a name="forwardSecrecy"></a>that encrypting doesn't mean that you can be absolutely sure that your messages are and will always be secure</strong>.<br />
<em>GnuPG</em> doesn't support <strong>"forward secrecy"</strong>: <span class="fluo_green_bgnd">if a key is compromised then the secrecy of all past messages encrypted with it is compromised.</span><br />
<strong>You can periodically revoke secret subkeys (or even preliminary set an expiration date on them)</strong> and create new ones, but it's not the same as having different keys for each communication session.</li>
<li>Flip a coin to choose your key type. <a href="#ImayChoseRSA4096despite">I may still choose RSA4096 for now</a>, despite <a href="#Kleptography_NSA"><strong>RSA Security having been the target of strong accusations of adding backdoors</strong></a>. I may <a href="#HigherSecurity">add further encryption levels</a> with other encryption types for important messages.</li>
<li>Let <em>Mailpile</em> create and manage your keys for now.</li>
<li>Click the button and move on to the <a href="#accessingEmailAccount">next step</a>.</li>
</ol>
</div>
<p><br></p>
<big><span class="notEssent_security_bgnd_fg">This is not essential to use <em>Mailpile</em></span></big> <a name="AboutKeysAndSecurity"></a>
<div class="notEssent_security_frame">
<h1 id="about-keys-and-security-not-essential-to-use-mailpile">About keys and security – not essential to use <em>Mailpile</em></h1>
<p><strong><em>Mailpile</em></strong>, just as <em>Thunderbird</em>+<em>Enigmail</em>, can work in combination with <a href="https://www.gnupg.org/"><strong><em>GNU Privacy Guard</em></strong></a> to use all keys in its "keyring" (or "keychain").</p>
<p>We can let <em>Mailpile</em> handle <em>gpg</em> to create keys for us and totally manage them, or we can use <em>gpg</em> from a terminal window to create keys, import keys, export keys, and also encrypt symmetrically or asymmetrically, sign files, sign other persons' keys...</p>
<p>(I didn't plan to put any <em>GnuPG</em> commands in this document, because there are many good tutorials out there, but after mentioning <em>Mailpile</em> in an online<=><a href="#airGapped">air-gapped</a> workflow, I ended up doing so in an <a href="#gpgExamples">appendix</a>.)</p>
<p><strong><em>Mailpile</em> will be able to use any keys that we might import directly with <em>gpg</em> into its keyring.</strong></p>
<p><a name="UseSharedGnuPGkeychain"></a></p>
<div class="fluo_orange_frame">
<p>Please <strong>NOTE</strong> that one of the Security and Privacy settings I <a href="#SecurityAndPrivacySettingsModifiedFromDefaults">modified above</a> was <u><strong><em>Use shared GnuPG keychain for PGP encryption keys</em></strong></u> and I activated it.</p>
<p><u><strong>I haven't tested at all what happens with "Off", what follows is pure speculation and that setting might even have another meaning.</strong></u> <span class="fluo_orange_bgnd"><strong>[needs clarification]</strong></span></p>
<p><span class="fluo_orange_bgnd">If you do not want to have anything to do directly with <em>GnuPG</em>, you might want to leave that "Off", I don't know if doing so would imply a higher security level. <strong>[needs clarification]</strong></span></p>
<p>I prefer to be able to fully use <em>Mailpile</em> in combination with <em>gpg</em> on the command line.</p>
<p>Besides, in the <a href="https://github.com/mailpile/Mailpile/issues">GitHub page for <em>Mailpile</em> issues</a>, I've seen <span class="fluo_orange_bgnd">reports about difficulties to import keys via <em>Mailpile</em>'s GUI, while it's trivial to import keys with <em>GnuPG</em>'s command line:</span></p>
<p><code>gpg --import filename</code></p>
<p>(Those issues may have been solved by now. <span class="fluo_orange_bgnd"><strong>[needs clarification]</strong></span>)</p>
<p>As for the security level: I prefer to create my own keys apart with GnuPG, I set a stronger passphrase on my keys than <em>Mailpile</em>'s current passphrases, alphanumeric instead of numeric-only, and I keep the primary secret key stored apart, I only export secret subkeys and import them into the keychain I actually use. This way, <strong>the primary secret key remains valid as a long-term identity key</strong>, I can always revoke the secret subkeys, periodically or if I think that they might be compromised, and create new ones.</p>
<p>Unless you <em>really</em> prepare the whole <em>Mailpile</em>+<em>GnuPG</em> setup on some <a href="#airGapped">air-gapped</a> machine, this approach might actually turn out to be weaker than leaving it all to <em>Mailpile</em>, because at some point you would have to <strong>type</strong> the keys passphrase, at least twice, once when importing into the keyring, and once for <em>Mailpile</em>, and you don't know if those keystrokes are being recorded... This is about <strong>bets</strong>, make yours. If there isn't an option to prepare the whole <em>Mailpile</em>+<em>GnuPG</em> setup on some <a href="#airGapped">air-gapped</a> machine (at least for creating keys and moving secret subkeys to a <a href="#keysInHardwareDevice">hardware device</a>), then leaving it all to <em>Mailpile</em> might be the best bet after all.</p>
<p>On the other hand, you'll be typing <em>Mailpile</em>'s login password anyway, so the encryption on your local storage might also get compromised... well if somebody's <strong>"watching over your shoulder"</strong>, then simply nothing can be kept secure on that machine, unencrypted or decrypted messages will be exposed as well.</p>
<p>Better chances of security would be gained by also encrypting/decrypting exclusively on an <a href="#airGapped">air-gapped</a> machine, better if with a supposedly audited Operative System like <em>Tails</em>, especially at the moment of keys generation, to avoid <a href="#Kleptography_NSA">Kleptography</a>.</p>
<p>As for purely brutal force attacks on <span class="fluo_orange_bgnd">the local storage</span> encryption, they wouldn't probably be successful for a few more years.<br />
<span class="fluo_orange_bgnd">I don't know at the moment what type of encryption it is. <strong>[needs clarification]</strong></span><br />
The current PGP key of <em>Mailpile</em>'s developers team is EdDSA, a type of ECC, so maybe the local encryption scheme is also based on ECC. I've quoted something <a href="#EdDSA_ECC">below</a> about that.</p>
<p>Anyways:</p>
<ul>
<li><p><strong>If you do leave it all to <em>Mailpile</em>, you probably have one more good reason to always keep an updated backup copy of <a href="#MailpileFolderDefaultLocation">the whole <em>Mailpile</em> folder</a> (not only <em>Mailpile</em>'s settings backed up via <a href="#settingsBackup">the <em>Backup</em> button</a>), and <em>also</em> a backup copy of the <em>Mailpile</em> package that you have installed and has been running fine.</strong><br />
<span class="fluo_green_bgnd">Keeping a backup is a good practice anyway, <strong><em>Borg</em></strong> is a <em>very</em> good de-duplicating incremental backup utility, I hear from a very knowledgeable friend that <strong><em>Duplicata</em></strong> is another good one... or you might just copy the whole folder (in Linux: ~/.local/share/Mailpile).</span></p></li>
<li><p><strong>If a frequent backup of the whole <em>Mailpile</em> folder is <em>really</em> not an option for you for <em>who knows</em> what reason:</strong></p>
<p>Unless your philosophy is to "read and destroy" received encrypted emails, <span class="fluo_orange_bgnd">you should see if you can backup your secret keys anyway – and not only their passphrase<sup>[<a href="#fn20" id="fnref20">20</a>]</sup> – so you'd still be able to decrypt new incoming messages in case you run into problems with <em>Mailpile</em>. I won't investigate for now how to do that in case <a href="#UseSharedGnuPGkeychain">that option</a> is left "off". <strong>[needs clarification]</strong></span></p></li>
</ul>
<p>I describe <a href="#keysInHardwareDevice">below</a> how I handled secret keys for a <em>Yubikey 5 NFC</em>.</p>
</div>
<p><a name="TypesOfKeys"></a></p>
<h2 id="types-of-keys">Types of keys</h2>
<p>Keys can be of different <strong>types</strong>. Compatibility with Autocrypt mentioned below is "as far as I've read", it could be outdated info (but <span class="fluo_green_bgnd">a few tests</span> are enough to understand that it is a secondary importance matter):</p>
<ul>
<li><strong>EdDSA256</strong>, compatible with Autocrypt 1.1, which means that even the message subject will be encrypted, thus limiting the amount of data left visible by SMTP, the Send Mail Transfer Protocol<sup>[<a href="#fn21" id="fnref21">21</a>]</sup></li>
<li><strong>RSA3072</strong>, compatible with Autocrypt 1.0</li>
<li><strong>RSA4096</strong>, not compatible with Autocrypt... but when testing I see that <span class="fluo_green_bgnd">both <em>Mailpile</em> and <em>Thunderbird</em>+<em>Enigmail</em> circumvent the problem, only showing <strong>"(Subject unavailable)"</strong> or <strong>"..."</strong> as the email subject once it has been encrypted, revealing the original subject at the moment of decryption</span>. A correspondent using a client not implementing the same workaround would be able to read the subject anyway at the beginning of the message body, once decrypted.<br />
In any case: we can always arrange to write generic/allusive subjects not needing encryption.</li>
</ul>
<p><a name="ImayChoseRSA4096despite"></a><strong>Please share</strong> if you have more information to evaluate for this choice.</p>
<p><span class="fluo_green_bgnd"><strong>I may choose RSA4096</strong> as the basic key type associated with an account</span>, considering – and <span class="fluo_green_bgnd"><em>despite</em></span> – what follows, and considering the recommendations I've found in various <strong>tutorials</strong> about creating <em>GnuPG</em> keys, <a href="#perfectKeypair">one</a> is mentioned in the <a href="#gpgExamples">appendix with examples of usage of <em>GnuPG</em> in a <em>Linux</em> terminal command line</a>.</p>
<p>After reading below about <a href="#Kleptography_NSA">Kleptography</a>, you'll wonder, as I do:</p>
<center>
Were the tutorials I've seen made by backdoors creators pushing their trojan horses?<br />
I don't think so,<br />
but the truth is:<br />
<big><strong>I don't know</strong></big><sup>[<a href="#fn22" id="fnref22">22</a>]</sup>
</center>
<p>Let's see what Glenn Greenwald uses<sup>[<a href="#fn23" id="fnref23">23</a>]</sup>, I guess he learned from Edward Snowden:<sup>[<a href="#fn24" id="fnref24">24</a>]</sup></p>
<pre><code>pub rsa4096/0xA4A928C769CD6E44 2015-01-06 [SCA] [expires: 2021-01-19]
734A3680A438DD45AF6F5B99A4A928C769CD6E44
uid [ unknown] Glenn Greenwald <[email protected]>
uid [ unknown] Glenn Greenwald <[email protected]>
uid [ unknown] Glenn Greenwald <[email protected]>
uid [ unknown] Glenn Greenwald <[email protected]>
sub rsa4096/0x30B33AC842F37B85 2015-01-06 [E] [expires: 2021-03-05]</code></pre>
<p>That's one point for RSA4096.</p>
<p>And another one: <em>Mailpile</em> developers themselves qualify as "strong" the RSA4096 key type in that pull-down menu, meaning that they don't have elements against RSA4096 either (and they seem to know what they are doing, <em>Mailpile</em> can actually use or not use the pre-installed gpg-agent and gpg binary).</p>
<p>Now one point less for EdDSA:</p>
<p><a name="EdDSA_ECC"></a> This page tells us that <strong>EdDSA is based on elliptic-curve cryptography</strong>:<br />
<a href="https://en.wikipedia.org/wiki/EdDSA"><strong>EdDSA</strong> – https://en.wikipedia.org/wiki/EdDSA</a><br />
Such encryption, with shorter keys, might be as hard to break as RSA encryption with larger keys... <strong>except for quantum computing attacks</strong>.</p>
<p>Let's quote from this other page (please visit the page to also read those footnotes):<br />
<a href="https://en.wikipedia.org/wiki/Elliptic_curve_cryptography"><strong>Elliptic-curve cryptography</strong> – https://en.wikipedia.org/wiki/Elliptic_curve_cryptography</a></p>
<blockquote>
<p><strong>Quantum computing attacks</strong></p>
<p>Shor's algorithm can be used to break elliptic curve cryptography by computing discrete logarithms on a hypothetical quantum computer. The latest quantum resource estimates for breaking a curve with a 256-bit modulus (128-bit security level) are 2330 qubits and 126 billion Toffoli gates.<sup><sub><del>[43]</del></sub></sup> In comparison, using Shor's algorithm to break the RSA algorithm requires 4098 qubits and 5.2 trillion Toffoli gates for a 2048-bit RSA key, <span class="fluo_green_bgnd">suggesting that ECC is an easier target for quantum computers than RSA. All of these figures vastly exceed any quantum computer that has ever been built, and estimates place the creation of such computers as a decade or more away.</span>[citation needed]</p>
<p>Supersingular Isogeny Diffie–Hellman Key Exchange provides a post-quantum secure form of elliptic curve cryptography by using isogenies to implement Diffie–Hellman key exchanges. This key exchange uses much of the same field arithmetic as existing elliptic curve cryptography and requires computational and transmission overhead similar to many currently used public key systems.<sup><sub><del>[44]</del></sub></p>
<p><span class="fluo_green_bgnd">In August 2015, the NSA announced that it planned to transition "in the not distant future" to a new cipher suite that is resistant to quantum attacks. "Unfortunately, the growth of elliptic curve use has bumped up against the fact of continued progress in the research on quantum computing, necessitating a re-evaluation of our cryptographic strategy."</span></p>
</blockquote>
<p><a name="HigherSecurity"></a></p>
<h2 id="higher-security-superposing-encryption-levels">Higher security: superposing encryption levels</h2>
<p>Whatever setup we have chosen now, if in the future we need a higher security level on some emails we can superpose one or more encryption steps.</p>
<ul>
<li><p><strong>we create apart another key</strong> (primary + subkeys), our correspondent does the same</p>
<p>"apart" meaning possibly on <em>Tails</em> (see <strong>Kleptography</strong> <a href="#Kleptography_NSA">below</a>), because <em>GnuPG</em> on <em>Tails</em> should undergo stricter auditing than for instance on <em>Ubuntu</em> and <em>Windows</em><sup>[<a href="#fn25" id="fnref25">25</a>]</sup>, it could be an <a href="#airGapped">air-gapped</a> computer or the keys could stay on a <a href="#keysInHardwareDevice">hardware device</a></p></li>
<li><strong>we encrypt apart</strong> using <em>gpg</em> command line, with the --armor option</li>
<li><p><strong>we paste the result</strong> of the encryption into our email body <strong>or attach it</strong> (in which case better avoid the --armor option not to unnecessarily inflate size), so our message will be <strong>encrypted twice</strong> with two different keys (or more than two).</p></li>
</ul>
<p>This is not difficult at all, at least on any <em>Linux</em>-based machine (I can only guess that <em>gpg</em> takes the same command line syntax in <em>Windows</em>). Just check out the <a href="#gpgExamples">appendix on <em>GnuPG</em></a>, especially <a href="#EncryptingSigning">this part</a>.</p>
<p><a name="otherCommTools"></a></p>
<h2 id="other-communication-tools-than-email">Other communication tools than email</h2>
<p>The "encrypt apart and attach or copy&paste" modus operandi opens the possibility to use <em>GnuPG</em> to add secrecy to other communication channels instead of e-mail, e.g. <em>Threema</em> via <a href="https://web.threema.ch">web.threema.ch</a> or <em>Signal</em> via its desktop app (without forgetting that our smartphones are probably the least secure devices around), or maybe <a href="https://element.io/">Element</a>, which is mentioned in this <a href="https://www.privacytools.io/software/real-time-communication/">interesting page on privacytools.io</a>. Without forgetting that <em>GnuPG</em> doesn't support <a href="#forwardSecrecy">forward secrecy</a>.</p>
<p><a name="keysTheft"></a></p>
<h2 id="keys-theft">Keys theft</h2>
<p>After plainly stealing my secret keys <em>from storage space</em>, the attacker should <em>crack</em> its encryption. I'm setting <em>strong passphrases</em>, but today's computers are increasingly fast (and keystrokes could be monitored/recorded).</p>
<p><a name="keysInHardwareDevice"></a></p>
<h2 id="keeping-secret-subkeys-on-a-hardware-device">Keeping secret subkeys on a hardware device</h2>
<div class="fluo_green_frame">
<p><strong>DISCLAIMER:</strong> I'm not getting <em>any compensation whatsoever</em> from <em>Yubico</em> (alas LOL), I'm just sharing possibly useful info. This device happens to be the one I <em>bought</em>, I can't say anything about any others.</p>
</div>
<p>
</p>
<div class="fluo_green_frame">
<p><strong>CAVEAT:</strong> Keeping secret subkeys on a hardware device is probably pretty good against keys theft and should grant that what's <em>signed</em> with your signing subkey is actually signed <em>by you</em>.</p>
<p><strong>As for secrecy:</strong></p>
<ul>
<li>again, the fact that they can't steal your secret subkeys prevents that they can use them elsewhere at will</li>
<li><strong>BUT</strong>
<ul>