search

ProtonMail / proton-bridge

Proton Mail Bridge application
GNU General Public License v3.0
1.14k stars 153 forks source link

Security issue: SMIME signature verification is still broken #216

Open tk-innoq opened 2 years ago

tk-innoq commented 2 years ago

ProtonMail is still breaking email headers as already described in:

Expected Behavior

ProtonMail should by no means alter any contents/headers of incoming mails from a third party.

Current Behavior

ProtonMail changes the Mime-Type of a signed message:

Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="-- vs. Content-Type: multipart/mixed; boundary=

Message integrity cannot verified any more.

Possible Solution

Do not touch mail headers or content of signed messages.

Steps to Reproduce

Send a SMIME signed mail to a ProtonMail account.

Version Information

ProtonMail 4.0.5 and ProtonMailBridge still do not work.

jwflory commented 2 years ago

Hi, I ran into an issue with S/MIME signatures and wanted to confirm if it was related to this issue.

When I send an email from Thunderbird via the Bridge, the email body appears as an attached text file in Office 365 mail clients:

Screenshot of an email in Outlook (Office 365) showing an empty email with a text file attached

Screenshot of the text file attachment in previous image.

When I send mail from mail.protonmail.com, the email renders correctly:

Screenshot of an email in Outlook (Office 365) rendering correctly in the body content of the email, not as an attachment.

Is this related or should I open a new bug?

andrzejsza commented 2 years ago

please open a new bug @jwflory - the first issue reported here is known but what you are describing is not. we'll look into different request sent from webclient and bridge to try and unravel this.

jwflory commented 2 years ago

@andrzejsza Acknowledged, I opened #230 for my issue.

LBeernaertProton commented 1 year ago

@tk-innoq is this still an issue for you with the latest version of Bridge?

Neustradamus commented 1 year ago

To follow this ticket

tk-innoq commented 9 months ago

@LBeernaertProton After two years I checked it again with Bridge Version 3.6.1. The issue is still the same as described in the ticket.

LBeernaertProton commented 9 months ago

After some investigation, it seems we currently can't correctly support this in the proton API. We will internally evaluate how to best proceed to support this use case, but we can't promise any ETA at this point.

GGORG0 commented 2 weeks ago

Hi, are there any news on this topic?