E-mail clients like Thunderbird and Mail.app support S/MIME out of the box but various essential components are missing.
For example, e-mails aren't automatically upgraded to encrypt when it's detected that a public key for the recipient exists in your keystore for Thunderbird. Various other conditions lead many e-mails to be sent that you may believe are signed and encrypted but are not. This functionality could be investigated in the open-source Thunderbird repository and changed or added to.
https://www.mozilla.org/en-US/contribute/https://wiki.mozilla.org/Thunderbird
As another example, attackers may find an unscrupulous CA to sign a CSR and get an S/MIME cert in the name of a friend of yours. Mail.app provides little to no facilities to check whether the S/MIME cert used by a third party is the one you expect. It's not possible to view the certificate used to sign a message from the message display, compare it to previous certificates used by that sender, or inspect that the keys used were strong enough to resist cracking. Changing this functionality would require developing a plugin, similar to GPGTool's GPGMail which is open-source and might serve as a template.
https://github.com/GPGTools/GPGMailhttps://developer.apple.com/library/mac/#documentation/CoreFoundation/Conceptual/CFBundles/Introduction/Introduction.html
E-mail clients like Thunderbird and Mail.app support S/MIME out of the box but various essential components are missing.
For example, e-mails aren't automatically upgraded to encrypt when it's detected that a public key for the recipient exists in your keystore for Thunderbird. Various other conditions lead many e-mails to be sent that you may believe are signed and encrypted but are not. This functionality could be investigated in the open-source Thunderbird repository and changed or added to. https://www.mozilla.org/en-US/contribute/ https://wiki.mozilla.org/Thunderbird
As another example, attackers may find an unscrupulous CA to sign a CSR and get an S/MIME cert in the name of a friend of yours. Mail.app provides little to no facilities to check whether the S/MIME cert used by a third party is the one you expect. It's not possible to view the certificate used to sign a message from the message display, compare it to previous certificates used by that sender, or inspect that the keys used were strong enough to resist cracking. Changing this functionality would require developing a plugin, similar to GPGTool's GPGMail which is open-source and might serve as a template. https://github.com/GPGTools/GPGMail https://developer.apple.com/library/mac/#documentation/CoreFoundation/Conceptual/CFBundles/Introduction/Introduction.html