Add-ons
Attachment Crypt 0.7.2
by Michael
When attaching a file, subtly asks if the content should be encrypted. The file is packaged into an HTML file that self-decrypts using the passphrase. Runs entirely locally.
About this Add-on
Attachment Crypt enables local and secure encryption of email attachments without external dependencies or server services.
Important Security Note: Attachment Crypt is not a full replacement for S/MIME or PGP. The email itself (subject, message body, sender, recipient, and approximate file size) remains unencrypted. However, it offers an ideal solution for recipients without a PGP or S/MIME setup to transmit attachments securely, as the recipient does not need to install any additional software.
Key Features & Operation
Seamless Integration into the Compose WindowAutomatic Prompt: When adding an attachment, a small bar appears in the bottom-right corner of the compose window asking: "Encrypt attachment?"
Simple Controls: Clicking "No" leaves the attachment unchanged; "Encrypt..." opens the passphrase options.
Manual Trigger: The add-on can also be triggered at any time via the toolbar button "Encrypt attachments (Attachment Crypt)".
Self-Decrypting HTML Format
The attachment is packaged locally into a single HTML file (e.g., cloud-42.html).
No Additional Software Required for the Recipient: The recipient opens the file in a standard desktop web browser, enters the passphrase provided via a separate channel, and retrieves the original file.
Secure Passphrase Vault
Master Password Protection: Optionally stores passphrasings AES-256-GCM encrypted, mapped to the recipient's email address.
No Automatic Insertion: For security reasons, passphrases are never inserted automatically; they are only applied manually via click.
Automatic Lock: The vault locks automatically after 15 minutes of inactivity or when Thunderbird is closed.
Security Mechanisms: Rate-limiting delay on failed password attempts as well as two-step confirmation when displaying or deleting entries.
Convenience & Personalization
Passphrase Generator: Generates strong, easy-to-remember word combinations (Default: 8 words ≈ 63 bits).
Clipboard: Offers the option to automatically clear copied passphrases from the clipboard after 60 seconds.
Company Branding: Organizations can add their company name and custom logo, which are embedded into the recipient's HTML file.
Technical Details & SecurityEncryption Standards:
Algorithm: AES-256-GCM.
Key Derivation: PBKDF2-SHA256 (default: 1,200,000 rounds, customizable up to 5,000,000).
Authenticated Data Format: New SEC2 format, which protects header data (salt, IV, rounds) against tampering.
Minimum Strength: Passphrases under approx. 40 bits are rejected for security.
Fully Local: All encryption processes run entirely in the local machine's memory. There is no telemetry, no external server connections, and no third-party library dependencies.
Strict Content Security Policy (CSP): Maximum protection of background scripts and the generated recipient page against code injection.
Important Security Note: Attachment Crypt is not a full replacement for S/MIME or PGP. The email itself (subject, message body, sender, recipient, and approximate file size) remains unencrypted. However, it offers an ideal solution for recipients without a PGP or S/MIME setup to transmit attachments securely, as the recipient does not need to install any additional software.
Key Features & Operation
Seamless Integration into the Compose WindowAutomatic Prompt: When adding an attachment, a small bar appears in the bottom-right corner of the compose window asking: "Encrypt attachment?"
Simple Controls: Clicking "No" leaves the attachment unchanged; "Encrypt..." opens the passphrase options.
Manual Trigger: The add-on can also be triggered at any time via the toolbar button "Encrypt attachments (Attachment Crypt)".
Self-Decrypting HTML Format
The attachment is packaged locally into a single HTML file (e.g., cloud-42.html).
No Additional Software Required for the Recipient: The recipient opens the file in a standard desktop web browser, enters the passphrase provided via a separate channel, and retrieves the original file.
Secure Passphrase Vault
Master Password Protection: Optionally stores passphrasings AES-256-GCM encrypted, mapped to the recipient's email address.
No Automatic Insertion: For security reasons, passphrases are never inserted automatically; they are only applied manually via click.
Automatic Lock: The vault locks automatically after 15 minutes of inactivity or when Thunderbird is closed.
Security Mechanisms: Rate-limiting delay on failed password attempts as well as two-step confirmation when displaying or deleting entries.
Convenience & Personalization
Passphrase Generator: Generates strong, easy-to-remember word combinations (Default: 8 words ≈ 63 bits).
Clipboard: Offers the option to automatically clear copied passphrases from the clipboard after 60 seconds.
Company Branding: Organizations can add their company name and custom logo, which are embedded into the recipient's HTML file.
Technical Details & SecurityEncryption Standards:
Algorithm: AES-256-GCM.
Key Derivation: PBKDF2-SHA256 (default: 1,200,000 rounds, customizable up to 5,000,000).
Authenticated Data Format: New SEC2 format, which protects header data (salt, IV, rounds) against tampering.
Minimum Strength: Passphrases under approx. 40 bits are rejected for security.
Fully Local: All encryption processes run entirely in the local machine's memory. There is no telemetry, no external server connections, and no third-party library dependencies.
Strict Content Security Policy (CSP): Maximum protection of background scripts and the generated recipient page against code injection.
