Am I reading correctly that ~“GPG private keys were stored unencrypted” and ~“messages could be modified to include non-encrypted chunks, which the client displayed without indicating the distinction” both count as low-severity?
This reminds me of the fact that Firefox, by default, allows anyone to view stored credentials – no authentication required, as no master password is set. It boggles my mind.
Well it's not ideal, but it assumes the computer it is stored on is securely protected, so Thunderbird would not be the weakest link here.<p>Protecting this key would require to ask a password to the user.<p>By default there are none, but users who use gpg are aware of security and would generally set a master password.