[Feature Request] PGP sign and/or encrypt E-Mails

[DunklerPhoenix]

Heho
It would be great if E-Mails can be signed or encrypted by an PGP key. The user should decide which mail-type should be normal, signed or encrypted.

Maybe this is not possible, because Bitwarden itself doesn't support the options.

[BlackDex]

That would be very difficult to configure i think.
There isn't an option for this within the user interface to add or modify there public PGP key which is needed for the encryption.
Without this the server would need to try and guess where they need to download the key from if that is possible at all.

Facebook for example has this feature. But there you need to upload your public key so that they can use that with there key to encrypt the message.

So, i do not think this is a feasible option to try and implement.

[DunklerPhoenix]

I thought some hours about a solution, but everything is to complicated for an average user. The public key wouldn't be the greatest difficult, but more the options for changing the settings per mail type.

[BlackDex]

Well, that doesn't exists for one. Second, that should be build into the web-vault how you would suggest it, which is not something we want to do. We want to keep as close as possible to the upstream releases, and adding something like this would mean a lot of changes and adjustments.

[tamaskan]

It doesn't have to be build in, except the changes to the mail-function. I don't know rust, so i can't provide an example, sorry.

[BlackDex]

You mentioned a page after login/register, that is not something we controle, and thus need to change.
That whole part has nothing to do with Rust btw.

[tamaskan]

I guess the easiest way would be to fuse a custom sendmail with pgp like https://github.com/tamaskan/sendmail-pgp/tree/main and add a small node-website via proxy to handle the key-upload. That way there would be no need to touch the vaultwarden-code at all :-)

[BlackDex]

Well, nobody is stopping you from implementing something like that.

While i do like the feature, I do not think it will be part of Vaultwarden (or Bitwarden) in the near future.
If someone finds a nice way without changing the web-vault in a way that makes it unmaintainable when there are large changes done upstream, or even without changing the web-vault, but still have a secure way to verify the user is correct which uploads the key, then we are open for a well written PR.