4 ms·
This doesn't make sense. PGP is encryption software, whereas S/MIME is an encryption standard. It's like saying that a vulnerability affetcts users of OpenSSL
by jwilk 8y ago
This doesn't make sense.
PGP is encryption software, whereas S/MIME is an encryption standard.
It's like saying that a vulnerability affetcts users of OpenSSL and RSA.
- viraptor 8y agoPGP is both software and an encryption system. (https://tools.ietf.org/html/rfc4880 https://tools.ietf.org/html/rfc4880)
- irundebian 8y agoTo be more precise, the standardized encryption system is called OpenPGP (RFC4880) whereas PGP is the name of tool which was written by Phil Zimmermann.
- scandox 8y agoThough it would appear the source of the original PGP software is no longer publicly accessible [1], so how would one know if it was vulnerable? I think the EFF probably meant people using various implementations right? [1] https://philzimmermann.com/EN/findpgp/ https://philzimmermann.com/EN/findpgp/
- irundebian 8y agoYes, especially mail solutions which are using OpenPGP implementations such as GnuPG. It looks like its rather an mail client issue than an OpenPGP implementation issue: https://twitter.com/gnupg/status/995931083584757760?s=19 https://twitter.com/gnupg/status/995931083584757760?s=19
- jstanley 8y agoGood point. One of the researchers' tweets[0] was: > You can still disable it in the config. If use S/MIME for sensitive information, disable it for now. which would imply that it's not remote code execution, otherwise it would be worth disabling S/MIME whether you use it for sensitive information or not. [0] https://twitter.com/seecurity/status/995914298512887808 https://twitter.com/seecurity/status/995914298512887808
- avian 8y agoIt makes sense to me. They are saying that there is a bug in the way PGP (software) handles S/MIME (standard). People that are using both (the software and the standard) are at risk.