4 ms·
Good point. I wonder what kind of flaw in PGP's design could make it unsafe to decrypt incoming mails.
by jstanley 9y ago
Good point.
I wonder what kind of flaw in PGP's design could make it unsafe to decrypt incoming mails.
- skunkworker 9y agoIt'll be interesting to see the flaw that many pgp clients all seemed to implement in the same/similar ways.
- im3w1l 9y agoAt a guess: 1. Take previous email (X) that you want to decrypt. 2. Apply transformation (this is the actual secret sauce) to previous X to get email Y. 3. Because of how Y was constructed, decrypting it causes X to be decypted. 4. Phone home with the result by using some kind of tracking pixel. My reasoning is that they didn't talk about RCE and they didn't talk about stealing the key, and they did warn about automatic decryption, so it should be about tricking the decryptor into decrypting whatever you want for you.
- jstanley 9y agoUpdate: you were right :)