7 ms·

Response by Werner Koch (GPG), contains some details: https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060315.html https://lists.gnupg.org/pipermail/gnup

• Sniffnoy 8y ago
  So in short, if you have all mails set to display as plain text rather than HTML, there's no problem?
  • jabot 8y ago
    to quote the letter: There are two ways to mitigate this attack - Don't use HTML mails. Or if you really need to read them use a proper MIME parser and disallow any access to external links. - Use authenticated encryption.
    • deleted 8y ago
      [deleted]
  • gsich 8y ago
    Like every sane person should do.
    • tzs 8y ago
      That ship sailed when email got named email instead of etelegram.
      • arcbyte 8y ago
        I'm stealing etelegram for a new startup I'm going to make
        • jecxjo 8y ago
          Aren't telegrams already "e"?
      • gsich 8y ago
        Why do you think so? People are not forced to use HTML mails. I don't.
        • tzs 8y ago
          Oh, I thought you were making the "email should only be text" argument, not the "you should avoid looking at the non-text part of multipart email" argument. I was addressing the former.
• simias 8y ago
  >Due to broken MIME parsers a bunch of MUAs seem to concatenate decrypted HTML mime parts which makes it easy to plant such HTML snippets. To me this sounds strictly like a MUA issue, not a PGP/SMIME one. If that's really all it is it does seem massively overblown to me. Why not single out the broken MUA implementations instead of saying "don't decrypt emails OR YOU'LL DIE"? I mean just look at the wild speculation in this thread, nobody understood what was going on or even what was really vulnerable and what wasn't. Given the alarmist tone and the claims of "no workaround available" I was personally expecting a deep conceptual flaw in PGP/SMIME themselves. Terrible communication IMO. The parent email in the GnuPG thread seems to agree: https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060317.html https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06031... We'll know for sure tomorrow I suppose.
  • spacenick88 8y ago
    Sounds like this has been handled absolutely terrible both by the original researchers and EFF. The researcher then trying to shush the directly affected GPG developers on Twitter, evidently just for the sake of a stupid no-prior publication bullshit for their paper just adds to it.
  • virusduck 8y ago
    I dunno, a client issue like this seems pretty terrible to me since there is no obvious (to me) way to fix it. If I am encrypting a message, I have no control over what client decrypts it (and whether that client unwittingly passes the information along) without maybe changing the standard completely. The thing is, If I am reading correctly, it seems like this kind of vulnerability seems totally predictable.
    • simias 8y ago
      I agree, after getting the details it's fair to say that while some MUAs should fix their handling of encrypted emails PGP implementations and the S/MIME standard shares a part of the blame by not detecting and preventing the decoding of tampered documents. Still, the way the problem was disclosed is rather misleading and confusing.
• mike-cardwell 8y ago
  Time to start testing your email clients with https://www.emailprivacytester.com https://www.emailprivacytester.com