4 ms·

Robert Hansen just sent the following email to the gnupg-users list: to GnuPG-Users [taps the mike] Hi. I maintain the official GnuPG FAQ. So let me start

Robert Hansen just sent the following email to the gnupg-users list: to GnuPG-Users [taps the mike] Hi. I maintain the official GnuPG FAQ. So let me start off by answering a question that is certainly about to be asked a lot: "Should we be worried about OpenPGP, GnuPG, or Enigmail? The EFF's advising us to uninstall it!" https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now https://www.eff.org/deeplinks/2018/05/attention-pgp-users-ne... Werner saw a preprint of this paper some time ago. I saw it recently. Patrick Brunschwig of Enigmail saw it. None of us are worried. Out of respect for the paper authors I will skip further comment until such time as the paper is published. It would've been nice if EFF had reached out to us for comment, rather than apparently only talking to the paper authors. We hope they'll reach out next time.

patoh 8y ago
Werner Koch goes into further detail at the start of the gnupg-users thread @ https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060315.html https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06031...
- sambe 8y ago
  I'm reading this message with little context but it doesn't strike me as having reasons not to be worried. The two suggestions are: a) not to use HTML emails, which seems unlikely in practice; b) to use an obscure-sounding mode which has been implemented in such a way as to depend on the MUA doing multiple things correctly after the GPG code runs. What am I missing here? Is the latter mode on by default and MUA are widely known to correctly deal with the error code in a secure way?
  - klez 8y ago
    > not to use HTML emails, which seems unlikely in practice In a context where pgp is used, which is not me receiving promotional material or forwards from Grandma, why do you consider it unlikely that mail is to be sent as plaintext and not as html?
    - deong 8y ago
      Almost every email client defaults to HTML. There are going to be people using both encryption and HTML.
      - e12e 8y ago
        The idea that you can combine full hypertext and security is absurd. IMNHO this is the most significant problem with email (and many "secure" messaging stacks that allow "rich content"). Sure, it's possible to define a secure subset of html (basically bold/italics/underline, tables and headers). But everyone adds transclusion (in-line rendering of linked content, which leaks data and opens up the door to bugs), fonts (ie: programs), images (historically not a great idea), and some even Javascript! And that's not even all the muas that runs in the browser, and try to expose some safe subset of itself to be used for rendering the mail body. So, html Email is insecure, when contrasted with plain text email. Using pgp as "code signing" for hypertext applications ("html emails") isn't nearly enough. Sadly, afaik there's no agreed "safe" rich text format for mail. Absurdly rtf would probably be better than html mail. Anyway, I don't see how anyone could expect html mail to be safe in the first place.
    - Xylakant 8y ago
      Afaics the attacker gets to pick the format.
      - klez 8y ago
        I'll rephrase what I was trying to say: If I'm expecting encrypted email, I don't expect it formatted as HTML, so I can just disable its rendering. At which point the attacker can send it any format they want, my mail client just won't render it. The parent to my comment says this is unlikely, and I don't understand why. Hence my asking (and now I see I phrased it the opposite way).
        CJefferson 8y ago
        The problem is this seems like fragile security -- most mail clients do render HTML, so better make sure that option never gets set to on, or you are hosed.
  - dmix 8y ago
    > a) not to use HTML emails, which seems unlikely in practice I've always used plaintext when using PGP, same with others who have used it with me... I thought it was standard practice. I don't see the point in using HTML for one-on-one encrypted conversations. HTML is for newsletters and similar content. Although I assume this means "don't use HTML at all in your client, not just for encrypted email".
    - pera 8y ago
      Same here, just good ol' plain text and inlined pgp :)

patoh 8y ago

Werner Koch goes into further detail at the start of the gnupg-users thread @ https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060315.html https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06031...

sambe 8y ago
I'm reading this message with little context but it doesn't strike me as having reasons not to be worried. The two suggestions are: a) not to use HTML emails, which seems unlikely in practice; b) to use an obscure-sounding mode which has been implemented in such a way as to depend on the MUA doing multiple things correctly after the GPG code runs. What am I missing here? Is the latter mode on by default and MUA are widely known to correctly deal with the error code in a secure way?
- klez 8y ago
  > not to use HTML emails, which seems unlikely in practice In a context where pgp is used, which is not me receiving promotional material or forwards from Grandma, why do you consider it unlikely that mail is to be sent as plaintext and not as html?
  - deong 8y ago
    Almost every email client defaults to HTML. There are going to be people using both encryption and HTML.
    - e12e 8y ago
      The idea that you can combine full hypertext and security is absurd. IMNHO this is the most significant problem with email (and many "secure" messaging stacks that allow "rich content"). Sure, it's possible to define a secure subset of html (basically bold/italics/underline, tables and headers). But everyone adds transclusion (in-line rendering of linked content, which leaks data and opens up the door to bugs), fonts (ie: programs), images (historically not a great idea), and some even Javascript! And that's not even all the muas that runs in the browser, and try to expose some safe subset of itself to be used for rendering the mail body. So, html Email is insecure, when contrasted with plain text email. Using pgp as "code signing" for hypertext applications ("html emails") isn't nearly enough. Sadly, afaik there's no agreed "safe" rich text format for mail. Absurdly rtf would probably be better than html mail. Anyway, I don't see how anyone could expect html mail to be safe in the first place.
  - Xylakant 8y ago
    Afaics the attacker gets to pick the format.
    - klez 8y ago
      I'll rephrase what I was trying to say: If I'm expecting encrypted email, I don't expect it formatted as HTML, so I can just disable its rendering. At which point the attacker can send it any format they want, my mail client just won't render it. The parent to my comment says this is unlikely, and I don't understand why. Hence my asking (and now I see I phrased it the opposite way).
      - CJefferson 8y ago
        The problem is this seems like fragile security -- most mail clients do render HTML, so better make sure that option never gets set to on, or you are hosed.
- dmix 8y ago
  > a) not to use HTML emails, which seems unlikely in practice I've always used plaintext when using PGP, same with others who have used it with me... I thought it was standard practice. I don't see the point in using HTML for one-on-one encrypted conversations. HTML is for newsletters and similar content. Although I assume this means "don't use HTML at all in your client, not just for encrypted email".
  - pera 8y ago
    Same here, just good ol' plain text and inlined pgp :)