4 ms·

Also relevant https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060320.html https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06032...

jwilk 8y ago
This seems to contradict the earlier claim that "the GnuPG team was not contacted by the researchers".
- Foxboron 8y ago
  It however confirms that the OpenPGP devs had no knowledge of an embargo, and thus didn't break any embargo. Sebastian Schinzel claimed they had to publish early because the embargo broke.
- tripzilch 8y ago
  As far as I understand it, the earliest communication was 2017/11/24, which they addressed as it appeared that GnuPG wasn't vulnerable as it would fail with an error message when processing the exploit as it was known in November. A few days later, they got an email asking for a phone call, which wasn't followed up upon--I'm not sure to what extent this is GnuPG's fault, whether this is a usual way of communicating a serious vulnerability. It would've been better if they called em back, definitely goes for both parties. Then after a few months of silence, 2.5 weeks ago, they received another email with a different title that, according to Werner Koch, was too redacted to act upon: On 2017-11-29 we got a short mail asking for a phone call. It might be that I did not reply to that but in any case my office phone number is easy to lookup. I did not get a phone call. Since then we have not seen any more communication - not even about the proposed coordinated public disclosure. Thus I closed this issue in December and forgot about it. On 2018-04-27 I received another paper via a Kmail developer which had a different title than the one from November *** DO NOT PUBLISH OR SHARE ON PUBLIC MAILING LISTS *** Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels and no author names etc. The GnuPG team discussed this but did not see that any action was required. In particular because due to the redaction we were not able to contact and help the developers of other MUAs which might be affected. I mean yeah, in theory, BOTH parties could have been better at communicating and following up on it. But both parties are probably very busy and this kind of "no you call me back" is the sort of thing that falls through if you have to make choices about what to spend limited time on. That's why there exists protocol and coordination to tell something is really serious/urgent. It does seem to me that the security researchers were a bit too trigger-happy on the redacting of information, in particular unnecessarily so in private emails to the security folk they expected to act on the vulnerability.
- AnaniasAnanas 8y ago
  Maybe they forgot about it, or assumed that it was a different vulnerability especially since the original was a non-issue. Not a terrible thing to assume when the last communication with them was 6 months ago and they did not bother to give them the new paper. IMHO, the only unethical part on the side of the researchers is that they spread the whole "GPG is vulnerable!" FUD and went directly to the media when they had been informed that this is not a GPG issue beforehand. The other unethical part is that the EFF and the media companies did not bother to take GPG's side of the story.

jwilk 8y ago

This seems to contradict the earlier claim that "the GnuPG team was not contacted by the researchers".

Foxboron 8y ago
It however confirms that the OpenPGP devs had no knowledge of an embargo, and thus didn't break any embargo. Sebastian Schinzel claimed they had to publish early because the embargo broke.
tripzilch 8y ago
As far as I understand it, the earliest communication was 2017/11/24, which they addressed as it appeared that GnuPG wasn't vulnerable as it would fail with an error message when processing the exploit as it was known in November. A few days later, they got an email asking for a phone call, which wasn't followed up upon--I'm not sure to what extent this is GnuPG's fault, whether this is a usual way of communicating a serious vulnerability. It would've been better if they called em back, definitely goes for both parties. Then after a few months of silence, 2.5 weeks ago, they received another email with a different title that, according to Werner Koch, was too redacted to act upon: On 2017-11-29 we got a short mail asking for a phone call. It might be that I did not reply to that but in any case my office phone number is easy to lookup. I did not get a phone call. Since then we have not seen any more communication - not even about the proposed coordinated public disclosure. Thus I closed this issue in December and forgot about it. On 2018-04-27 I received another paper via a Kmail developer which had a different title than the one from November *** DO NOT PUBLISH OR SHARE ON PUBLIC MAILING LISTS *** Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels and no author names etc. The GnuPG team discussed this but did not see that any action was required. In particular because due to the redaction we were not able to contact and help the developers of other MUAs which might be affected. I mean yeah, in theory, BOTH parties could have been better at communicating and following up on it. But both parties are probably very busy and this kind of "no you call me back" is the sort of thing that falls through if you have to make choices about what to spend limited time on. That's why there exists protocol and coordination to tell something is really serious/urgent. It does seem to me that the security researchers were a bit too trigger-happy on the redacting of information, in particular unnecessarily so in private emails to the security folk they expected to act on the vulnerability.
AnaniasAnanas 8y ago
Maybe they forgot about it, or assumed that it was a different vulnerability especially since the original was a non-issue. Not a terrible thing to assume when the last communication with them was 6 months ago and they did not bother to give them the new paper. IMHO, the only unethical part on the side of the researchers is that they spread the whole "GPG is vulnerable!" FUD and went directly to the media when they had been informed that this is not a GPG issue beforehand. The other unethical part is that the EFF and the media companies did not bother to take GPG's side of the story.