3 ms·
Encryption plugins on top of other mail clients has always been a recipe for disaster. That being said, why would EFF tell people to completely uninstall it? W
by gepeto42 8y ago
Encryption plugins on top of other mail clients has always been a recipe for disaster.
That being said, why would EFF tell people to completely uninstall it? When I hear that, I think "There is a crazy, in the wild, no user interaction needed remote code execution vulnerability". If someone had a use for PGP/GPG email (assuming they understand the threat model and the metadata that is not encrypted), surely they're better off with a buggy version that with pure cleartext?
- deong 8y agoI believe the recommendation is to use something like Signal or iMessage -- an end-to-end encrypted channel that isn't email.
- gsnedders 8y agoAnd which have perfect forward secrecy, which PGP will never have without adding some new per-message communication between the two parties (which would totally violate the layering on top of email).
- bscphil 8y agoSurely, telling users to uninstall it was a temporary measure until they can be certain that the bug is fixed. Without it removed, there was a risk that users could be quickly targeted with previously captured replayed messages and if their clients automatically decrypt then it would in fact be a disclosure vulnerability with no user interaction needed.