3 ms·
I can't wait to discover that the whole thing was engineered by or at least sponsored by a nefarious three letter agency.
by VyseofArcadia 8y ago
I can't wait to discover that the whole thing was engineered by or at least sponsored by a nefarious three letter agency.
- Clubber 8y agoYes, "PGP has a flaw so you should disable plugins," sounds extremely fishy.
- Xylakant 8y agoAFAIR the attack allows taking any old encrypted email and modifying it in a fashion so that a vulnerable client at the recipient would decrypt the message and send its content to the attacker. So the attacker needs access to the mail, either from the victims computer, mail-server or any or the senders computer, mail server (sent mail imap box) or intercepted in flight and the ability to send that to the recipient. It's not like this is necessarily hard, this is what GPG is supposed to protect against. disabling the plugin until this is fixed would prevent an attack. Depending on your risk profile, this would be a reasonable mitigation: Don't receive encrypted messages for a while, but keep old conversations safe.