42 ms·
Is this a joke? >Solution/Vendor Information/Workaround >For safer communications on desktop systems, please consider the use of a safer end-point client like
by AdmiralAsshat 8y ago
Is this a joke?
>Solution/Vendor Information/Workaround
>For safer communications on desktop systems, please consider the use of a safer end-point client like PGP or GnuPG instead.
---
Meanwhile, regarding yesterday's PGP flaw:
https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you-need-know-about-e-fail-and-pgp-flaw-0 https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you...
>EFF’s recommendations: Disable or uninstall PGP email
plugins for now. Do not decrypt encrypted PGP messages
that you receive. Instead, use non-email based
messaging platforms, like Signal, for your encrypted
messaging needs.
- bcaa7f3a8bbc 8y agoAnd ironically enough, both security issues are triggered by HTML, without HTML world would be a much better place. Seriously speaking, using plain commandline PGP or GnuPG can be a safer form of communication on desktops, but not with email clients that support HTML, and don't forget the inherent drawback of no forward secrecy.
- baby 8y agoPlease do not quote with codeblocks as it is unreadble on mobile.
- AnaniasAnanas 8y agoIronically enough it is more readable on my laptop.
- Bartweiss 8y agoCertainly awful timing, and especially awkward since a prepended img tag was one of the mechanisms for attacking PGP clients as well. That said, the EFF recommendation turns out to be somewhere between 'overzealous' and 'wrong'. If you're using Protonmail or another solid GPG implementation, the attack is already handled in full by re-encrypting mixed plain/cipher messages and requiring MDC. https://protonmail.com/blog/pgp-vulnerability-efail/ https://protonmail.com/blog/pgp-vulnerability-efail/ https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06033...