3 ms·
I agree that this is the wording of the comment - if having a PGP-encrypted message intercepted in transit compromises it, something has gone horribly wrong. F
by Bartweiss 8y ago
I agree that this is the wording of the comment - if having a PGP-encrypted message intercepted in transit compromises it, something has gone horribly wrong.
Fortunately, it's not true; the situation is actually much better than the comment suggests. As the Protonmail rundown points out, the better PGP clients should be unaffected, and secure even with in-transit interception.
- mtremsal 8y agoUnless another recipient uses a flawed client, which is pretty hard to check.
- nzp 8y agoAnother recipient could also work for cops, which is also pretty hard to check.
- Bartweiss 8y agoIf securing the contents of the message are the issue, then this is true but it's an opsec problem - no different than corresponding with someone who's downloaded malware. But "another recipient leaked the data" isn't actually the same security breach as "my data was observed". If the message was sent twice to different people, no one even has reason to believe I was sent the data. If the message was sent with multiple recipients, GPG encrypts it symmetrically, then provides an encrypted copy of that key to each user - which means there's no way to check that I actually received a valid copy of the message. It's a good point, though, that if you're planning the Arab Spring by group email or something, you should currently treat messages as at higher risk even if you use Protonmail.