3 ms·
> I don't even understand why efail is getting so much publicity. Because many people have a defeatist, preconceived notion that the government can monitor any
by AdmiralAsshat 8y ago
> I don't even understand why efail is getting so much publicity.
Because many people have a defeatist, preconceived notion that the government can monitor anything and everything you do, no matter what you do. A flaw in PGP is a key piece of evidence in support of their theory that allows them to say, "See? All those tinfoil hats spent all that time on a cumbersome solution that was defeated anyway."
- Xylakant 8y agoa lot of the criticism that GPG receives can be summarized as "GPG has known to be problematic for at least a decade, move on to something better". And, given the nature of the underlying issue - allowing access to unauthenticated plaintext by default - this is valid. The fix has been known for at least 10 years - add a checksum/authenticator. I can understand accepting messages that don't have message authentication for a handful of years for BC reasons, but at some point, GPG should have switched: Don't present plaintext at all if you can't authenticate it. You can still allow access to unauthenticated plaintext, but make that an explicit option. That alone would have prevented this issue and that's really on GPGs side.