No he is saying it requires a man-in-the-middle kind of attack. Additionally, it requires a broken mail client that does not check error result from the pgp dec

No he is saying it requires a man-in-the-middle kind of attack. Additionally, it requires a broken mail client that does not check error result from the pgp decoder _and_ concatenates different mail parts _and_ has HTML rendering enabled (and does not warn for external content). The pgp spec, afaik, had already protection by checking inline modification (fixing the exploit using CBC), but due to old mail clients this didnt generate an error by default. Some users of the gpg decoder tool does not support or ignore errors, making you invisible from issues in the email... Check the efail.de page for more info.