4 ms·

The PGP vulnerability is actually in e-mail clients, and it affects almost nobody. And how often do PGP vulnerabilities happen? Signal got two vulnerabilities

by 4ad 8y ago

The PGP vulnerability is actually in e-mail clients, and it affects almost nobody. And how often do PGP vulnerabilities happen? Signal got two vulnerabilities that affect everyone JUST THIS WEEK.

tptacek 8y ago
By "almost nobody", you mean everyone who used Apple Mail/GPGTools and Thunderbird/Enigma, meaning, the vast majority of everybody who used PGP?
- pera 8y ago
  Are GPGMail and Enigmail really more popular than other extensions/clients? genuinely asking since I am not aware of any study on PGP usage.
- 4ad 8y ago
  Thunderbird does not download remote content by default. I don't know anybody who is using Apple Mail with GPG, but if there are such people, they have been doing it very wrong regardless of this vulnerability. It's an unsafe combination. I have no statistics on what people use PGP with, but asserting that most people use it with Apple Mail and Thunderbird is baseless and without proof.
  - pfg 8y ago
    > Thunderbird does not download remote content by default. The researchers behind EFAIL found a number of ways to bypass the remote content setting. Not only that, but Hanno Böck found another one today[1] that hasn't been fixed yet. [1]: https://twitter.com/hanno/status/997138771194859521 https://twitter.com/hanno/status/997138771194859521
  - girvo 8y ago
    Why would Apple Mail and PGP be a unsafe combination by default?
- AnaniasAnanas 8y ago
  Enigmail 2 was not affected.
  - pfg 8y ago
    I'm not sure what you're trying to say here, but Enigmail 2 was released a few months after the researchers disclosed the vulnerability to the project[1], so it would've been a rather sad state of affairs if the release hadn't included a fix. That's not to say that everything's fine now for users of Thunderbird and Enigmail[2]. [1]: https://sourceforge.net/p/enigmail/bugs/721/ https://sourceforge.net/p/enigmail/bugs/721/ [2]: https://twitter.com/hanno/status/997138771194859521 https://twitter.com/hanno/status/997138771194859521
Forbo 8y ago
The Signal vulnerabilities did not affect the mobile apps, only the desktop app.

by 4ad 8y ago

The PGP vulnerability is actually in e-mail clients, and it affects almost nobody. And how often do PGP vulnerabilities happen? Signal got two vulnerabilities that affect everyone JUST THIS WEEK.

tptacek 8y ago

By "almost nobody", you mean everyone who used Apple Mail/GPGTools and Thunderbird/Enigma, meaning, the vast majority of everybody who used PGP?

pera 8y ago
Are GPGMail and Enigmail really more popular than other extensions/clients? genuinely asking since I am not aware of any study on PGP usage.
4ad 8y ago
Thunderbird does not download remote content by default. I don't know anybody who is using Apple Mail with GPG, but if there are such people, they have been doing it very wrong regardless of this vulnerability. It's an unsafe combination. I have no statistics on what people use PGP with, but asserting that most people use it with Apple Mail and Thunderbird is baseless and without proof.
- pfg 8y ago
  > Thunderbird does not download remote content by default. The researchers behind EFAIL found a number of ways to bypass the remote content setting. Not only that, but Hanno Böck found another one today[1] that hasn't been fixed yet. [1]: https://twitter.com/hanno/status/997138771194859521 https://twitter.com/hanno/status/997138771194859521
- girvo 8y ago
  Why would Apple Mail and PGP be a unsafe combination by default?
AnaniasAnanas 8y ago
Enigmail 2 was not affected.
- pfg 8y ago
  I'm not sure what you're trying to say here, but Enigmail 2 was released a few months after the researchers disclosed the vulnerability to the project[1], so it would've been a rather sad state of affairs if the release hadn't included a fix. That's not to say that everything's fine now for users of Thunderbird and Enigmail[2]. [1]: https://sourceforge.net/p/enigmail/bugs/721/ https://sourceforge.net/p/enigmail/bugs/721/ [2]: https://twitter.com/hanno/status/997138771194859521 https://twitter.com/hanno/status/997138771194859521

Forbo 8y ago

The Signal vulnerabilities did not affect the mobile apps, only the desktop app.