5 ms·
Well, depends how it's sent. The header information in an encrypted message is unencrypted. Using an MUA, the body of the message will be sent as an inline atta
by sbuk 6y ago
Well, depends how it's sent. The header information in an encrypted message is unencrypted. Using an MUA, the body of the message will be sent as an inline attachment. The contend definition of the boundary for the attachment is Content-Type: application/pgp-encrypted, which is trivial to detect. A encrypted attachment that uses a generic application/binary or text/plain starts with -----BEGIN PGP MESSAGE----- or 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 47 50 20 4d 45 53 53 41 47 45 2d 2d 2d 2d 2d, which again is trivial to detect.
Edit: I'm not suggesting PGP itself is bad because of this. There are many other reasons why you should consider other methods of sending messages securely that aren't email or PGP.
- upofadown 6y agoEmail on the wire is mostly all TLS encrypted these days. Generally offline encryption like PGP encrypted email is moe secure than, say, instant messaging: * https://articles.59.ca/doku.php?id=em:emailvsim https://articles.59.ca/doku.php?id=em:emailvsim
- prepend 6y agoWhat I meant is it’s trivial to change the content type and to change the attachment format so it doesn’t match specific GPG formats. The content type is done now for convenience, but there’s nothing stopping me from using GPG to generate a message and send it with the content type of a text file or zip or whatnot. Of course there are other methods, but GPG is free, stable and works as expected.