4 ms·

> So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most

> So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it. This is news to me, but I’ll admit I’m one of those technologists who doesn’t understand it enough. Can anyone point me to more info on this?

doomrobo 5y ago
https://efail.de/ https://efail.de/
- faeyanpiraat 5y ago
  Okay, so PGP is not vulnerable.
upofadown 5y ago
It's the EFAIL thing. Which was an actual issue but was wildly misrepresented in the media[1]. [1] https://articles.59.ca/doku.php?id=pgpfan:efail https://articles.59.ca/doku.php?id=pgpfan:efail
- tptacek 5y ago
  This is such a bizarre article. Efail was, among other things, a peer-reviewed accept at Usenix Security in 2018. It is certainly and obviously not a "hoax". Cryptography engineers have been warning about the pattern of PGP weaknesses that led to it for almost a decade prior.
  - upofadown 5y ago
    You might want to read the article more carefully taking into account context: >The word “Hoax” in the title of this article refers to the attempts to make it seem that EFAIL represented some deficiency in PGP. Which was found after an example of a "hyperbolic headline". Later in the article it explicitly addresses the media distortion. I don't know how anyone could get from that that the article was claiming that the article was some sort of hoax, particularly when the article actually praises the work represented by the paper.
    - akerl_ 5y ago
      I know we’ve gone back and forth about this before, but EFAIL was caused by a major deficiency in PGP. PGP tees up failure modes like this, as evidenced by the fact that the vast majority of implementations all suffered from the same issue. Edit: Hilariously, I went to look up the prior thread and it involves you calling EFAIL a hoax: https://news.ycombinator.com/item?id=21985303 https://news.ycombinator.com/item?id=21985303
      - upofadown 5y ago
        What I actually said: >If that is true (and there is evidence that it was) then the whole thing was just a hoax, _at least as presented_. I suppose this is an example of the perils of attempting to be nuanced on the internet. The EFAIL paper is great work. I recently referenced it in an article I wrote. The group involved has subsequently done other good work in the messaging space I am interested in. I shall go and update the article to be even more explicit on this point. Thanks for the assistance...

doomrobo 5y ago

https://efail.de/ https://efail.de/

faeyanpiraat 5y ago
Okay, so PGP is not vulnerable.

upofadown 5y ago

It's the EFAIL thing. Which was an actual issue but was wildly misrepresented in the media[1]. [1] https://articles.59.ca/doku.php?id=pgpfan:efail https://articles.59.ca/doku.php?id=pgpfan:efail

tptacek 5y ago
This is such a bizarre article. Efail was, among other things, a peer-reviewed accept at Usenix Security in 2018. It is certainly and obviously not a "hoax". Cryptography engineers have been warning about the pattern of PGP weaknesses that led to it for almost a decade prior.
- upofadown 5y ago
  You might want to read the article more carefully taking into account context: >The word “Hoax” in the title of this article refers to the attempts to make it seem that EFAIL represented some deficiency in PGP. Which was found after an example of a "hyperbolic headline". Later in the article it explicitly addresses the media distortion. I don't know how anyone could get from that that the article was claiming that the article was some sort of hoax, particularly when the article actually praises the work represented by the paper.
  - akerl_ 5y ago
    I know we’ve gone back and forth about this before, but EFAIL was caused by a major deficiency in PGP. PGP tees up failure modes like this, as evidenced by the fact that the vast majority of implementations all suffered from the same issue. Edit: Hilariously, I went to look up the prior thread and it involves you calling EFAIL a hoax: https://news.ycombinator.com/item?id=21985303 https://news.ycombinator.com/item?id=21985303
    - upofadown 5y ago
      What I actually said: >If that is true (and there is evidence that it was) then the whole thing was just a hoax, _at least as presented_. I suppose this is an example of the perils of attempting to be nuanced on the internet. The EFAIL paper is great work. I recently referenced it in an article I wrote. The group involved has subsequently done other good work in the messaging space I am interested in. I shall go and update the article to be even more explicit on this point. Thanks for the assistance...