Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A new set of vulnerabilities affecting users of PGP and S/MIME

eff.org

Post reply on HN
Print view View original

11–20 of 79 posts

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#11

Post by klez »

logicallee wrote: post #5

I think PGP should implement a centralized auto-update mechanism so that software can disable itself in cases as severe as listed (with advice to "immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email"). [I've removed an earlier longer version of this comment.]

Your comment presupposes that software never ever has bugs, which is clearly hard for any non trivial piece of code.

Furthermore, the big is in the decryption part of pgp, so the security of the encrypted communication doesn't seem to be at risk (unless the bug can somehow be used to exfiltrate your keys).

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#12

Post by rococode »

jstanley wrote: post #10
logicallee wrote: post #5

I think PGP should implement a centralized auto-update mechanism so that software can disable itself in cases as severe as listed (with advice to "immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email"). [I've removed an earlier longer version of this comment.]

The problem with a comment like this is that it's practically impossible to reply to it without sinking to the same level. You're getting downvoted with no replies because almost everybody disagrees with you but nobody can be bothered to argue your nonsensical points. EDIT: I see now what's going on. You baited people into disagreeing with your crackpottery, you then edited-down or deleted all of your comments in thi…

Absolutely agree, although I want to give a better typewriter example. I'd say this announcement is much more similar to:

-----

May 14th, 1918.

Attention All Users of Typewriters: Stop Using Patented "Secret Envelopes".

Recent research has demonstrated that under certain lighting conditions, "Secret Envelopes" become transparent. There are alternatives to "Secret Envelopes" and we urge you to use them instead for the time being.

-----

In which case I would not only accept the announcement, but probably toss out my secret envelopes for good, or at least until it's proven to work again.

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#13

Post by [deleted] »

jstanley wrote: post #10
logicallee wrote: post #5

I think PGP should implement a centralized auto-update mechanism so that software can disable itself in cases as severe as listed (with advice to "immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email"). [I've removed an earlier longer version of this comment.]

The problem with a comment like this is that it's practically impossible to reply to it without sinking to the same level. You're getting downvoted with no replies because almost everybody disagrees with you but nobody can be bothered to argue your nonsensical points. EDIT: I see now what's going on. You baited people into disagreeing with your crackpottery, you then edited-down or deleted all of your comments in thi…

[deleted]

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#14

Post by skunkworker »

I'm a little confused. Is this an attack on the PGP protocol or just an attack on the software implementation of PGP?

The advice they give seems to indicate that somehow a well-crafted payload can expose the secret PGP key from "tools that automatically decrypt PGP-encrypted email."

This seems to me that it is an implementation-level attack and not a protocol attack on the basis for PGP. Is anyone else getting that same thought?

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#15

Post by rococode »

jstanley wrote: post #3

Given that they recommend against decrypting any email, it sounds like the bug is some sort of remote-code-execution against the decryption step, that would then allow (among ~anything else) exfiltration of keys, ciphertexts, and plaintexts. EDIT: Having read a bit more I'm not so convinced that this explanation makes sense.

The original tweet linked in the article [1] says "They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past.", so at least that much is probably compromised. They also say there are currently no reliable fixes, which seems to suggest the problem is a flaw in PGP's design rather than a security bug in some specific library or tool, since a simple (but widespread) bug would most likely have a clear fix.

[1] https://twitter.com/seecurity/status/995906576170053633

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#17

Post by viraptor »

jwilk wrote: post #16

This doesn't make sense. PGP is encryption software, whereas S/MIME is an encryption standard. It's like saying that a vulnerability affetcts users of OpenSSL and RSA.

PGP is both software and an encryption system. (https://tools.ietf.org/html/rfc4880)

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#18

Post by logicallee »

rococode wrote: post #12
jstanley wrote: post #10

Earlier quoted context omitted.

The problem with a comment like this is that it's practically impossible to reply to it without sinking to the same level. You're getting downvoted with no replies because almost everybody disagrees with you but nobody can be bothered to argue your nonsensical points. EDIT: I see now what's going on. You baited people into disagreeing with your crackpottery, you then edited-down or deleted all of your comments in thi…

Absolutely agree, although I want to give a better typewriter example. I'd say this announcement is much more similar to: ----- May 14th, 1918. Attention All Users of Typewriters: Stop Using Patented "Secret Envelopes". Recent research has demonstrated that under certain lighting conditions, "Secret Envelopes" become transparent. There are alternatives to "Secret Envelopes" and we urge you to use them instead for the…

[removed]

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#19

Post by kss238 »

skunkworker wrote: post #14

I'm a little confused. Is this an attack on the PGP protocol or just an attack on the software implementation of PGP? The advice they give seems to indicate that somehow a well-crafted payload can expose the secret PGP key from "tools that automatically decrypt PGP-encrypted email." This seems to me that it is an implementation-level attack and not a protocol attack on the basis for PGP. Is anyone else getting that s…

This is what I thought as well. The EFF warning was specifically against decrypting messages so I think it's unlikely to be a protocol vulnerability. But my experience with software exploits is limited to reading publications about exploits.

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#20

Post by jstanley »

jwilk wrote: post #16

This doesn't make sense. PGP is encryption software, whereas S/MIME is an encryption standard. It's like saying that a vulnerability affetcts users of OpenSSL and RSA.

Good point.

One of the researchers' tweets[0] was:

> You can still disable it in the config. If use S/MIME for sensitive information, disable it for now.

which would imply that it's not remote code execution, otherwise it would be worth disabling S/MIME whether you use it for sensitive information or not.

[0] https://twitter.com/seecurity/status/995914298512887808

Post reply on HN