31–40 of 79 posts
This doesn't make sense. PGP is encryption software, whereas S/MIME is an encryption standard. It's like saying that a vulnerability affetcts users of OpenSSL and RSA.
PGP is both software and an encryption system. ( https://tools.ietf.org/html/rfc4880 )
I think PGP should implement a centralized auto-update mechanism so that software can disable itself in cases as severe as listed (with advice to "immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email"). [I've removed an earlier longer version of this comment.]
The problem with a comment like this is that it's practically impossible to reply to it without sinking to the same level. You're getting downvoted with no replies because almost everybody disagrees with you but nobody can be bothered to argue your nonsensical points. EDIT: I see now what's going on. You baited people into disagreeing with your crackpottery, you then edited-down or deleted all of your comments in thi…
https://mastodon.social/web/statuses/100026482838593277
[1]: https://keybase.io/
Given that they recommend against decrypting any email, it sounds like the bug is some sort of remote-code-execution against the decryption step, that would then allow (among ~anything else) exfiltration of keys, ciphertexts, and plaintexts. EDIT: Having read a bit more I'm not so convinced that this explanation makes sense.
The original tweet linked in the article [1] says "They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past.", so at least that much is probably compromised. They also say there are currently no reliable fixes, which seems to suggest the problem is a flaw in PGP's design rather than a security bug in some specific library or tool, since a simple (but widespread) bug would most…
The drama is totally pointless and comes across as masturbatory, should have just waited 24 hours to tell everyone the full details instead of dangling pointless bait over our heads. Clearly the flaw has already existed for many years, 24 hours is not going to make any difference.
Earlier quoted context omitted.
Your comment presupposes that software never ever has bugs, which is clearly hard for any non trivial piece of code. Furthermore, the big is in the decryption part of pgp, so the security of the encrypted communication doesn't seem to be at risk (unless the bug can somehow be used to exfiltrate your keys).
[removed]
It doesn't seem like you have the necessary knowledge about this particular bug to assert that, but the people who do are clearly stating that there's a risk of just that:
"EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages."
Also
"We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 2018-05-15 07:00 UTC. They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past."
Earlier quoted context omitted.
The original tweet linked in the article [1] says "They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past.", so at least that much is probably compromised. They also say there are currently no reliable fixes, which seems to suggest the problem is a flaw in PGP's design rather than a security bug in some specific library or tool, since a simple (but widespread) bug would most…
Good point. I wonder what kind of flaw in PGP's design could make it unsafe to decrypt incoming mails.
1. Take previous email (X) that you want to decrypt.
2. Apply transformation (this is the actual secret sauce) to previous X to get email Y.
3. Because of how Y was constructed, decrypting it causes X to be decypted.
4. Phone home with the result by using some kind of tracking pixel.
My reasoning is that they didn't talk about RCE and they didn't talk about stealing the key, and they did warn about automatic decryption, so it should be about tricking the decryptor into decrypting whatever you want for you.