61–70 of 79 posts
Earlier quoted context omitted.
So in short, if you have all mails set to display as plain text rather than HTML, there's no problem?
to quote the letter: There are two ways to mitigate this attack - Don't use HTML mails. Or if you really need to read them use a proper MIME parser and disallow any access to external links. - Use authenticated encryption.
I've always handled PGP via cut-and-paste of the ascii armored block, through a text file on a ramdisk (or between systems), then using command-line pgp or gpg to decrypt, and the reverse. Not always on a VM or machine without external network access, but for signing keys for software and stuff, yes. It just seemed too easy to mess up auto-decrypt/auto-encrypt and accidentally send out cleartext -- the cut and paste…
I wonder if that doesn't open up similar problems: Pasting the mail into the gpg command line program prints out the clear text to the terminal. There are all kinds of magic control sequences that might be in that clear text. Isn't that conceptually similar to having HTML "executed"?
First, you need to know that each MIME email is made up of a series of subcomponents, which the email client interprets and concatenates. One subcomponent could be PGP encrypted while the next is not.
So given an old email where message X was encrypted to form a component Encr(X), simply write a new email of the form:
Part 1: To be clear, I doubt very much that this is the attack, but it sounds like it's along these lines.
What about Keybase[1] app, and Autocrypt[2],PEP[3]? Even dough Keybase is not email client, it can be used to continue to communicate with users that have PGP/GPG keys, over their app. And Autocrypt is Thunderbird extension, and PEP is for Outlook and Android. https://mastodon.social/web/statuses/100026482838593277 [1]: https://keybase.io/ [2]: https://autocrypt.org/ [3]: https://www.pep.security/
Earlier quoted context omitted.
The original tweet linked in the article [1] says "They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past.", so at least that much is probably compromised. They also say there are currently no reliable fixes, which seems to suggest the problem is a flaw in PGP's design rather than a security bug in some specific library or tool, since a simple (but widespread) bug would most…
They claim this also affects S/MIME, so concluding a flaw only in GPG/PGP seems to be wrong.