Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

efail.de

Post reply on HN
Print view View original

211–220 of 306 posts

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#211

Post by tedunangst »

rocqua wrote: post #183
tptacek wrote: post #158

Earlier quoted context omitted.

What's happened here is that GPG has used the OpenPGP spec as excuse to support extremely insecure default behavior. In reality, GPG can simply buffer and check before writing to stdout, and, in the rare cases where messages are too large to buffer, a flag can be used to override the secure default.

If the message is too large to buffer, one might also first just decrypt and stream the plaintext into sha-1. Once the MDC clears, you can just decrypt again, this time writing to stdout.

This is difficult if the input is a nonseekable stream, but that doesn't excuse producing bad output.

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#212

Post by tptacek »

xoa wrote: post #206
tptacek wrote: post #194

Earlier quoted context omitted.

I think you misunderstood his argument. It was, "no".

Your argument is "everybody on the planet including all corporations and governments should instantly abandon email for an instant messenger thing instead of which there are many and no federation" which is a bullshit argument and you damn well know it. FFS, how often over the decades in security have we had to make do with highly suboptimal solutions that were the lesser of evils? When did you of all people become a…

Yes, us head-in-the-clouds idealists with our pie-eyed demands that encrypted message protocols not leak the contents of our messages to anyone who can intercept them. What will we demand next, forward secrecy? We should climb down from our ivory towers.

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#213

Post by AnaniasAnanas »

veeti wrote: post #54
AnaniasAnanas wrote: post #18

To be honest, this is a really bad joke. Not only did they chose to go directly to the media/EFF without even informing the GPG people but they also attacked them[1] for not keeping quiet. Not to mention all the fud that was spread for an issue that is not even caused by GPG but by bad clients (in fact I am not aware of any client that is vulnerable to this). Shame both to the publishers of this and to the EFF for he…

> (in fact I am not aware of any client that is vulnerable to this) > First, the direct exfiltration attack abuses vulnerabilities in Apple Mail, iOS Mail and Mozilla Thunderbird...

Not with Engimail 2+. (I was also not aware of Apple mail's and iOS Mail's existence so technically my statement was true)

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#214

Post by tptacek »

tedunangst wrote: post #211
rocqua wrote: post #183

Earlier quoted context omitted.

If the message is too large to buffer, one might also first just decrypt and stream the plaintext into sha-1. Once the MDC clears, you can just decrypt again, this time writing to stdout.

This is difficult if the input is a nonseekable stream, but that doesn't excuse producing bad output.

That's why I didn't suggest it, but to be fair, you could tee the stream into an intermediate file for a two-pass scheme.

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#215

Post by AnaniasAnanas »

zaarn wrote: post #37
AnaniasAnanas wrote: post #26

Earlier quoted context omitted.

GPG is not a standard, the standard is OpenPGP. As for the tools, they seem very easy, especially engimail which IS 1-click setup. > add generic messages about encryption in alternate mime content bodies and simply encode the encrypted messages into it's own This is exactly what it is doing. PGP/MIME is a thing.

Enigmail is far from friction free and no 1-click setup. I still have to go through key generation last I checked. And then publish those keys or give them to friends. If PGP/GPG wants adoption they need to eliminate those friction points, a TOFU model with automatic key redistribution should lower friction sufficiently but except TOFU there isn't much development in that direction. >This is exactly what it is doing.…

> no 1-click setup

True, it is 3-click setup.

> I don't think I ever received a single PGP/MIME email

I haven't seen non-PGP/MIME emails in ages. In fact, Engimail uses PGP/MIME by default.

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#216

Post by AnaniasAnanas »

cyphar wrote: post #167
AnaniasAnanas wrote: post #26

Earlier quoted context omitted.

GPG is not a standard, the standard is OpenPGP. As for the tools, they seem very easy, especially engimail which IS 1-click setup. > add generic messages about encryption in alternate mime content bodies and simply encode the encrypted messages into it's own This is exactly what it is doing. PGP/MIME is a thing.

> the standard is OpenPGP The standard is PGP. OpenPGP is an implementation.

Is this a joke?

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#217

Post by xorcist »

baby wrote: post #73
dijit wrote: post #60

Earlier quoted context omitted.

I can see how it would work against Apple Mail/iOS Mail since they load HTML and external elements by default. I would be interested to see the attack working on a Thunderbird client with Enigmail installed and no other settings changes (like; loading external resources).

According to this table Thunderbird is vulnerable: https://twitter.com/matthew_d_green/status/99599862678571417...

This is the weird part. Sure, Outlook 2007 and Apple Mail are vulnerable, but if you are really parsing untrusted HTML with these clients you probably have more pressing problems (running arbitrary code, perhaps).

From a quick test it seems like a completely standard Thunderbird/Enigmail not only checks the error code from gpg, but also doesn't render HTML by default. There must be something more to this, unless something was fixed quite recently, in which case that would seem very relevant to the announcement.

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#219

Post by xoa »

tptacek wrote: post #212
xoa wrote: post #206

Earlier quoted context omitted.

Your argument is "everybody on the planet including all corporations and governments should instantly abandon email for an instant messenger thing instead of which there are many and no federation" which is a bullshit argument and you damn well know it. FFS, how often over the decades in security have we had to make do with highly suboptimal solutions that were the lesser of evils? When did you of all people become a…

Yes, us head-in-the-clouds idealists with our pie-eyed demands that encrypted message protocols not leak the contents of our messages to anyone who can intercept them . What will we demand next, forward secrecy? We should climb down from our ivory towers.

>Yes, us head-in-the-clouds idealists with our pie-eyed demands that encrypted message protocols not leak the contents of our messages to anyone who can intercept them.

That's not what you're demanding. You're demanding the end to a UX. That's entirely orthogonal to security, and my whole point is that's very different from pushing people to go from an insecure version of a UX to a more secure version of a UX (or at least a strict superset of that UX). It's straight forward to argue "don't use HTTP, use HTTPS", or "don't use SMS, use {secure messenger}"[1], or "don't use POP, use POPS or IMAPS" or even "don't use an 8 character password that is the name of your dog on a website, use something random and preferably a password manager".

But that's not your argument.

1. Though again, the basic fact that I can't just tell anyone in the world, on any device at all, what {secure messenger} vs "SMS" should be is inherently suboptimal though less so.

Re: EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

#220

Post by tptacek »

yacn wrote: post #218
tptacek wrote: post #195

Earlier quoted context omitted.

I do not recommend it, but it's very probably better than PGP email.

Why don't you recommend it?

Wouldn't a bunch of secure messenger drama be fun right now?
Post reply on HN