Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A new set of vulnerabilities affecting users of PGP and S/MIME

eff.org

Post reply on HN
Print view View original

51–60 of 79 posts

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#51

Post by spacenick88 »

scandox wrote: post #49
keSSeaj wrote: post #42

"They figured out mail clients which don't properly check for decryption errors and also follow links in HTML mails. So the vulnerability is in the mail clients and not in the protocols. In fact OpenPGP is immune if used correctly while S/MIME has no deployed mitigation." - by GnuPG ( https://twitter.com/gnupg/status/995931083584757760 )

This is worth reading with the Researcher then (publicly :)) asking him to "keep this quiet". I think some of the subsequent commentators have a point which is that the media will take this to mean PGP is broken.

Yes and researchers shouldn't release incomplete teaser facts just to promote their publication and then cry wolf when their stupid paper embargo bullshit isn't adhered to.

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#52

Post by tasqa »

This seems way overblown. An in-depth explanation Werner as to why this is most likely not an issue if you're GPG is > 2.1.9 [1]

An (older) example of expected behaviour [2].

[1] https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06032... [2] https://sourceforge.net/p/enigmail/bugs/538/#43ff

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#53

Post by irundebian »

scandox wrote: post #47
irundebian wrote: post #31

Earlier quoted context omitted.

To be more precise, the standardized encryption system is called OpenPGP (RFC4880) whereas PGP is the name of tool which was written by Phil Zimmermann.

Though it would appear the source of the original PGP software is no longer publicly accessible [1], so how would one know if it was vulnerable? I think the EFF probably meant people using various implementations right? [1] https://philzimmermann.com/EN/findpgp/

Yes, especially mail solutions which are using OpenPGP implementations such as GnuPG.

It looks like its rather an mail client issue than an OpenPGP implementation issue: https://twitter.com/gnupg/status/995931083584757760?s=19

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#54

Post by dividuum »

rdl wrote: post #29

I've always handled PGP via cut-and-paste of the ascii armored block, through a text file on a ramdisk (or between systems), then using command-line pgp or gpg to decrypt, and the reverse. Not always on a VM or machine without external network access, but for signing keys for software and stuff, yes. It just seemed too easy to mess up auto-decrypt/auto-encrypt and accidentally send out cleartext -- the cut and paste…

I wonder if that doesn't open up similar problems: Pasting the mail into the gpg command line program prints out the clear text to the terminal. There are all kinds of magic control sequences that might be in that clear text. Isn't that conceptually similar to having HTML "executed"?

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#55

Post by rdl »

dividuum wrote: post #54
rdl wrote: post #29

I've always handled PGP via cut-and-paste of the ascii armored block, through a text file on a ramdisk (or between systems), then using command-line pgp or gpg to decrypt, and the reverse. Not always on a VM or machine without external network access, but for signing keys for software and stuff, yes. It just seemed too easy to mess up auto-decrypt/auto-encrypt and accidentally send out cleartext -- the cut and paste…

I wonder if that doesn't open up similar problems: Pasting the mail into the gpg command line program prints out the clear text to the terminal. There are all kinds of magic control sequences that might be in that clear text. Isn't that conceptually similar to having HTML "executed"?

I use text files (on ramdisk/tmpfs) as the intermediary, not display-to-screen.

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#56

Post by spacenick88 »

simias wrote: post #48
fensipens wrote: post #41

Response by Werner Koch (GPG), contains some details: https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06031...

>Due to broken MIME parsers a bunch of MUAs seem to concatenate decrypted HTML mime parts which makes it easy to plant such HTML snippets. To me this sounds strictly like a MUA issue, not a PGP/SMIME one. If that's really all it is it does seem massively overblown to me. Why not single out the broken MUA implementations instead of saying "don't decrypt emails OR YOU'LL DIE"? I mean just look at the wild speculation i…

Sounds like this has been handled absolutely terrible both by the original researchers and EFF. The researcher then trying to shush the directly affected GPG developers on Twitter, evidently just for the sake of a stupid no-prior publication bullshit for their paper just adds to it.

Re: A new set of vulnerabilities affecting users of PGP and S/MIME

#57

Post by [deleted] »

lbeltrame wrote: post #50
scandox wrote: post #49

Earlier quoted context omitted.

This is worth reading with the Researcher then (publicly :)) asking him to "keep this quiet". I think some of the subsequent commentators have a point which is that the media will take this to mean PGP is broken.

According to Werner Koch (link to the email posted by other commenters already), the GnuPG people weren't contacted about this issue. So that comment from the researcher looks a little out of place, iMO.

[deleted]
Post reply on HN