PGP Vulnerability? [Efail]

[entr0py]

Thanks for heads up. We started discussing a bit in a tangential thread:

@tempest

edit: already being called fud. Efail or OpenPGP is safer than S/MIME

apparently someone broke the embargo on publishing the paper, so it’s been published early by the authors. it’s mainly an html exploit. but, they say there may be other ways. thus, the initial hype of this appears to very much be fud. i have a feeling the authors may be in for a rough week.

https://efail.de/

keep calm and carry on.

@entr0py

Here’s a more sane take: Errata Security: Some notes on eFail

Summary

It only works if attackers have already captured your emails (though, that’s why you use PGP/SMIME in the first place, to guard against that).

It only works if you’ve enabled your email client to automatically grab external/remote content.

It seems to not be easily reproducible in all cases.

Instead of disabling PGP/SMIME, you should make sure your email client hast remote/external content disabled – that’s a huge privacy violation even without this bug.