Before anyone freaks out about "efail", realize that using it would be: 1) extremely easy to detect 2) archived in your target's email As an attacker, I could not care less about this technique. It's intellectually neat, but operationally stupid. https://efail.de/efail-attack-paper.pdf …
-
Show this thread
-
Most of us archive our entire history of email. The efail team could have released scripts that review your mailbox for signs of exploitation. Don't you think an img tag wrapping the multipart header would stick out a bit? Even the CFB/CBC gadget is discoverable after decrypting.
2 replies 9 retweets 31 likesShow this thread -
I also don't see any attempt to coordinate with major MTAs (e.g., Google or Microsoft). MTAs could have set up detections for direct exploitation and, likely, reviewed everyone's mailboxes for already delivered mail.pic.twitter.com/26SojYl2xb
2 replies 7 retweets 23 likesShow this thread -
Don't confuse my distaste for the disclosure with advocacy for S/MIME, PGP, or encrypted email. You should: 1) use authenticated cryptography ffs! 2) stop using email and start using Signal if you need privacy
4 replies 2 retweets 19 likesShow this thread
I think you’re confusing one bug with an architectural failure. I’d like it too if Signal completely ditched Desktop, but it’s miles and miles ahead of email even with it. Empheral communication and minimized metadata are huge wins for Signal.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.