Since the Efail guys and @EFF are failing at actually documenting mitigations, here they are:
- Use Enigmail 2.0 or later
- Use Thunderbird 52.7.0 or later
That's it. That fixes both the GPG issue and the back channels. If you've been running up to date software, *you're fine*.
-
Show this thread
-
If you're paranoid or running older Thunderbird, set network.http.speculative-parallel-limit=0 and network.dns.disablePrefetch=true. The former is already set on the latest version, the latter isn't but I wasn't able to reproduce it, so I assume they fixed it a different way.
1 reply 8 retweets 13 likesShow this thread -
Note that *either update* to Enigmail or Thunderbird is sufficient to mitigate; the exploit relies on *both* (for GPG anyway, but nobody uses S/MIME, right?). But you want the Thunderbird update/config fix for privacy reasons anyway (otherwise mail trackers could work).
2 replies 3 retweets 8 likesShow this thread -
Looks like the S/MIME fix will be in the next release.https://hg.mozilla.org/releases/comm-release/rev/6f5d2abfedc9 …
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.