This is the tweet to link to, to end this silly debate.https://twitter.com/tqbf/status/996056901514420224 …
-
This is the whole documentation for DECRYPTION_FAILED from doc/DETAILS: "The symmetric decryption failed - one reason could be a wrong passphrase for a symmetrical encrypted message." How would an implementor know that it is dangerous to use the emitted plaintext?
I don't know, because decryption failed? Why *would* you use emitted plaintext if you got an error code for the operation as a whole?
-
-
It's typical to do decrypt and verify in one step & to handle the plaintext, decrypt and verify result in three unrelated callbacks (it's a design pattern with gpgme_op_decrypt_verify - the GPGME docs, which I wrote, don't warn about it, bc at the time I didn't know better!).
-
BTW, I am not saying that this is what happened, because enigmail for instance does not even use GPGME. I am just giving one plausible scenario were it could happen.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.