This sounds very bad. And there are currently no reliable fixes.
#efailhttps://twitter.com/seecurity/status/995906576170053633 …
-
Show this thread
-
This vulnerability might be used to decrypt the contents of encrypted emails sent in the past. Having used PGP since 1993, this sounds baaad.
#efail15 replies 63 retweets 93 likesShow this thread -
Replying to @mikko @seecurity
They figured out mail clients which don't properly check for decryption errors and also follow links in HTML mails. So the vulnerability is in the mail clients and not in the protocols. In fact OpenPGP is immune if used correctly while S/MIME has no deployed mitigation.
15 replies 418 retweets 456 likes -
Could you please keep it quiet? There will be plenty of time to do this discussion.
21 replies 1 retweet 13 likes -
If you disclose incompetently, don't expect projects to play ball.pic.twitter.com/OL6s9TKty6
2 replies 49 retweets 124 likes -
Replying to @marcan42 @seecurity and
You didn't update this with latest info — they did contact Werner https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060320.html …
1 reply 0 retweets 0 likes
But they didn't coordinate disclosure, so it's still a fail.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.