GPZ> So we found these vulns related to CPU specula- Academia> ME ME ME TOO ALSO HERE'S A NAME AND A LOGO THE WORLD IS ENDING!!! Cure53> So Enigmail has some issue- Academia> OMG PGP IS DEAD EVERYONE STOP USING IT NOW ALSO NAME AND A LOGO!!! Starting to notice a pattern here.
-
This isn’t just about active content. It’s about the fact that active content can be subtly and comprehensively inserted into encrypted emails using very sophisticated cryptographic techniques, AND that content can be made to exfiltrate other encrypted portions of the data.
The root causes here are various, but one of them is active content in general. Another is the lack of MACs in PGP (originally). Another is that apparently it's 2018 and people are still not checking error codes. Another is that PGP mail is a patchjob of pseudo-standards.
-
-
All of these flaws (still) exist in 2018 because nobody thought they were comprehensively exploitable together. Now they’re being fixed. This is a good outcome.
-
Wouldn't it have been great if they'd bothered to follow up with the mitigations and tested the exploit again and confirmed what was fixed and wasn't. Then we'd still have the same outcome, minus the panic reaction and confused, FUD-filled media coverage.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.