Hector Martin on Twitter: "The new Enigmail has a bunch of mitigations for the concatenation/MIME merging crap that enables all of this, but all of that is irrelevant if you can't actually ping back the data to a server, which as far as I can tell you can't, at least not the way the Efail paper describes.… https://t.co/7yvyLr0Pv6"

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

Hector Martin‏ @marcan42 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @matthew_d_green

The root causes here are various, but one of them is active content in general. Another is the lack of MACs in PGP (originally). Another is that apparently it's 2018 and people are still not checking error codes. Another is that PGP mail is a patchjob of pseudo-standards.

1 reply 1 retweet 4 likes

Matthew Green‏ @matthew_d_green 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @marcan42

All of these flaws (still) exist in 2018 because nobody thought they were comprehensively exploitable together. Now they’re being fixed. This is a good outcome.

1 reply 0 retweets 3 likes

Hector Martin‏ @marcan42 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @matthew_d_green

Wouldn't it have been great if they'd bothered to follow up with the mitigations and tested the exploit again and confirmed what was fixed and wasn't. Then we'd still have the same outcome, minus the panic reaction and confused, FUD-filled media coverage.

1 reply 0 retweets 2 likes

Tony “Abolish (Pol)ICE” Arcieri ‏ @bascule 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @marcan42 @matthew_d_green

I’m recommending people delete Signal Desktop until we can be sure it’s fixed. Is that bad advice or “FUD”? You are literally arguing against being cautious with encrypted messaging tools.

2 replies 0 retweets 2 likes

Hector Martin‏ @marcan42 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @bascule @matthew_d_green

I'm not arguing against being cautious, I'm arguing against *not doing the damn research* to figure out the facts before stirring up a media shitstorm. If we really *couldn't* know then being cautious is warranted, but we *can* and they were just lazy.

1 reply 0 retweets 0 likes

Tony “Abolish (Pol)ICE” Arcieri ‏ @bascule 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @marcan42 @matthew_d_green

As we just saw with Signal Desktop, initial fixes to vulnerabilities are often insufficient and new ones are often found soon thereafter. You didn’t answer my question, but turns out I was right in practice to suggest caution.

1 reply 0 retweets 0 likes

Tony “Abolish (Pol)ICE” Arcieri ‏ @bascule 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @bascule @marcan42 @matthew_d_green

The EFF was doing the exact same thing I did except with #Efail, and you’re calling it FUD. Why don’t you go look in a mirror and ask yourself who’s spreading FUD?

1 reply 0 retweets 0 likes

Tony “Abolish (Pol)ICE” Arcieri ‏ @bascule 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @bascule @marcan42 @matthew_d_green

Tony “Abolish (Pol)ICE” Arcieri Retweeted hanno

https://twitter.com/hanno/status/997138771194859521 …

Tony “Abolish (Pol)ICE” Arcieri added,

hanno @hanno

so... about efail. the latest Enigmail version contains a few Mitigations. They don't work. I found a trivial bypass. So to be clear: efail is still exploitable with latest Enigmail+Thunderbird and default settings.

Show this thread

1 reply 0 retweets 0 likes

Hector Martin‏ @marcan42 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @bascule @matthew_d_green

Where's the PoC? Is this related the leak the Efail guys used or a completely different one? Is he using the direct exfiltration, since the PGP malleability should be gone for good? At this point this is just proving that HTML email is a fucking terrible idea more than anything.

2 replies 0 retweets 1 like

Hector Martin‏ @marcan42 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @marcan42 @bascule @matthew_d_green

Efail only listed *one* backchannel for Thunderbird and I tested it and found it didn't work in the current version. If there's another backchannel, well, then that's a different bug. And little to do with PGP per se.

1 reply 0 retweets 0 likes

Hector Martin‏ @marcan42 17 May 2018

Report Tweet
Report NetzDG Violation

Replying to @marcan42 @bascule @matthew_d_green

The new Enigmail has a bunch of mitigations for the concatenation/MIME merging crap that enables all of this, but all of that is irrelevant if you can't actually ping back the data to a server, which as far as I can tell you can't, at least not the way the Efail paper describes.

9:41 AM - 17 May 2018

0 replies 0 retweets 0 likes

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

Tweets

Hector Martin

@marcan42

Tweets

Loading seems to be taking a while.

false

Saved searches

Tweets

Hector Martin

@marcan42

Tweets

Go to a person's profile

Saved searches

Promote this Tweet

Block

Tweet with a location

Your lists

Create a new list

Copy link to Tweet

Embed this Tweet

Embed this Video

Preview

Why you're seeing this ad

Log in to Twitter

Sign up for Twitter

Not on Twitter? Sign up, tune into the things you care about, and get updates as they happen.

Two-way (sending and receiving) short codes:

Confirmation

Welcome home!

Tweets not working for you?

Say a lot with a little

Spread the word

Join the conversation

Learn the latest

Get more of what you love

Find what's happening

Never miss a Moment

Loading seems to be taking a while.

Promoted Tweet

false