I wrote a long post about the Efail disclosure to stop myself from tweeting about it anymore. Also it says mean things about PGP which I will regret for months.https://blog.cryptographyengineering.com/2018/05/17/was-the-efail-disclosure-horribly-screwed-up/ …
-
Could HTML email privacy ever not be crap?
Yes. You sandbox the HTML renderer and not give it network access. At all. We should already be doing that for hardening anyway, like browsers do. Instead of this stupid whack-a-mole of what network-related HTML feature did we forget to lock down today.
