Hector Martin

FWIW, as much as I still think the disclosure was a huge snafu, I do agree that PGP is probably due for replacement (and PGP *mail* in particular is a big mess). Just without the omg panic style.

"PGP is probably due for replacement" is, at this point, an evergreen infosec tweet

Just remember that for all its flaws, one of the Efail approaches doesn't even rely on a core PGP problem at all, and the other one only works on ancient emails for clients that correctly check error codes. PGP has problems, but isn't the biggest contributor here.

Whichever is the “bigger” problem, it remains a huge one that PGP uses a mode that has been known to be insecure for nearly 2 decades. That vulnerability has now been exploited. The fact that PGP advocates don’t acknowledge this does little for their credibility.

I have some sympathy for slowness in moving to AE. We only did so in 2012. But saying “I can continue to use actively exploited broken crypto, because I can’t see how someone might exploit it in my system” is not good.

But... It isn't. GPG has been using MDCs for a long time, and has been hard failing on decryption if they're missing for years. MIME-only vectors and stupid error checking bugs aside, Efail only works on very old PGP messages, using obsolete crypto before MDCs were mandatory.