A team of European researchers claim to have found critical vulnerabilities in PGP/GPG and S/MIME. PGP, which stands for Pretty Good Privacy, is code used to encrypt communications, commonly email. S/MIME, which stands for Secure/Multipurpose Internet Mail Extension, is a way to sign and encrypt modern email and all the extended character sets, attachments, and content it contains. If you want the same level of security in email as you have in end-to-end encrypted messaging, it's likely you're using PGP / S/MIME. And, right now, they may be vulnerable to hacks.
We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 2018-05-15 07:00 UTC. They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past. #efail 1/4— Sebastian Schinzel (@seecurity) May 14, 2018
Danny O'Brien and Gennie Genhart, writing for The EFF:
A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages.
Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email.
Dan Goodin at Ars Technica notes:
Both Schinzel and the EFF blog post referred those affected to EFF instructions for disabling plug-ins in Thunderbird, macOS Mail, and Outlook. The instructions say only to "disable PGP integration in e-mail clients." Interestingly, there's no advice to remove PGP apps such as Gpg4win, GNU Privacy Guard. Once the plugin tools are removed from the Thunderbird, Mail or Outlook, the EFF posts said, "your emails will not be automatically decrypted." On Twitter, EFF officials went on to say: "do not decrypt encrypted PGP messages that you receive using your email client."
The topic of that paper is that HTML is used as a back channel to create an oracle for modified encrypted mails. It is long known that HTML mails and in particular external links like are evil if the MUA actually honors them (which many meanwhile seem to do again; see all these newsletters). Due to broken MIME parsers a bunch of MUAs seem to concatenate decrypted HTML mime parts which makes it easy to plant such HTML snippets.
There are two ways to mitigate this attack
Don't use HTML mails. Or if you really need to read them use a proper MIME parser and disallow any access to external links.
Use authenticated encryption.
There's a lot to sift through here and the researchers aren't releasing their findings to the public until tomorrow. So, in the meantime, if you use PGP and S/MIME for encrypted email, read the EFF article, read the gnupg mail, and then:
- If you feel the least bit concerned, temporarily disable email encryption in Outlook, macOS Mail, Thunderbird, etc. and switch to something like Signal, WhatsApp, or iMessage for secure communication until the dust settles.
- If you're not concerned, still keep an eye on the story and see if anything changes over the next couple of days.
There will always be exploits and vulnerabilities, potential and proven. What's important is that they're disclosed ethically, reported responsibly, and addressed expeditiously.
We'll update this story as more becomes known. In the meantime, let me if you use PGP / S/MIME for encrypted email and, if so, what's your take?
The premium Lenovo Yoga C940 14 takes on the Yoga C740 14. Which one wins?
These two laptops come from the same family, but they're quite different with a price to reflect the premium offerings on the Yoga C940. Which one is right for you? We compare the two to help you decide.
Skype is great for Windows 10 users, even if people don't use it
Skype has apps everywhere, tons of features, and hundreds of millions of people have Skype accounts, but it's not known as a messaging app. Here's why Skype is the best communication app for users on Windows 10.
Master email with one of these awesome apps for Windows 10
Looking for a bit of variety in your email game? Need something powerful to handle the mail you send and receive? These are the best email apps for Windows 10.
Set up a Surface Pro workstation with one of these external monitors
The Surface Pro is great on its own, but that doesn't mean you can't add one or two external monitors to it and create a sweet battlestation. Here are the best overall picks available now.