SoylentNews is people
SoylentNews
Ars Technica is reporting that there are
critical PGP and S/MIME bugs which can reveal encrypted e-mails. Their advice is to uninstall the plugins, for the time being. More information will be released tomorrow (Tuesday at 07:00 UTC, 3:00 AM EDT, midnight PDT).
Little is publicly known about the flaws at the moment. Both Schinzel and the EFF blog post said they will be disclosed late Monday night California time in a paper written by a team of European security researchers. Schinzel's Twitter messages used the hashtag #efail, a possible indication of the name the researchers have given to their exploit.
The EFF also published a warning, Attention PGP Users: New Vulnerabilities Require You To Take Action Now:
A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages.
The full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific). In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication.
The EFF also gives additional advice on disabling PGP in Thunderbird with Enigmail as well as other mail and mail-like clients.
takyon: The embargo is broken and the full details, including the paper (PDF), have been published.
(Score: 2) by termigator on Monday May 14 2018, @09:41PM
Likely unaffected. Add nmh to that list.
One aspect the exploit takes advantage of is the stupidity that the GUI-based MUAs handle multipart MIME messages: concatenating each part together instead of treat each part as its own displayable entity. If doing the latter, which is what one should do, then the HTML parts, before and after the encrypted part, would be malformed HTML, and not render correctly.
I am 100% for disabling HTML in email, but if you are going to render it, each entity should be rendered in its own context and not by concatenating the resulting parts into a single entity to render in a single context. Since most modern GUI MUAs "reuse" HTML rendering engines, the iframe construct could have been leveraged provide separate rendering contexts for each entity, preventing the concatenation exploit.
It appears to me what the core problem is programmer laziness: Not understanding the standards correctly and taking shortcuts in rendering data.