Hacker News Reader

Comment by quicklime | Hacker News Reader

> So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it.

This is news to me, but I’ll admit I’m one of those technologists who doesn’t understand it enough. Can anyone point me to more info on this?

View on HN

https://efail.de/

Okay, so PGP is not vulnerable.

It's the EFAIL thing. Which was an actual issue but was wildly misrepresented in the media[1].

[1] https://articles.59.ca/doku.php?id=pgpfan:efail

This is such a bizarre article. Efail was, among other things, a peer-reviewed accept at Usenix Security in 2018. It is certainly and obviously not a "hoax". Cryptography engineers have been warning about the pattern of PGP weaknesses that led to it for almost a decade prior.

You might want to read the article more carefully taking into account context:

>The word “Hoax” in the title of this article refers to the attempts to make it seem that EFAIL represented some deficiency in PGP.

Which was found after an example of a "hyperbolic headline". Later in the article it explicitly addresses the media distortion. I don't know how anyone could get from that that the article was claiming that the article was some sort of hoax, particularly when the article actually praises the work represented by the paper.

I know we’ve gone back and forth about this before, but EFAIL was caused by a major deficiency in PGP. PGP tees up failure modes like this, as evidenced by the fact that the vast majority of implementations all suffered from the same issue.

Edit: Hilariously, I went to look up the prior thread and it involves you calling EFAIL a hoax: https://news.ycombinator.com/item?id=21985303

What I actually said:

>If that is true (and there is evidence that it was) then the whole thing was just a hoax, _at least as presented_.

I suppose this is an example of the perils of attempting to be nuanced on the internet. The EFAIL paper is great work. I recently referenced it in an article I wrote. The group involved has subsequently done other good work in the messaging space I am interested in.

I shall go and update the article to be even more explicit on this point. Thanks for the assistance...

Reply on news.ycombinator.com