Attention PGP Users: New Vulnerabilities Require You To Take Action Now

[DamianTV]

https://it.slashdot.org/story/18/05/...ake-action-now

A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. From a report:

EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages. The full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific).

In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication. Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email.

Further reading: People Are Freaking Out That PGP Is 'Broken' -- But You Shouldn't Be Using It Anyway (Motherboard).

[timosman]

Disable HTML rendering.

LOL. How many times are we going to hear that? We must leave HTML rendering enabled because the sales and marketing folks won't be able to insert cool signatures in their emails.

[DamianTV]

By "cool" do you mean "deceptive"? Where they underline the word "unsubscribe" but it isnt actually a link?

[timosman]

By "cool" do you mean "deceptive"? Where they underline the word "unsubscribe" but it isnt actually a link?

You are clearly not familiar with the contemporary sales process. You must be one of those socially challenged individuals.

[H_H]

You are clearly not familiar with the contemporary sales process.

It's all part of the User eXperience!

[pcosmar]