Critical PGP and S / MIME vulnerabilities make email encryption almost useless

[BadB]

A group of academics, led by Professor Sebastian Schinzel at the University of Applied Sciences in Münster, warned of critical vulnerabilities in PGP and S / MIME. While the technical details of the problem have not been disclosed, they promise to be made public tomorrow.

Now, according to experts, it is known that holes in PGP and S / MIME make it possible to read messages encrypted in this way in plain text format. Worse, the problem extends to older emails sent and received in the past. On Twitter, Schinzel writes that there are currently no patches for the problems found, and recommends that you temporarily stop using PGP and S / MIME altogether.

Attention PGP Users: New Vulnerabilities Require You To Take Action Now

UPDATE: Enigmail and GPG Tools have been patched for EFAIL. For more up-to-date information, please see EFF's Surveillance Self-Defense guides.UPDATE (5/14/18): More information has been released. See EFF's more detailed explanation and analysis here.A group of European security researchers have...

www.eff.org

To publicize the problem and warn users, experts turned to the Electronic Frontier Foundation (EFF) for help. Representatives of the EFF confirmed the severity of the detected problems and published a message in which they also called for disabling or uninstalling tools for working with PGP and S / MIME. While there are no fixes, as an alternative method of secure communication, users are advised to pay attention to the Signal messenger.

In addition, the Electronic Frontier Foundation has posted instructions on how to disable the respective plugins:

• Thunderbird with Enigmail;
• Apple Mail with GPGTools;
• Outlook with Gpg4win.

At the same time, the GnuGP developers report that the discovered vulnerabilities do not affect GnuGP and Enigmail directly, but are related to the use of PGP in email clients. In addition, the site efail.de started working ahead of the deadline set by the specialists, and it became known that problems arise only with those letters that were sent in HTML format.