Slashdot Mirror
In Apple Mail, There's No Protecting PGP-Encrypted Messages (theintercept.com)
It has been nearly two weeks since researchers unveiled "EFAIL," a set of critical software vulnerabilities that allow encrypted email messages to be stolen from within the inbox. The Intercept reports that developers of email clients and encryption plugins are still scrambling to come up with a permanent fix. From the report: Apple Mail is the email client that comes free with every Mac computer, and an open source project called GPGTools allows Apple Mail to smoothly encrypt and decrypt messages using the 23-year-old PGP standard. The day the EFAIL paper was published, GPGTools instructed users to workaround EFAIL by changing a setting in Apple Mail to disable loading remote content. Similarly, the creator of PGP, Phil Zimmermann, co-signed a blog post Thursday stating that EFAIL was "easy to mitigate" by disabling the loading of remote content in GPGTools. But even if you follow this advice and disable remote content, Apple Mail and GPGTools are still vulnerable to EFAIL.
I developed a proof-of-concept exploit that works against Apple Mail and GPGTools even when remote content loading is disabled (German security researcher Hanno Bock also deserves much of the credit for this exploit, more on that below). I have reported the vulnerability to the GPGTools developers, and they are actively working on an update that they plan on releasing soon.
I developed a proof-of-concept exploit that works against Apple Mail and GPGTools even when remote content loading is disabled (German security researcher Hanno Bock also deserves much of the credit for this exploit, more on that below). I have reported the vulnerability to the GPGTools developers, and they are actively working on an update that they plan on releasing soon.
It would only provide a false sense of security from a failed encryption utility.
This nonsense needs to stop. Zimmerman even tells you to.
The more I learn about or use other email clients, the more I love Thunderbird.
> '> ">
Would > '> "> at the start of any encrypted message prevent the issue from sending the real content from going anywhere?
Thanks,
IMarv
Trusting software vendors is no smarter than trus
Puts Apple in the headline, even though Apple has nothing to do with this -- the vulnerability is strictly within the open source plugin that people use with Apple Mail.
Additionally he trumpets that it works against systems with "load remote content" turned off... and then buries *way* down his page that his exploit requires that the user clicks a link.
WTF? Clicking links in email has *NEVER* been safe.
Your super amazing "exploit" is that you can con the user into clicking a malicious link and use an already existing vulnerability on that basis? Wow. Welcome to super genius mode, dude.
According to TFS, Apple Mail is not the ONLY Mail Client/Plugin that is affected:
"The Intercept reports that developers of email clients and encryption plugins are still scrambling to come up with a permanent fix. "
That sentence tells me it is more than Apple Mail that is affected; yet the Title makes it sound that way.
Why?
Oh, right: Clickbait.
What rational thinking person would default-load remote content from an encrypted email to begin with? It was an obviously horrible idea from t=0. Do people seriously do it? I've always had my mailer configured to not do that. In fact also for non-encrypted mail, because that's a bad idea too.
A negative Apple story posted by msmash? Must be a day that ends with "-day"!
I always have always just used the command line tools to encrypt messages. Just cut and paste. Much easier to learn, understand and use overall when you think of it from the big picture perspective.
Easy solution: Don't set up encryption in your e-mail products, but instead, (en|de)crypt all messages outside of the e-mailer, using copy/paste to get the messages into or out of your e-mail client, or even by using attachments and .ASC files etc..
If you have a clue, getting around that flaw is child's play.
Either doesn't understand the vulnerability or is calling out Apple because it will attract more eyes.
Apple Mail already has public-key encryption built in, albeit S/MIME rather than PGP. I don't see why it would make a difference for most people.