Questions tagged [efail]

EFAIL is a vulnerability in the OpenPGP and S/MIME standards, disclosed in 2018.

Filter by
Sorted by
Tagged with
1
vote
1answer
65 views

Were PGP/MIME and PGP/Inline equally affected by EFAIL?

I saw this question about which out of those two protocols is more secure. The question was from 2016, but Efail was discovered late 2017. I understand that some email programs were affected while ...
2
votes
1answer
220 views

Is is safe to use PGP again?

The EFF has issued some instructions enitiled "How To Turn PGP Back On As Safely As Possible". The emphasis there is mine, and that qualifier worries me. Realistically, what risks do I run if I ...
5
votes
1answer
91 views

What are the EFAIL “backchannels in email clients not related to HTML”?

The published examples for exploiting the EFAIL email encryption vulnerability all appear to use HTML to create a backchannel for exfiltrating decrypted data. However, the homepage of EFAIL, https://...
-1
votes
1answer
105 views

Will this method allow EFAIL-safe sending of OpenPGP encrypted messages to otherwise EFAIL-unsafe readers?

The proposed method Brief and simplified description of the attack: Any and every single encrypted block B of the encrypted message can be surrounded by Trojan psuedo-encrypted data to give a ...
5
votes
1answer
81 views

Is this a simple protection against EFAIL?

The way I understand EFAIL, the attack works because email clients can be coerced into concatenating the decrypted message into text supplied by the attacker to result in an URL. But wouldn't it be a ...
50
votes
5answers
6k views

What actions should I, as an end user, take in response to EFAIL?

There's a lot of talk about EFAIL: The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In a nutshell, EFAIL abuses active ...