A team of European researchers claim to have found critical vulnerabilities in PGP/GPG and S/MIME. PGP, which stands for Pretty Good Privacy, is code used to encrypt communications, commonly email. S/MIME, which stands for Secure/Multipurpose Internet Mail Extension, is a way to sign and encrypt modern email and all the extended character sets, attachments, and content it contains. If you want the same level of security in email as you have in end-to-end encrypted messaging, it's likely you're using PGP / S/MIME. And, right now, they may be vulnerable to hacks.
We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 2018-05-15 07:00 UTC. They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past. #efail 1/4We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 2018-05-15 07:00 UTC. They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past. #efail 1/4— Sebastian Schinzel (@seecurity) May 14, 2018May 14, 2018
Danny O'Brien and Gennie Genhart, writing for The EFF:
Dan Goodin at Ars Technica notes:
The topic of that paper is that HTML is used as a back channel to create an oracle for modified encrypted mails. It is long known that HTML mails and in particular external links like are evil if the MUA actually honors them (which many meanwhile seem to do again; see all these newsletters). Due to broken MIME parsers a bunch of MUAs seem to concatenate decrypted HTML mime parts which makes it easy to plant such HTML snippets.
There are two ways to mitigate this attack
- Don't use HTML mails. Or if you really need to read them use a proper MIME parser and disallow any access to external links.
- Use authenticated encryption.
There's a lot to sift through here and the researchers aren't releasing their findings to the public until tomorrow. So, in the meantime, if you use PGP and S/MIME for encrypted email, read the EFF article, read the gnupg mail, and then:
- If you feel the least bit concerned, temporarily disable email encryption in Outlook, macOS Mail, Thunderbird, etc. and switch to something like Signal, WhatsApp, or iMessage for secure communication until the dust settles.
- If you're not concerned, still keep an eye on the story and see if anything changes over the next couple of days.
There will always be exploits and vulnerabilities, potential and proven. What's important is that they're disclosed ethically, reported responsibly, and addressed expeditiously.
We'll update this story as more becomes known. In the meantime, let me if you use PGP / S/MIME for encrypted email and, if so, what's your take?
Get the Android Central Newsletter
Instant access to breaking news, the hottest reviews, great deals and helpful tips.