[Faith Connors]

https://www.eff.org/deeplinks/2018/05/at...action-now

so hf, were you sending emails with pgp? how fucked are you now?
looks like only emails are compromised though, other forms of communication (encrypting message, posting to privnote, sending to user to decrypt or other ways) might still be fine.

edit: yeah, its just emails that use the openpgp standard that are truly vulnerable because they dont verify the integrity of the message. if you're doing everything manually like with gnupg, then youre fine.

[Crystallize.]

Thats why I never use anything else except jabber for secure communications.I never liked PGP idea.

[4158996621556]

What? I didn't read the article but from the headline I'm going to assume that PGP encrypted emails can be read without the keys?
I'm sure they're popular on the dark web, if this is true it's huge news.

[Faith Connors]

What? I didn't read the article but from the headline I'm going to assume that PGP encrypted emails can be read without the keys?
I'm sure they're popular on the dark web, if this is true it's huge news.

thats exactly what the article says. confirmed by the researcher (sebastian shinzel) on twitter too.
https://twitter.com/seecurity

[ＢＯＢＢＹ ＴＡＲＡＮＴＩＮＯ]

Holy shit this is huge man, I’m fortunate enough to not use PGP myself

[Shlazam]

Wow this is actually huge.

I honestly have to watch my back now..

[CyberStrike]

yeah I read this at like 0500 today apparently it has to do with remote content in a message and decrypting your emails

https://efail.de/

There is more there on the site above I haven't had time to read through everything yet.

[Moon Rock]

Wow, so this only effects e-mails. Not when we are passing addressed back an forth thru the onion?

[Faith Connors]

yeah I read this at like 0500 today apparently it has to do with remote content in a message and decrypting your emails

https://efail.de/

There is more there on the site above I haven't had time to read through everything yet.

yeah, but its only happening with the openpgp protocol/standard. to be useful it needs to get past that integrity check, and pretty much any other standard won't.
most people will be safe for now just by disabling their mail extensions that automatically decrypt and parse messages.

[Covalent]

I've never used the auto-decrypting email shit that's included in things like Enigmail, Gpg4win and what not. Doing it manually is the best thing for you.

[SIM-3391627]

Thank god I don't use PGP lmao.

[LilRaysrevenge]

Only automated pgp encryption got fucked though?

I remember when # got taken down and everyone that used auto encryption was fucke and everyone that did it manually got away with it?

Correct me if I'm wrong but this will most likely not affect people who PGP encrypt manually.

[randomUsername25214]

So is this something wrong whit PGP or the tools that decrypt PGP necrypted messages?

[Faith Connors]

So is this something wrong whit PGP or the tools that decrypt PGP necrypted messages?

the openpgp standard which, yes, has tools based off it which are compromised.
doing it manually through gnupg or gpg4win is fine though.

[Bluffer]

Dont break the law and no worries.