European researchers warn against risks of popular encrypted email standards

"Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email", the EFF said.

On Monday morning, the Electronic Frontier Foundation (EFF) reported that Efail is able to expose HTML emails encrypted with PGP and S/MIME encryption programs - even those that were sent years ago. "We devise working attacks for both OpenPGP and S/MIME encryption, and show that exfiltration channels exist for 23 of the 35 tested S/MIME email clients and 10 of the 28 tested OpenPGP email clients".

In a paper published Monday, the group outlined a proof-of-concept process for how attackers could exploit weaknesses in how email clients like Apple Mail, iOS Mail, and Mozilla Thunderbird manage HTML in messages. "Having used PGP since 1993, this sounds baaad".

A group of nine researchers has discovered a critical vulnerability in the systems end-to-end email encryption using OpenPGP and S/MIME. As there are "currently no reliable fixes for the vulnerability", the researchers are advising users to immediately disable the encryption within individual email clients and use other methods to send their secure data for now.

The research paper details a method whereby the simple omission of not closing the URL with quotes can enable an attacker to get access to the decrypted email contents.

Anyone who actively wants their email communication to be secure and private - and uses common email security plugins - should take notice.

Security researchers, backed up the EFF, have issued a warning over PGP and S/MIME encryption. That's because EFAIL can be stopped by using authenticated encryption; OpenPGP started to support authenticated encryption in 2001.

Professor Schinzel is a member of a research team consisting of a long list of respected security researchers, and which has been responsible for uncovering a number of cryptographic vulnerabilities. The newly found vulnerability has the potential to reveal encrypted emails in plaintext, including emails sent in the past.

It recommended that users switch for the time being to secure messaging app Signal for sensitive communications. (S/MIME is more typically used to protect corporate emails, which means its use is up to the IT department, not individual workers.) We're still in the "knee-jerk reaction" phase of the response cycle.

It advised users to disable the use of active content, such as HTML code and the loading of external content, and to secure their email servers against external access.

Recommended:

• 

  13 May 2018

  Pakistan 268-6 against Ireland at 2nd day close

  When Stirling did come on, a well-set Faheem launched the part-time spinner over long-on for six. First, it was Shadab who played the aggressor and then Faheem to help Pakistan revive.
  

  12 May 2018

  Trump Greets 3 Americans Freed by North Korea

  Shuang has said that China welcomes the positive progress made by the leaders of the DPRK and the USA to prepare for the summit. And President Trump going there would play into North Korea's propaganda machine - that the American President is coming to us.
  

  12 May 2018

  Seoul 'tricked' N. Korea waitresses into defecting: manager

  The summit will be the first meeting ever between a sitting United States president and the leader of North Korea. But Libya's program was not almost as advanced as North Korea and the country had not already stockpiled weapons.
• 

  14 May 2018

  Leahy comments on White House aide mocking Senator John McCain

  John McCain is still showing his influence in Washington while battling cancer thousands of miles away in Arizona. Sadler reportedly called McCain's daughter, Meghan McCain, after making the remark.
  

  13 May 2018

  Mercedes in front again in final practice for Spanish GP

  There was a massive scalp when Renault's Nico Hulkenberg was eliminated along with the 2 struggling Williams and Marcus Ericsson. His time was only good enough for 16th. "It is a little bit disheartening as I don't really know what I could have done more".
  

  12 May 2018

  US Fighters have Intercepted Two Russian Strategic Bombers near Alaska

  F-22 fighters escorted the Russian aircraft for 40 minutes and kept a distance of over 100 meters, he said in a statement. The Russian bombers never entered USA airspace, the spokesman for the North American Aerospace Defense Command told CNN.
• 

  14 May 2018

  Nintendo NES Classic Edition is coming back again . . . on June 29

  The tiny, retro Nintendo console that was almost impossible to snag 18 months ago will return to store shelves this summer. The $59.99 NES Classic Edition is a mini version of the Nintendo Entertainment System that originally launched in 1985.
  

  13 May 2018

  Kangana Ranaut talks about gender equality in films at her Cannes debut

  And for the final debut on the red carpet, she chooses a designer dress giving an ample view of her curves from all dimensions. Accessorising with wavy hair and crystal earrings , we reckon Deepika was the belle of the ball with this look.
  

  12 May 2018

  South Sudan on alert as Ebola outbreak reported in Congo

  World Health Organization has recorded 32 suspected or confirmed cases in Bikoro, including 18 deaths, between April 4 and May 9. A new experimental vaccine has been shown to be highly effective against the virus, though quantities are now limited.
• 

  13 May 2018

  Poster depicts Lalu's son as 'Shiva, daughter-in-law as 'Parvati'

  As the chief minister arrived at the veterinary college grounds in Patna - the wedding venue - he was greeted with loud cheers. Tej Pratap's baarat (wedding procession) comprised of 200 cars, horses and brass bands.
  

  13 May 2018

  RIP Himanshu Roy, condolence messages pour in

  In Dey's case, the then chief minister had issued instructions that he wanted an update on the investigations every six hours. The primary investigations revealed that Roy was in his bedroom and his wife in another room when he shot himself.
  

  12 May 2018

  Alonso making most out of his season despite McLaren's woes

  Alonso started 13th in Azerbaijan and dropped to the back of the pack after another vehicle collided with him on the first lap. They reset whatever happened in the first couple of races and they come here and expect you to win and deliver the result.