Attention PGP Users: New Vulnerabilities Require You To Take Action Now

Post date: May 22, 2018 2:41:30 AM

A group of European security researchers have released a warning about a set of vulnerabilities affecting users of the encryption software PGP and S/MIME. The Electronic Frontier Foundation has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages.

In order to reduce the short-term risk, EFF and the researchers have agreed to warn the wider PGP user community in advance of its full publication.

Their advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email.

These steps are intended as a temporary, conservative stopgap until the immediate risk of the exploit has passed and been mitigated against by the wider community.

For a more detailed analysis from EFF, click here.