Security flaws found in Apple Mail can reveal encrypted email as plaintext

Security flaws found in Apple Mail can reveal encrypted email as plaintext

Werner Koch of GNUPrivacyGuard (GnuPG), an open source PGP privacy suite, said the EFF's warning was "overblown" and said he hadn't been contacted.

The security flaws that have been discovered could potentially leak the contents of the encrypted messages you send and receive via email when signed with PGP or S/MIME encryption methods. It's suggested that users "immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email". The first is a "direct exfiltration" attack that relies on clients such as Apple Mail, iOS Mail, and Mozilla Thunderbird rendering encrypted email as HTML.

The full details of the flaw are set for release at 7am UTC on Tuesday, which is 3am on the U.S. eastern seaboard, midnight Pacific time, 5pm in Sydney, and 12:30pm in Mumbai.

If you use Thunderbird with Enigmail, Apple Mail with GPGTools or Outlook with Gpg4win the EFF has step-by-step tutorials to temporarily disable their PGP plug-ins. "The attack has a large surface, since for each encrypted email sent to n recipients, there are n + 1 mail clients that are susceptible to our attack", the abstract of the research paper reads. Dmitri Strukov, a professor of electrical and computer engineering at the University of California, and his team are working to put an additional security measure on internet-connected devices to prevent hackers from cloning them.

But it said that, correctly used and configured, both forms of encryption remained secure.

Pashinyan calls on Russian businessmen to make investments in Armenia
Relations between Armenia and Russian Federation will be more fraternal, Armenian Prime Minister Nikol Pashinyan said at the St. He also called on the two countries' businesspeople to invest in Armenia.

PGP works using an algorithm to generate a "hash", or mathematical summary, of a user's name and other information.

That the vulnerability also affects S/MIME, however, may be more significant because S/MIME is much more widely deployed by businesses to secure their email communications.

PGP - short for Pretty Good Privacy - was invented back in 1991 by Phil Zimmermann and has always been viewed as a secure form of end-to-end encryption impossible for outsiders to access.

The PGP encryption is mostly used by political activists, journalists, and whistleblowers as an extra layer of encryption. This is then encrypted with the sender's private "key" and decrypted by the receiver using a separate public key.

It recommended that users switch for the time being to secure messaging app Signal for sensitive communications. In addition the mails would need to be in HTML format and have active links to external content to be vulnerable.

Related Articles

  • Sports Betting is Legal

    Sports Betting is Legal

    September 17, 2013: Third Circuit Court of Appeal, in a 2-1 decision, upholds lower court decision that the law violates PASPA. There are already ample preparations being made for the Supreme Court ruling that could overrule PASPA as unconstitutional.
    NES Classic Edition making a comeback next month

    NES Classic Edition making a comeback next month

    You can play two-player games by getting a second or using a Wii Classic Controller/Classic Controller Pro. At the year ended March 31, Nintendo said it marketed 5.28 million SNES Classic Edition consoles.
    West Bengal panchayat polls: Voting begins, violence and booth capturing reported

    West Bengal panchayat polls: Voting begins, violence and booth capturing reported

    Senior minister Jyotipriyo Mullick denied the involvement of the TMC in the incident and accused BJP of terrorising the voters. Two days back, one person was shot dead and Arabul Islam was arrested, following Chief Minister Mamata Baneerjee's direction.
  • Atletico Madrid's Jose Gimenez leaves training due to discomfort

    Atletico Madrid's Jose Gimenez leaves training due to discomfort

    Atletico Madrid head to Lyon this week aiming to claim their third Europa League title when they take on Marseille in the final. In other matches, Valencia won at Girona 1-0, Alaves beat Athletic Bilbao 3-1, and Eibar edged Las Palmas 1-0.
    'We've got you covered', condom brand to Sonam Kapoor and Anand Ahuja

    'We've got you covered', condom brand to Sonam Kapoor and Anand Ahuja

    When in Cannes, Sonam will take over the reins from Aishwarya Rai Bachchan , who is now representing L'Oreal at the film festival. Even for her travel, Sonam Kapoor appears to have hand-picked an ensemble that the fashion police will agree with.
    AMG GT Roadster range expands with 384kW 'S'

    AMG GT Roadster range expands with 384kW 'S'

    In the standard model, this produces 469 hp and 465 lb-ft of torque, while the C version ups the ante to 550 hp and 502 lb-ft. As a result, the GT S covers the 0-62mph dash in 3.8 seconds en route to a top speed of 191mph.
  • Overwatch Anniversary Event Adds New Skins and Map

    Overwatch Anniversary Event Adds New Skins and Map

    You can also access over 50 new cosmetic items, including eight legendary skins and three new epic skins, and new dance emotes. This version is called the Legendary Edition and will include Legendary, Epic, and Origin skins with 15 skins in total.
    ICSE, ISC results to be declared at 3 pm today

    ICSE, ISC results to be declared at 3 pm today

    Reportedly, the board will announce the ICSE and ISC results after a press conference at the Council's Noida office. Earlier, the pass percentages were 35 per cent and 40 per cent for ICSE and ISC students, respectively.
    Episcopal Church leader to speak at royal wedding ceremony

    Episcopal Church leader to speak at royal wedding ceremony

    The issue of same-sex marriage is one that has led to a conflict between Episcopalians and the greater Anglican Communion. The Instrument of Consent will be presented to the couple after becoming husband and wife.
  • Feige: MCU Has 'Plans' to Introduce Ms. Marvel After Captain Marvel

    Feige: MCU Has 'Plans' to Introduce Ms. Marvel After Captain Marvel

    When news of Ms Marvel's debut spread like wild fire, fans were quick to share their two cents on the ideal actor for the role. So there's definitely scope for Ms Marvel to make her appearance at some point.
    Kerala: Malappuram child abuser had protested Kathua girl's rape, murder!

    Kerala: Malappuram child abuser had protested Kathua girl's rape, murder!

    The girl's statement was recorded by a magistrate and she was later shifted to a Nirbhaya Kendra, a children's home. However, the girl raised an alarm and her parents woke up, following which the man left her and fled the spot.
    Yeddyurappa Predicts BJP will Win 2018 Karnataka Elections

    Yeddyurappa Predicts BJP will Win 2018 Karnataka Elections

    No, in the past, there have been instances when exit polls have predicted the verdict of an election incorrectly. Siddaramaiah exhorted his party workers, supporters and well wishers to relax and enjoy their weekend.