<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap:break-word;line-break:after-white-space"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto"><br></div> <br> <div id="bloop_sign_1526331245402199040" class="bloop_sign"></div> <br><p class="airmail_on">On May 14, 2018 at 1:29:07 PM, Judd Montgomery (<a href="mailto:judd@engineer.com">judd@engineer.com</a>) wrote:</p> <div><blockquote type="cite" class="clean_bq" style="font-family:Helvetica,Arial;font-size:13px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><span><div><div></div><div>I know a few of us on the list use GPG for email.<span class="Apple-converted-space"> </span><br><br><a href="https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you-need-know-about-e-fail-and-pgp-flaw-0">https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you-need-know-about-e-fail-and-pgp-flaw-0</a><span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>I think there’s an easy solution — turn off HTML in your email client? At the very least don’t allow external content to load? That would ostensibly stop the outbound call to the remote server that carries with it the exfiltrating data.</p><p>I guess the advice to stop using PGP/GPG is because both ends would have to do this to mitigate the risk of compromise?</p><p>I understand sort of why they’re focusing on PGP/GPG, but that doesn’t seem like the problem. In the second scenario with the missing integrity checks, there’s a good argument to be made for a weakness. Otherwise, this seems like an email client misbehaving.</p><p>(On a related note, if you have external content (usually images) automatically loading in your email client, you should know that you are being tracked. The sender, or their list manager proxy, knows when you open the email without requiring the affirmative action of something like a read receipt. When possible I keep auto-loading of external content intentionally turned off because of this. I also avoid opening messages I know will have trackers on my iOS devices, because that client doesn’t have the remote content off option.)</p><p>When HTML first started to be made a thing all those years ago — thank you Microsoft Outlook for all the pink Comic Sans — I complained to anyone who would listen that it was a terrible idea and that HTML did not belong in email. Obviously, I lost that argument windmills being what they are. Moving forward, we’ve known about these sort of drive-by attacks ever since malicious actors made Internet Explorer their … tool.</p><p>It feels like we’re dealing with the same thing. Unless GPG has some kind of code exploitation bug or built-in scripting engine that’s being abused, I’m having difficulty finding fault with GPG here.</p></body></html>