Security News Users Warned of Critical PGP Email Encryption Security Flaw

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/users-warned-of-critical-pgp-email-encryption-security-flaw/

A team of nine academics is warning the world about critical vulnerabilities in the PGP and S/MIME email encryption tools.

The flaws, if exploited, allow an attacker to decrypt sent or received messages, according to the researcher team.

"They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past," researchers said. "There are currently no reliable fixes for the vulnerability."

Researchers promised to publish more details tomorrow, Tuesday, May 15. In the meantime, they are recommending that users stop using PGP and S/MIME for now.

The Electronic Frontier Foundation —which researchers contacted to help them broadcast their message to a broader audience— has published tutorials on how to disable PGP and related plugins.


Thunderbird with Enigmail
Apple Mail with GPGTools
Outlook with Gpg4win


Users are advised to disable email encryption to avoid any attackers from recovering past encrypted emails after the paper's publication.

"These steps are intended as a temporary, conservative stopgap until the immediate risk of the exploit has passed and been mitigated against by the wider community," the EFF said.

Users in dire need of using encryption to protect their communications channels were advised to use an instant messaging client that supports end-to-end encryption, the EFF recommended.