Your IT Consultant

Encrypted E-mail is Not Broken Despite the Hype

May 15, 2018

The sky is not falling and encrypted e-mail is not broken. There were a ton of reports yesterday claiming that encrypting e-mail using PGP and S/MIME are vulnerable to hacks that can reveal the contents. Ars Technica reported that Sebastian Schinzel, a professor of computer security at Münster University of Applied Sciences, wrote on Twitter. "There are currently no reliable fixes for the vulnerability. If you use PGP/GPG or S/MIME for very sensitive communication, you should disable it in your email client for now." To give the news some credibility, references were made to a blog post posted by the Electronic Frontier Foundation (EFF). You'll notice that the post does not say that PGP is broken or that encrypted e-mail is no longer safe. We now know that the researchers have call the attack "Efail." The technical paper detailing the attack is now available.

After the dust has settled, the problem is not PGP or S/MIME, but in how some e-mail clients/plugins have incorrectly implemented the technologies. The real problem is with HTML-based e-mail and external links as pointed out in Update 2 of a CSO post. It should be noted that to successfully take advantage of the attack, the attacker must have access to your encrypted messages, which are then modified and sent back to you. The hoops you have to jump through to pull this off are not for the faint of heart. Even Bruce Schneier stated, "Being able to intercept and modify e-mails in transit is the sort of thing the NSA can do, but is hard for the average hacker." A temporary practical solution is to disable HTML rendering.

According to Motherboard, Phil Zimmermann, the cryptographer who invented PGP, stopped using it years ago. It's probably wise to follow his lead and look for secure communication methods other than PGP. The Hacker News has an excellent table that shows how to prevent against the attack. It identifies various e-mail clients running on different operating systems and whether it is susceptible to the attack with or without user interaction.

E-mail: Phone: 703.359.0700
Digital Forensics/Information Security/Information Technology
https://www.linkedin.com/in/johnsimek
https://amazon.com/author/johnsimek
https://www.senseient.com