Serious PGP Security Flaw Makes Email Encryption Unsafe: What To Do Until It's Fixed


Security experts from Europe are warning users who encrypt their email with PGP and S/MIME, saying they are no longer safe to use.

The critical flaw found in the two allows hackers to pull plaintext from encrypted emails. In other words, they can break the security measure and reveal the private contents of users' emails.

The Issue: EFAIL

Dubbed "EFAIL," the flaw affects the popular email clients Apple Mail, Microsoft Outlook, and Thunderbird.

Sebastian Schinzel, a Münster University of Applied Sciences professor of computer security, explains the scope of the potential danger in a tweet:

What To Do Now

Schinzel says that there isn't a reliable fix available at the moment, but there is one way to mitigate the risk. According to the Electronic Frontier Foundation, users must look for alternatives to PGP or S/MIME and turn off any software that automatically decrypts email encrypted with PGP.

"Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email," it says.

The EFF also took to Twitter to warn users of the threat:

Schinzel also urged users via Twitter to visit the blog posts by the EFF, which includes detailed step-by-step guides on how to disable PGP in Outlook, Apple Mail, and Thunderbird.

PGP and S/MIME are two of the most used email encryption methods on the internet, though the former isn't that popular (its creator reportedly doesn't even use it). At any rate, what this means is that there are a lot of users out there who are at risk.

For the record, PGP stands for "Pretty Good Privacy," while S/MIME is for Secure/Multipurpose Internet Mail Extensions.

The researchers have published a paper on how encrypted emails can be turned into plaintext.

See Now: 30 Gadgets And Tech Gifts For Father's Day 2018 That Dad Will Think Are Rad

ⓒ 2018 All rights reserved. Do not reproduce without permission.
Real Time Analytics