#efail — Public Fediverse posts

🔒 I waited 4 years for Mailfence. Here's why it failed:

99% of emails unencrypted (manual PGP setup required, zero user guidance)
Closed-source = zero verification
No E2EE for calendar/contacts
OpenPGP EFAIL vulnerabilities remain exploitable
Metadata still fully exposed

EU jurisdiction ≠ cryptographic protection.
Privacy theater is still theater. You deserve better.
Full technical analysis: https://open.substack.com/pub/kaifisahil/p/i-waited-4-years-for-mailfence-heres?r=6p8e80&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

#Privacy #EmailSecurity #OpenPGP #EFAIL #InfoSec #PrivacyTools

It's been 3 years since the #EFAIL disclosure, and I'm still impressed with the attack.

Today's #35C3 talk recommendation is rather technical: "Attacking end-to-end email encryption" -- #EFail explained:
https://media.ccc.de/v/35c3-9463-attacking_end-to-end_email_encryption

@varx I just got reminded of it recently thanks to #Efail.

@bob @dredmorbius @QuantumHemp #Efail was a storm in a teacup. I was disappointed to see a lot of people who normally say sensible things about security getting over-excited about it.

I managed two #Mailpile team meetings in under an hour today... plus getting a contributor on IRC unstuck! Woo!

One of the meetings was w/ our PM. In case you were wondering why pay for a PM, these are things I put on her plate:

Desktop packages: almost ready, so how do we a) get people to test, b) coordinate translations and i18n/QA, c) release and d) structure ongoing relations w/ contractors?

EFail: I feel I made mistakes in handling #EFail. Followup? We need processes for security issues!

#Error451 this week: @micahflee of @theintercept breaks down #Efail, safer practices with #Encryption, threat modeling and explains a bit about the future of encryption in the face of #QuantumComputing.

https://thefinalstrawradio.noblogs.org/post/2018/06/06/error451-12-efail-w-micah-lee/

https://chaos.social/media/8pWpZisHHXv-udl-1WA

Entwarnung für alle, die #Thunderbird nutzen: Selbst die @EFF rät jetzt dazu, die E-Mail-Verschlüsselung mit dem Add-on #Enigmail wieder zu aktivieren.

Die als #efail bekannt gewordenen Sicherheitslücken sind gestopft.

https://www.eff.org/deeplinks/2018/05/how-turn-pgp-back-safely-possible

#PGP #GnuPG #Überwachung /c

@micahflee given that #EFail only worked with #HTMLMail turned on, the whole things seems to me like a storm in a teacup. I mean, nobody who use PGP and cares about security lets their mail client run HTML code, right? Right?
https://www.coactivate.org/projects/disintermedia/blog/2018/04/12/get-your-html-email-off-my-lawn/

@HerraBRE @lain I'm not arguing for KMail being safe from #EFail (although I remember it being mentioned explicitly as not affected).

But in KMail by default HTML is not shown, and remote resources are not loaded.

It seems like #Apple decided to make it impossible to disable HTML e-mail.

And it seems like they made this decision lately. Perhaps even after #EFail.

What the fsck is wrong with these people.

Weil über #EFAIL so viel Unsinn geschrieben wurde, veröffentlichen wir einen Text der @[email protected] auf deutsch, der das zu erklären versucht und besseren Rat gibt:
„E-Mail-Verschlüsselung und Sicherheitsnihilismus“
https://digitalcourage.de/2018/05/21/e-mail-verschluesselung-und-sicherheitsnihilismus

Vielen Dank den Übersetzern!
#eHTMLfail #EFFail

Robert Hansen (@[email protected]) has written a very comprehensive and reasonable post-mortem on #Efail. 🔗 https://medium.com/@cipherpunk/efail-a-postmortem-4bef2cea4c08