croemerDec 28

The PGP Problem (2019)

https://www.latacora.com/blog/2019/07/16/the-pgp-problem/#the-answers

The PGP problem

The PGP problem

Latacora
Show threadshakna

Probably resurfacing, because we have some new attacks thanks to CCC. [0]

[0] https://news.ycombinator.com/item?id=46453461

To sign or not to sign: Practical vulnerabilities in GPG and friends [video] | Hacker News

Jan 3 at 1:07amWeb
Show threadshaknaJan 3

Worth noting: minisign and age were also affected by a couple things here.

GnuPG has decided a couple things are out of scope, fixed a couple others. Not all is in distro packages yet.

age didn't have the clearest way to report things - discord is apparently the point of contact. Which will probably improve soon.

minisign was affected by most everything GnuPG was, but had a faster turnaround to patching.

Show threadtptacekJan 3
The minisign bug was much less severe than the (insane) GPG signing bugs, and the age bug wasn't a cryptographic thing at all, just a dumb path sanitization thing. Minisign was not in fact affected by most everything GPG was. The GnuPG team wontfixed one of the most significant bugs!