A Solution for Sending Messages Safely from EFAIL-safe Senders to EFAIL-unsafe Receivers

[NdK]

Il 23/05/2018 04:35, Craig P Hicks ha scritto:

> When decrypted by the user in its raw form the total message will be
> human readable but a little ugly because it contains the obfuscation
> string *o*, but it will be safe from EFAIL.
While that could be OK for human-readable files, it silently alters
every other content.
Say *m* is a binary file (say a tar.gz)  that needs automatic processing
and voilà -- you broke a perfectly good use case.
Say *m* is not decrypted "immediately" but archived for later use
together with other (pre-patch) files. That corruption could go
unnoticed for a very long time, and when it gets noticed it could have
damaged a lot of archived files...
IMVHO that's really bad. And all that just because a bug isn't fixed
where it belongs?
A security-conscious user must upgrade the programs he uses anyway. So
why apply dirty workarounds?
Efail is not a GPG bug, so why should it be fixed in GPG? Sure, GPG can
be more picky and throw an error instead of a warning, but please do not
corrupt files that will be around much longer than any buggy mail client!

BYtE,
 Diego