A Solution for Sending Messages Safely from EFAIL-safe Senders to EFAIL-unsafe Receivers

[Werner Koch]

On Thu, 24 May 2018 00:05, gnupg-users at spodhuis.org said:

> up at <https://github.com/autocrypt/memoryhole>.

Given that I see more and more mails with "Encrypted mail" as subject,
this feature is getting more and more annoying.  It will eventually not
anymore possible to pre-sort mails as it is commonly done either mental
of by tools.  Well, some MUAs might be able to auto-decrypt whole
folders but that opens a more severe security problem (e.g. Tempest
oracle) than having a plaintext subject.

We can't enforce technical security without proper OPSEC.  Regarding the
Subject, Reference, etc, it is way easy and more secure to educate the
user about the fact that only the content is _end-to-end_ encrypted and
other parts, like the Subject, are required to be plaintext for proper
routing and mail handling.

Regarding the subject there is a simple and also fun solution: If you
need to hide the subject, use a nonsense phrase instead.  Such a phrase
makes mental pre-sorting as effecitive as an on-topic subject.


Shalom-Salam,

   Werner

-- 
#  Please read:  Daniel Ellsberg - The Doomsday Machine  #
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20180528/12a5b629/attachment-0001.sig>