News for hackers. Stuff that matters.

A comment on EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME. Parent comment

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by giancarlostoro on Monday May 14, 2018 @07:18AM (#17064463)
It's been mentioned by other comments here[0] that the team / group / individual(s) behind this paper didn't even contact the underlying development teams prior to publishing. The whole thing looks like they want to be able to say "yeah we uncovered xyz vulnerability" which they kind of could of, if they had just explained it's relevant to implementation and didn't attack the wrong projects in the process. There seems to be some level of unprofessional conduct[1] coming from the people writing the paper as well where they attack the projects on Twitter to try and silence them when their claims are refuted.

[0]: https://news.ycombinator.com/item?id=17064360

[1]: https://twitter.com/seecurity/status/995936859980222464

(Note: I'm reiterating / summarizing the findings of AnaniasAnanas from here.)

[ Parent | on HN ]
Re:EFail – Vulnerabilities in end-to-end encryption technolo... by tptacek on Monday May 14, 2018 @07:36PM (#17070379)
This is false, and you should be embarrassed to have repeated it publicly.

If you'd even taken the time to look at the Efail.de website, you'd see the (extensive) timeline of contacts the Ruhr team made, including liasing with CERT teams, starting last year.

[ Parent | on HN ]