{"id":642,"date":"2018-05-14T20:09:58","date_gmt":"2018-05-14T20:09:58","guid":{"rendered":"https:\/\/kasperskycontenthub.com\/threatpost\/?p=131946"},"modified":"2018-05-14T20:09:58","modified_gmt":"2018-05-14T20:09:58","slug":"efail-opens-up-encrypted-email-to-prying-eyes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/","title":{"rendered":"EFAIL Opens Up Encrypted Email to Prying Eyes"},"content":{"rendered":"<div class=\"media_block\"><\/div>\n<div><img decoding=\"async\" src=\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/31\/2018\/04\/09163458\/abstract-digital-spam-email-e1523306170361.jpeg\" class=\"ff-og-image-inserted\"\/><\/div>\n<p>A set of vulnerabilities in the encryption technologies used to secure sensitive emails threatens to expose corporate communications as well as the messages of at-risk users such as journalists, political dissidents and whistleblowers operating in hostile environments.<\/p>\n<p>However, there is some debate as to how serious the issues are.<\/p>\n<p>The flaws, collectively dubbed EFAIL by the team of European researchers who discovered it, affect the end-to-end encryption protocols known as OpenPGP and S\/MIME.<\/p>\n<p>Email confidentiality is partly protected by Transport Layer Security, but OpenPGP offers an additional layer of end-to-end encryption specifically built to avoid the prying eyes. S\/MIME meanwhile is an alternative standard for email end-to-end encryption that is typically used to secure corporate email communication clients, such as Outlook.<\/p>\n<p>According to the researchers, <a href=\"https:\/\/efail.de\">EFAIL<\/a> affects clients that use a graphical user interface, including Thunderbird with Enigmail, Apple Mail with GPGTools and Outlook with Gpg4win. Secure messaging services such as Signal are not impacted, according to the Electronic Frontier Foundation, which <a href=\"https:\/\/www.eff.org\/deeplinks\/2018\/05\/not-so-pretty-what-you-need-know-about-e-fail-and-pgp-flaw-0\">worked<\/a> with the research team to publicize the problem.<\/p>\n<p>Describing the <a href=\"https:\/\/twitter.com\/seecurity\/status\/995906638556155904\">flaw in a tweet<\/a>,\u00a0Sebastian Schinzel, research team member and a professor of computer security at M\u00fcnster University of Applied Sciences, wrote: \u201cThey might reveal the plaintext of encrypted emails, including encrypted emails sent in the past.\u201d The researchers further elaborated the attack methods in <a href=\"https:\/\/efail.de\/efail-attack-paper.pdf\">documentation<\/a>\u00a0(PDF) on EFAIL released Monday.<\/p>\n<p>\u201cEFAIL abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plaintext through requested URLs,\u201d they wrote. \u201cThe attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim. The victim\u2019s email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker.\u201d<\/p>\n<p>To create these exfiltration channels, the attacker needs access to the encrypted emails in the first place, so a first step in any attack would be eavesdropping on network traffic or compromising email accounts, email servers, backup systems or client computers in order to collect messages intended for decryption.<\/p>\n<p>Matthew Green, assistant professor at the Department of Computer Science at Johns Hopkins University and <a href=\"https:\/\/isi.jhu.edu\/~mgreen\/\">crypto-expert<\/a> broke down the attack in simpler terms: \u201cIn a nutshell, if I intercept an encrypted email sent to you, I can modify that email into a new encrypted email that contains custom HTML,\u201d he <a href=\"https:\/\/twitter.com\/matthew_d_green\/status\/995989254143606789\">tweeted<\/a>. \u201cIn many GUI email clients, this HTML can exfiltrate the plaintext to a remote server. Ouch.\u201d<\/p>\n<p>The attack works on past trails of messages; so, for example, if a regime has been stealthily collecting emails sent by suspected dissidents in hopes of someday decrypting them, EFAIL will allow a nation-state to force the person\u2019s email client to now do so.<\/p>\n<p><strong>How Serious?<\/strong><\/p>\n<p>While on its face EFAIL seems alarming, a debate is in play as to whether the danger it poses has been exaggerated, with PGP vendors noting that it was a known flaw going back for 17 years, and one that they have addressed.<\/p>\n<p>Werner Koch, principle author at Gnu Privacy Guard, which is a free implementation of the OpenPGP standard, opened <a href=\"https:\/\/lists.gnupg.org\/pipermail\/gnupg-users\/2018-May\/060320.html\">a discussion<\/a> on the issue in which he said that the attack should not work if authenticated encryption (GnuPG\u2019s is called modification detection code, or MDC) is in use, which is the preferred configuration. If it\u2019s not, GnuPG returns an alert.<\/p>\n<p>\u201cIn response to that, they said that they did a simple rollback to the non-MDC encryption,\u201d he said. \u201cThis is a pretty old thing which we are aware of, and the reasons why a warning has always been printed in that case.\u201d<\/p>\n<p>Enigmail\u2019s Robert Hansen <a href=\"https:\/\/twitter.com\/robertjhansen\/status\/996015890574520320\">tweeted<\/a> that \u201cGnuPG has given warnings on missing\/malformed [authentication encryption] for years.\u201d He then added that the problem also has been patched in Enigmail for some time.<\/p>\n<p>\u201cAlthough the EFAIL authors did find some problems in Enigmail \u2013 for which we\u2019re deeply sorry, and plead that we\u2019re only human \u2014 we fixed them months ago,\u201d he tweeted, adding that users on the 1.9.9 distro should upgrade to 2.0.<\/p>\n<p>Some have been arguing that EFAIL isn\u2019t a problem for OpenPGP as long as the implementations are done correctly (in addition to the aforementioned authenticated encryption, this includes not using HTML emails, which thwarts the problem). Koch for instance said that OpenPGP\u2019s message authentication that thwarts EFAIL (in place since 2001) can\u2019t be made mandatory because \u201csome implementations haven\u2019t kept up.\u201d<\/p>\n<p>Yet others take issue with that line. \u201cNo, in 2018 you don\u2019t get to claim the high ground and blame users and implementations if your crypto API returns the plaintext on a decryption error,\u201d said Google cryptographer Filippo Valsorda, <a href=\"https:\/\/twitter.com\/FiloSottile\/status\/996010161427935233\">writing<\/a> on Twitter. \u201cAt most you can say \u2018sorry we are a legacy system, no one knew better then, it\u2019s time to migrate off.&#8217;\u201d<\/p>\n<p>\u201cIf you were using GnuPG on the command line and checking your error results, it\u2019s absolutely true that you\u2019re fine,\u201d Green tweeted, adding that \u201cIf you\u2019ve been using (one of several) GUI clients with PGP encryption, you were anything but fine.\u201d He also noted that \u201cPGP clients are vulnerable because 17 years after a vulnerability was known, the mitigation was not made a default in GnuPG and defense was instead left to PGP clients, which also make a convenient scapegoat when it goes pear-shaped.\u201d<\/p>\n<p>Also, Robert Graham at Errata Security examined the flaws and came away with a different take: \u201cIt only works if you\u2019ve enabled your email client to automatically grab external\/remote content,\u201d he said in <a href=\"https:\/\/blog.erratasec.com\/2018\/05\/some-notes-on-efail.html#.WvnQomgvw2x\">a post<\/a>. \u201cIt seems to not be easily reproducible in all cases.\u201d<\/p>\n<p><strong>Outlook Mail Most Affected<\/strong><\/p>\n<p>In any event, the issue appears to be more serious for S\/MIME than it is for OpenPGP.\u00a0The researchers said as much in detailing one type of exploitation:<\/p>\n<p>\u201cAttacking S\/MIME is straightforward and an attacker can break multiple (in our tests up to 500) S\/MIME encrypted emails by sending a single crafted S\/MIME email to the victim,\u201d they said in their paper. \u201cGiven the current state of our research, the CFB gadget attack against PGP only has a success rate of approximately one in three attempts. The reason is that PGP compresses the plaintext before encrypting it, which complicates guessing known plaintext bytes.\u201d<\/p>\n<p><strong>Fixes<\/strong><\/p>\n<p>As for mitigations, those using HTML clients with these plug-ins have \u201ccurrently no reliable fixes for the vulnerability,\u201d Schinzel tweeted. \u201cIf you use PGP\/GPG or S\/MIME for very sensitive communication, you should disable it in your email client for now.\u201d Disabling the client will also prevent the ability for anyone looking over one\u2019s shoulder to decrypt past messages.<\/p>\n<p>The EFF, which in its alert <a href=\"https:\/\/www.eff.org\/deeplinks\/2018\/05\/attention-pgp-users-new-vulnerabilities-require-you-take-action-now\">published<\/a> specific ways to disable it in specific clients, echoed the assessment.<\/p>\n<p>\u201cOur advice, which mirrors that of the researchers, is to immediately disable and\/or uninstall tools that automatically decrypt PGP-encrypted email,\u201d wrote the EFF. \u201cUntil the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels\u2026and temporarily stop sending and especially reading PGP-encrypted email.\u201d<\/p>\n<p>Graham had a different take: \u201cInstead of disabling PGP\/S\/MIME, you should make sure your email client hast remote\/external content disabled \u2014 that\u2019s a huge privacy violation even without this bug.\u201d<\/p>\n<p> READ MORE <a href=\"https:\/\/threatpost.com\/efail-opens-up-encrypted-email-to-prying-eyes\/131946\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The flaws threaten to expose corporate communications in Outlook as well as the messages of at-risk users like political dissidents. READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":643,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[3],"tags":[17,458,459,46,460,461,462,5,463,464,465,19],"class_list":["post-642","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threatpost","tag-cryptography","tag-dissidents","tag-efail","tag-encryption","tag-mitigations","tag-openpgp","tag-outlook","tag-privacy","tag-s-mime","tag-secure-email","tag-sensitive-communications","tag-vulnerabilities"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>EFAIL Opens Up Encrypted Email to Prying Eyes 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"EFAIL Opens Up Encrypted Email to Prying Eyes 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2018-05-14T20:09:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/05\/efail-opens-up-encrypted-email-to-prying-eyes.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"700\" \/>\n\t<meta property=\"og:image:height\" content=\"467\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"EFAIL Opens Up Encrypted Email to Prying Eyes\",\"datePublished\":\"2018-05-14T20:09:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/\"},\"wordCount\":1220,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/05\\\/efail-opens-up-encrypted-email-to-prying-eyes.jpg\",\"keywords\":[\"Cryptography\",\"dissidents\",\"efail\",\"Encryption\",\"mitigations\",\"OpenPGP\",\"Outlook\",\"Privacy\",\"s\\\/mime\",\"Secure email\",\"sensitive communications\",\"Vulnerabilities\"],\"articleSection\":[\"Threatpost\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/\",\"name\":\"EFAIL Opens Up Encrypted Email to Prying Eyes 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/05\\\/efail-opens-up-encrypted-email-to-prying-eyes.jpg\",\"datePublished\":\"2018-05-14T20:09:58+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/05\\\/efail-opens-up-encrypted-email-to-prying-eyes.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/05\\\/efail-opens-up-encrypted-email-to-prying-eyes.jpg\",\"width\":700,\"height\":467},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/efail-opens-up-encrypted-email-to-prying-eyes\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cryptography\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/cryptography\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"EFAIL Opens Up Encrypted Email to Prying Eyes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"EFAIL Opens Up Encrypted Email to Prying Eyes 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/","og_locale":"en_US","og_type":"article","og_title":"EFAIL Opens Up Encrypted Email to Prying Eyes 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2018-05-14T20:09:58+00:00","og_image":[{"width":700,"height":467,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/05\/efail-opens-up-encrypted-email-to-prying-eyes.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"EFAIL Opens Up Encrypted Email to Prying Eyes","datePublished":"2018-05-14T20:09:58+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/"},"wordCount":1220,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/05\/efail-opens-up-encrypted-email-to-prying-eyes.jpg","keywords":["Cryptography","dissidents","efail","Encryption","mitigations","OpenPGP","Outlook","Privacy","s\/mime","Secure email","sensitive communications","Vulnerabilities"],"articleSection":["Threatpost"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/","url":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/","name":"EFAIL Opens Up Encrypted Email to Prying Eyes 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/05\/efail-opens-up-encrypted-email-to-prying-eyes.jpg","datePublished":"2018-05-14T20:09:58+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/05\/efail-opens-up-encrypted-email-to-prying-eyes.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/05\/efail-opens-up-encrypted-email-to-prying-eyes.jpg","width":700,"height":467},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/efail-opens-up-encrypted-email-to-prying-eyes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Cryptography","item":"https:\/\/www.threatshub.org\/blog\/tag\/cryptography\/"},{"@type":"ListItem","position":3,"name":"EFAIL Opens Up Encrypted Email to Prying Eyes"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=642"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/642\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/643"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}