Mutt and EFAIL

--GID0FwUMdk1T2AWN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

I've received a few questions about EFAIL and whether this release has
any related changes, so I hope you'll forgive me for sending a second
mutt-announce email today.

For those unaware, https://efail.de/ disclosed an attack on OpenPGP and
S/MIME emails this past week.  The researchers reported mutt-1.7.2 was
not successfully attacked.

So, the short answer is no, mutt-1.10.0 has no changes made as a result
of EFAIL, and the pgp/smime configuration variable changes in this
release are unrelated.

I am neither a security researcher nor a cryptographer, but here are my
current takeaways and suggestions:

* If you are using a version of mutt before 1.6.0 and rely on OpenPGP
  encryption, please upgrade.  1.6.0 introduced $pgp_decryption_okay,
  which scans the GnuPGP status output for a successful decryption code.

* Please make sure you update your config to the values suggested
  in contrib/gpg.rc (again, in particular $pgp_decryption_okay).

* Opening a decrypted email in an external browser should be considered
  unsafe.  Part of the attack was due to HTML injection.

* I don't believe autoviewing dumped HTML via lynx, elinks, etc is an
  issue.  However, the researchers did not specifically test that.

-Kevin

--GID0FwUMdk1T2AWN
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEiXWpszqjeRA4XFMIre92hIAxa9oFAlsArT8ACgkQre92hIAx
a9ouYw//SL7PtOrrYn9rmnd17cO3EMC9rjb6H8dvAkulJWFrbHxJbk3oJrs4kE0H
oyPDHhYFLPHNyAJrIiHOFaRG8zY9OSrkdoBq6eJAnTLnEy7HuFLl5ssVL82YAKs2
87gUZ7fFB9ULzhbe8bFL8xi7W0+0FbF7l0vSTTbdxYwmIl7Ra/Ugn+Lf+amq+ONQ
VFpXuLL4YCfEVsXIdqiXUSe8gJOoi1Dwia3JFbKGC9PplEK8UQniQmSlX0iwgwz5
C7k7sTiks2zv4/Lh3WDf5N9pJ+C6E3sUEWwjsvxESfuKzIzwsia4kkk37a54HgRv
enoGgUpgaa4tfBk0djZxYc32QBD1zzK8FSWhKMzxPkqNkV71/WcSbt1R/mJ0nUxW
fKr9RgN08uNpFVREGd9kx4mIJFCNuf/tkoYMxN5Wu48IVOD/xQx7wVYSBJgcynMX
KINyzh3WQg2TQYPJ+ToMTE0nWEdlSZRsG0IJZpeNgqjT8kRFhwayAj9UXGjuxmPU
g+JGYB9gAydRZC8EeDvQywsjWwOv3dsz+oizVBEqG9txguXlzCH5YnHDwGfFCV9H
f6ORZluVjphqnldOyZbQuV3rL78cFhBnvlb4gg999iiPdqxaZqdvSnHP+lZ7/iA4
hfkT/dlwu/dXoMNXDbSmrsKDayGJbtIlf5WdLEDrtwQ3CUcwbHU=
=YXmt
-----END PGP SIGNATURE-----

--GID0FwUMdk1T2AWN--