@kensanata The problem here seems to be less PGP/GPG, but the use of complicated stuff like HTML and JavaScript together with encrypted communication. That one is hard to get right.

@kensanata
Can we just federate Wire and Signal then do away with email altogether?

@kensanata As far as I understood, the attack works as follows:

1) Alice sends Bob an encrypted message, I intercept it but cannot read it.

2) I craft a new email to Bob and include the crypted text as an MIME attachment.

3) Bob decrypts the complete email, through an error in his MIME parser, the decrypted text from Alice becomes part of a larger HTML text.

4) By displaying the HTML mail, the secret message may be exfiltrated as part of an URL.