PGP is all over the news (even on TV) and there seems to be a lot of confusion about it.

For the time being, people face articles like Attention PGP users: new vulnerabilities require you to take action now which tell readers to deactivate their PGP plugins while raising concerns related to PGP beyond email client software and good, old email itself.

A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME.

Since I've been asked about the status of PGP several times today, I think a short Q&A related to this makes sense.

Do the new vulnerabilities mean that

1. there is a problem with PGP itself (as in: we should not use PGP encryption at all), or
2. do the vulnerabilities "merely" point to a problem with email clients and the way they handle things (as in: PGP is fine outside or your email client)?

Differently stated: I'm asking to clarify if it is still safe to use PGP itself (eg sign/encrypt via commandline and transmit via non-email channels) or if there's a problem with the cryptographic internals of PGP.

PGP is all over the news (even on TV) and there seems to be a lot of confusion about it.

For the time being, people face articles like Attention PGP users: new vulnerabilities require you to take action now which tell readers to deactivate their PGP plugins while raising concerns related to PGP beyond email client software and good, old email itself.

A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME.

Since I've been asked about the status of PGP several times today, I think a short Q&A related to this makes sense.

Do the new vulnerabilities mean that

1. there is a problem with PGP itself (as in: we should not use PGP encryption/signing at all), or
2. do the vulnerabilities "merely" point to a problem with email clients and the way they handle things (as in: PGP is fine outside or your email client)?

Differently stated: I'm asking to clarify if it is still safe to use PGP itself (eg sign/encrypt via commandline and transmit via non-email channels) or if there's a problem with the cryptographic internals of PGP.

PGP is all over the news (even on TV) and there seems to be a lot of confusion about it.

For the time being, people face articles like Attention PGP users: new vulnerabilities require you to take action now which tell readers to deactivate their PGP plugins while raising concerns related to PGP beyond email client software and good, old email itself.

A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME.

Since I've been asked about the status of PGP several times today, I think a short, canonical Q&A related to this makes sense.

Do the new vulnerabilities mean that

1. there is a problem with PGP itself (as in: we should not use PGP encryption at all), or
2. do the vulnerabilities "merely" point to a problem with email clients and the way they handle things (as in: PGP is fine outside or your email client)?

Differently stated: I'm asking to clarify if it is still safe to use PGP itself (eg sign/encrypt via commandline and transmit via non-email channels) or if there's a problem with the cryptographic internals of PGP.

^{Nota Bene: Since the full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific), I will refrain from upvoting or acceptimg any answers before that paper is officially released.}

PGP is all over the news (even on TV) and there seems to be a lot of confusion about it.

For the time being, people face articles like Attention PGP users: new vulnerabilities require you to take action now which tell readers to deactivate their PGP plugins while raising concerns related to PGP beyond email client software and good, old email itself.

A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME.

Since I've been asked about the status of PGP several times today, I think a short Q&A related to this makes sense.

Do the new vulnerabilities mean that

1. there is a problem with PGP itself (as in: we should not use PGP encryption at all), or
2. do the vulnerabilities "merely" point to a problem with email clients and the way they handle things (as in: PGP is fine outside or your email client)?

Differently stated: I'm asking to clarify if it is still safe to use PGP itself (eg sign/encrypt via commandline and transmit via non-email channels) or if there's a problem with the cryptographic internals of PGP.