Subject: Yet another way to mangle OpenPGP data

From: David Shaw <[email-masked]>
Date: Wed, 9 Jun 2004 11:04:47 -0400

Just when you thought it was safe to use ASCII armor to protect
messages.  I don't think we need to worry about this in 2440bis, but
it's amusing in a "oh, fer cryin out loud" sort of way.

Seen on alt.security.pgp:

-- forwarded message --

From: "joe" <[email-masked]>
Newsgroups: alt.security.pgp
References: <[email-masked]>
Subject: Re: corrupt data in pgp 
Date: Tue, 8 Jun 2004 23:46:53 +0100
Lines: 44

It seems like within the block of pgp encrypted text, if the line
starts with the characters '//' MS OutlookExpress will automatically
add the 'file:' before it making it file:// I guess the same thing
will happen when it starts with [email-masked] etc. it just assumes
it's an address location when it encounters the '@' symbol followed by
the fullstop '.' & thinks it's a email address or URL etc.

I removed the 'file:' from my block of encrypted data & it decrypted
perfectly.

joe.

-- end of forwarded message --