updated ESD in light of post-EFAIL security vulnerabilities around spoofing signatures.

[enc-live.git] / en / mac.html

diff --git a/en/mac.html b/en/mac.html
index af1773170bd5b15929f6293f8153cbbaef20820a..65f03fdda97cd3c08894eb9408b9b4d6f1e311a3 100644 (file)
--- a/en/mac.html
+++ b/en/mac.html
@@ -155,6 +155,8 @@ you can access in a browser (like Gmail), but provide extra features.</p>
 <p>If you already have an email program, you can skip to <a
 href="#step-1b">Step 1.b</a>.</p>
 
+<p class="notes">There are serious security flaws in GnuPG versions prior to 2.2.8. Install GnuPG versions 2.2.8 or 1.4.23 or later. There are also known issues with GPGTools prior to 2018.3. Make sure you have the most recent version of GPGTools.</p>
+
 </div><!-- End .section-intro -->
 
 <!-- ~~~~~~~~~ a div for each step ~~~~~~~~~ -->
@@ -241,7 +243,7 @@ so, skip this step.</p>
 <p>If not, search "Enigmail" with the search bar in the upper right. You
 can take it from here. Restart your email program when you're done.</p>
 
-<p>Enigmail versions prior to 2.0.6 have serious security issues. Make sure to install version 2.0.6 or later. The current version is 2.0.6.1.</p>
+<p>Enigmail versions prior to 2.0.7 have serious security issues. Make sure to install version 2.0.7 or later.</p>
 
 <!-- ~~~~~~~~~ Troubleshooting ~~~~~~~~~ -->
 <div class="troubleshooting">
@@ -822,15 +824,15 @@ and choosing Key Properties. It's good practice to share your fingerprint
 wherever you share your email address, so that people can double-check that
 they have the correct public key when they download yours from a keyserver.</p>
 
-<p class="notes">You may also see public keys referred to by their key ID,
-which is simply the last eight digits of the fingerprint, like C09A61E8 for
-Edward. The key ID is visible directly from the Key Management window. This
-key ID is like a person's first name (it is a useful shorthand but may not be
-unique to a given key), whereas the fingerprint actually identifies the key
-uniquely without the possibility of confusion. If you only have the key ID,
-you can still look up the key (as well as its fingerprint), like you did in
-Step 3, but if multiple options appear, you'll need the fingerprint of the
-person to whom you are trying to communicate to verify which one to use.</p>
+<p class="notes">You may also see public keys referred to by a shorter
+key ID. This key ID is visible directly from the Key Management
+window. These eight character key IDs were previously used for
+identification, which used to be safe, but is no longer reliable. You
+need to check the full fingerprint as part of verifying you have the
+correct key for the person you are trying to contact. Spoofing, in
+which someone intentionally generates a key with a fingerprint whose
+final eight characters are the same as another, is unfortunately
+common.</p>
 
 </div><!-- End .main -->
 </div><!-- End #step-identify_keys .step-->