Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail Will Warn If Message Is Not Authenticated/Encrypted

gmailblog.blogspot.com

Post reply on HN
Print view View original

21–30 of 216 posts

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#21

Post by thrownaway2424 »

lstamour wrote: post #18
finnn wrote: post #9

>If you receive a message that can’t be authenticated, you’ll see a question mark in place of the sender’s profile photo, corporate logo, or avatar. This makes it sound like I (the sender) can set the image displayed if I am using DKIM. Is that the case? Or is it only if I have DKIM and have a Google account with that email?

Gmail uses an associated Google+ profile for authenticated emails, so you need both for it to work going forward, I presume. To get started, check https://www.google.com/business/ Outlook uses Facebook and Twitter, if you have these contacts integrated. Yahoo does this too: http://techcrunch.com/2015/03/04/smart-contact-cards-arrive-... There really should be some kind of standard or mail header though. :) Come to th…

Gmail will prefer the image you include in the sender's contact info, if you manage your own address book, and it only falls back on Google profile pictures if you don't have one (which is the common case).

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#22

Post by Someone1234 »

more_corn wrote: post #3

meh. This doesn't seem very interesting. What would be really interesting is gmail support for public key encryption. They're perfectly positioned to roll out a user-friendly key management system.

Webmail struggles to offer security reassurances when utilising public key encryption. For example if Google allowed you to upload your private key and email would be transparently decrypted, that would be a great user experience, but now you have no way of knowing if the NSA/GCHQ/etc forced Google to give them your private key.

If you didn't upload your private key to Google now you need your browser to decrypt your message in-line but preventing the website with the encrypted version from stealing the resulting decrypted version from the secure container. So that requires every browser to add these secure containers, for content to be marked for decryption, and for key storage.

If you aren't worried about usability then you could just write a Word document, encrypt it and attach it to an unencrypted email. No browser support, or website support needed.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#23

Post by darkr »

schoen wrote: post #14
andygambles wrote: post #4

Earlier quoted context omitted.

Yep surprised they haven't rolled one out yet. Ideally placed.

They've been working on a browser extension for it: https://googleonlinesecurity.blogspot.com/2014/06/making-end... https://github.com/google/end-to-end I don't know what they might do in the future to encourage people to use this, or if they feel that there's a point at which it would be sensible or useful to actively promote it.

It's still not ready for production use. One problem with e2e is that it's JavaScript based and runs in he browser, so there is a certain attack vector present there. To defend against this, ideally e2e needs to work with a smartcard (such as the yubikey neo) so that the private key cannot be stolen.

There was an issue I was tracking a while back to integrate this support, but it's still a work in progress.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#24

Post by mgbmtl »

Esau wrote: post #19
MicroBerto wrote: post #15

In my opinion, you should just behave like your emails are public record. This is the best way of approaching that technology.

That's what I do as email is more akin to a postcard than a letter. If that makes someone uncomfortable, then they should choose another medium.

This is what GMail is doing: making sure that sending an email is like sending a letter (instead of a postcard). TLS email is not 100% secure (private, authenticated, etc), but not 100% insecure either.

Verifying TLS for email is an easy step in making email a bit less insecure, and it requires no intervention from users. If you need something secure, then yes, go for GnuPG or other forms of end-to-end encryption (if only I could name a few).

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#25

Post by fwn »

Animats wrote: post #8

Other mailers should warn about Gmail, with "Your message was scanned for advertising purposes".

I never understood this sentiment.

I doubt that there is a way to build a webmailer without processing the emails content at some point. And as it is processed anyway; using it to adjust your ads doesn't appear to me as something significant.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#26

Post by kbenson »

Animats wrote: post #8

Other mailers should warn about Gmail, with "Your message was scanned for advertising purposes".

What about "Your message was categorized fir Bayesian spam filtering and may have contributed to eventual upstream rules" for all those installations that historically ran SpamAssassin?

If you're using Gmail or sending to a gmail address[1], you know what you are in for, and if you don't you should at least know that anything you send to someone else is no longer in your control and you have very little control over who sees it.

1: Google Apps for business accounts are not scanned for ads.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#27

Post by waffle_ss »

MicroBerto wrote: post #15

In my opinion, you should just behave like your emails are public record. This is the best way of approaching that technology.

But if your emails can be MitM'ed then the text of your emails (the public record) may not actually be what the sender wrote.

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#28

Post by headstorm »

MicroBerto wrote: post #15

In my opinion, you should just behave like your emails are public record. This is the best way of approaching that technology.

I wholly agree regarding email hosted in the United States, especially for any emails stored over 180 days on servers you don't own (see Electronic Communications Privacy Act of 1986).

Re: Gmail Will Warn If Message Is Not Authenticated/Encrypted

#30

Post by jcoffland »

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google.

I've run my own email server for about 15 years. Every now and then I have to drop everything and implement some new technology that Gmail demands I have. Granted SPF, DMARC and TLS are all great technologies but I take issue with Google making the decision that everyone is going to switch, now and with out sufficient warning.

Post reply on HN