Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail confidential mode is not secure or private

protonmail.com

Post reply on HN
Print view View original

191–200 of 226 posts

Re: Gmail confidential mode is not secure or private

#191

Post by Fnoord »

slips wrote: post #128
bitexploder wrote: post #110

Earlier quoted context omitted.

Is a citation really needed about the NSA collecting basically all the data on the Internet? This is "common knowledge" in information security circles. Go look up the battles the EFF has fought with the NSA about their data collection practices. The NSA is continually building giant data warehouses everywhere... they probably have more data centers than any other organization in existence. They collect all the data.

It's pretty common for people to throw out "citation needed" when they don't want to believe or admit something, but can't plausibly deny it. Sort of the same way people use the term "fallacy" these days.

IMO "Citation needed" is a quick way to say "do you have a source for me?", and "fallacy" (hardly used without also mentioning the specific fallacy) is a quicker way to say "I recognized logic flaw X in your argument".

You are free to see harm in these statements but telling me they are always meant as harmful as you mentioned is your own negative reflection. Not mine or ours, we are free to have our own interpretation as well.

Re: Gmail confidential mode is not secure or private

#192

Post by bitexploder »

Fnoord wrote: post #191
slips wrote: post #128

Earlier quoted context omitted.

It's pretty common for people to throw out "citation needed" when they don't want to believe or admit something, but can't plausibly deny it. Sort of the same way people use the term "fallacy" these days.

IMO "Citation needed" is a quick way to say "do you have a source for me?", and "fallacy" (hardly used without also mentioning the specific fallacy) is a quicker way to say "I recognized logic flaw X in your argument". You are free to see harm in these statements but telling me they are always meant as harmful as you mentioned is your own negative reflection. Not mine or ours, we are free to have our own interpretati…

I think citation needed carries a connotation of “I don’t believe this is true.” It is just a lazy way to converse if you are engaged in a genial conversation in good faith. “This is new to me, can you share some references?” I appreciate we can be technical and to the point, but given the context, I felt my response was appropriate.

Re: Gmail confidential mode is not secure or private

#193

Post by bitexploder »

lern_too_spel wrote: post #186
bitexploder wrote: post #110

Earlier quoted context omitted.

Is a citation really needed about the NSA collecting basically all the data on the Internet? This is "common knowledge" in information security circles. Go look up the battles the EFF has fought with the NSA about their data collection practices. The NSA is continually building giant data warehouses everywhere... they probably have more data centers than any other organization in existence. They collect all the data.

> Is a citation really needed about the NSA collecting basically all the data on the Internet? Yes because this claim is preposterous. You don't even need a napkin to show this is impossible. > This is "common knowledge" in information security circles. The "common knowledge" in Internet industry circles is that Snowden misinterpreted several documents and made wild claims about what they said. > Go look up the battl…

I think that is honestly not what those documents show at all. How they actually do it is ripe for abuse and egregiously broad and beyond the scope of simple foreign monitoring.

Re: Gmail confidential mode is not secure or private

#194

Post by bitexploder »

joshuamorton wrote: post #188
brantonb wrote: post #187

Earlier quoted context omitted.

If a billion people watch the same YouTube video, the NSA isn’t going to store a billion copies of it.

...But they don't know it's the same youtube video. It's just an encrypted bytes from a connection to youtube.com. Now you might be able to infer from metadata what the video is sometimes, but given that youtube does things like dynamically change the resolution it sends over the wire based on network congestion during a single watch session, it's not clear that size and length metadata would be enough to dedupe.

It is endearing to me that people still think the NSA can't break most of the TLS traffic on the the Internet. I have my doubts about the security provided by traffic that transits US soil and is protected by US CAs. High skepticism would be a better way to put it. Citation needed, and I don't have one, but it is safest to assume they have this capability, and before anyone gets up in arms about this statement, I do understand how certificate authorities and TLS works and I don't think they have to break it cryptographically.

Keep in mind there are side channel attacks that let you guess passwords typed via SSH. I wouldn't be even a little surprised if the side channel leakage of most Internet traffic zooming around via TLS is good enough that the NSA can sort it pretty easily. This is all theorizing on my part, though.

What we do know is they can probably collect a huge amount of useful traffic and store it for a relatively short, but useful amount of time (weeks, probably). Kind of like a ring buffer. Systems are always sifting and flagging and saving some portion of what they are collecting, including raw traffic. Also consider that there are lots of ways of unmasking the basic metadata of the streams through any number of leaky things happening in the web browser.

This traffic is collected in an un-targeted fashion. They just promise (pinky swear) they don't look at it without a search warrant. Then a search program executes and they retrieve it from the data stores. Think about that legal theory, because that is exactly what Michael Hayden testified to. I don't know if it is just an age gap or something else, but I think people on HN are not aware of the extreme data collection the NSA performs and the ongoing threat this is, and continues to be, to privacy.

Anyhow, I think the generation after millennials should be called the surveillance generation, because it's all tracked. I just can't understand the skepticism at what the NSA is doing because of some lazy back of the envelope math. Anyway, this isn't really targeted at you as a reply, but this whole thread... there was a time when this sort of skepticism was basically the norm in technical circles with little doubt. Now I see it eroding in general tech circles.

Re: Gmail confidential mode is not secure or private

#195

Post by mulmen »

inlined wrote: post #108
mulmen wrote: post #51

Earlier quoted context omitted.

So you reference Snowden then pretend dragnet surveillance doesn't exist? If you are on the internet the NSA is spying on you and everyone else. This is not an improvement because it makes guarantees that simply aren't true. These compromises are made to further Google's bottom line, not protect users. Don't pretend this is some kind of incremental improvement. It's a marketing gimmick.

Though since the Snowden leak Google really upped their game. Everything internally is encrypted in transit and at rest. Even when you use Google Cloud you automatically get encryption at rest.

Should we be proud of them for that? What does it have to do with Snowden? They can still read my emails.

Re: Gmail confidential mode is not secure or private

#196

Post by [deleted] »

anyfoo wrote: post #120
mulmen wrote: post #91

Earlier quoted context omitted.

That the recipient can't "forward, copy, download, or print" the message and that the message expiration will prevent the recipient from viewing the message.

From what you have pasted, it seems that they just claim to disable those options in their UI?

[deleted]

Re: Gmail confidential mode is not secure or private

#197

Post by mulmen »

privateSFacct wrote: post #167
cfmcdonald wrote: post #31

The point of confidential mode is for corporate users. When the CEO sends out that confidential mail to the company, it adds a speed bump to users who are about to copy out data that they have been told they should not, so they get a chance to realize they should not do this, and then removes all plausible deniability when they choose to bypass that speed bump.

Actually, in many corporate cases BOTH parties want to keep the info confidential - the CEO sends over salary details to CFO to load into payroll system. After it's all loaded and printed for the files (or saved in the HR system), they BOTH want it to auto-expire out of their emails, but both are too busy to scrape back through old emails after a month to delete things. So this confidential mode let's this happen nat…

So confidential mode is a cumbersome retention mechanism? A simple email rule can do this for all messages.

Re: Gmail confidential mode is not secure or private

#198

Post by lern_too_spel »

bitexploder wrote: post #193
lern_too_spel wrote: post #186

Earlier quoted context omitted.

> Is a citation really needed about the NSA collecting basically all the data on the Internet? Yes because this claim is preposterous. You don't even need a napkin to show this is impossible. > This is "common knowledge" in information security circles. The "common knowledge" in Internet industry circles is that Snowden misinterpreted several documents and made wild claims about what they said. > Go look up the battl…

I think that is honestly not what those documents show at all. How they actually do it is ripe for abuse and egregiously broad and beyond the scope of simple foreign monitoring.

> I think that is honestly not what those documents show at all.

Then either you have the same reading errors as Snowden, or you haven't looked at the actual documents instead of Greenwald's incompetent reporting of them.

Re: Gmail confidential mode is not secure or private

#199

Post by junar »

danShumway wrote: post #61
sigmar wrote: post #54

Earlier quoted context omitted.

>Note: Although confidential mode helps prevent the recipients from accidentally sharing your email, it doesn't prevent recipients from taking screenshots or photos of your messages or attachments. Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. If you click the "learn more" in gmail it says that ^. Gmail seems pretty upfront about what "con…

> Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. Even this is really poorly worded. You don't need a "malicious" program on your computer, you just need to go to your browser menu and hit the print button. This still makes it sound like the average user won't be able to save your email unless they're doing some kind of tech mumbo-jumbo -- t…

> Recipients of the confidential message will have options to forward, copy, print, and download disabled.

Doesn't seem to be that easy. You're probably not going to get a copy without taking a screenshot, opening up developer tools or digging into your browser's cache.

Re: Gmail confidential mode is not secure or private

#200

Post by lern_too_spel »

bitexploder wrote: post #194
joshuamorton wrote: post #188

Earlier quoted context omitted.

...But they don't know it's the same youtube video. It's just an encrypted bytes from a connection to youtube.com. Now you might be able to infer from metadata what the video is sometimes, but given that youtube does things like dynamically change the resolution it sends over the wire based on network congestion during a single watch session, it's not clear that size and length metadata would be enough to dedupe.

It is endearing to me that people still think the NSA can't break most of the TLS traffic on the the Internet. I have my doubts about the security provided by traffic that transits US soil and is protected by US CAs. High skepticism would be a better way to put it. Citation needed, and I don't have one, but it is safest to assume they have this capability, and before anyone gets up in arms about this statement, I do…

Nothing that you conjectured is supported by any documents. Snowden grabbed pretty much everything he could get his hands on as a SharePoint admin, so if any of that were true, it would have made its way into bigger news than the ho-hum stuff that was reported.
Post reply on HN