Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Client-side encryption for Gmail in Google Workspace is now generally available

workspaceupdates.googleblog.com

Post reply on HN
Print view View original

31–40 of 101 posts

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#31

Post by fauigerzigerk »

xinu2020 wrote: post #10

>Availability > >Available to Google Workspace Enterprise Plus, Education Plus, and Education Standard customers >Not available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Education Fundamentals, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers >Not available to users with personal Google Accounts Also to be available it m…

To me this feature looks like a box ticking exercise with an eye toward government contracts. Microsoft has it so Google needs it too in order to avoid looking less secure to decision makers who may not know whether or not it will ever be needed.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#32

Post by misterio7 »

misterio7 wrote: post #28
jeremyjh wrote: post #22

Earlier quoted context omitted.

What if you want email you send to make it to the inbox of gmail, 365 users?

Most hosted mail services have no issues getting to mailbox. I've used Gandi, Mailbox, FastMail, and never have any mails flagged as spam. Deliverability is only an issue when self hosting (particularly for home IPs)

I mean, at least for me it hasn't been a problem. I currently self host mail on a VPS and everything's awesome. YMMV

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#33

Post by groffee »

deelowe wrote: post #19
cientifico wrote: post #9

That is not Generally available: Availability * Available to Google Workspace Enterprise Plus, Education Plus, and Education Standard customers * Not available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Education Fundamentals, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers * Not available to users with personal Google A…

At Google, generally available means it's no longer in testing. It's a development lifecycle term.

That's weasel word marketing.

They know the majority of their users are going to think 'generally available' is exactly what it sounds like, not their made up meaning.

https://en.wikipedia.org/wiki/Weasel_word

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#34

Post by sneak »

tantalor wrote: post #15
acatton wrote: post #3

This is purely marketing AFAIT. I don't see how it provides any protection against the 5 eyes or having one's google account breached. The encryption/decription is done with javascript code served to your browser by google (= can be hijacked/changed/…) The only way to do client side encryption is PGP on a native client distributed by a third party.

Not saying much. Same is true about any e2e encrypted messaging (Telegram, Signal, etc.) There's no way to tell if they are intercepting your messages clientside, and you'd have to monitor all the network traffic (which would be encrypted with their keys) to detect exfiltration.

No. Signal is not redownloaded from Signal each time you launch the app, unlike javascript web apps.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#35

Post by rerdavies »

Gasp0de wrote: post #13
belltaco wrote: post #4

Title is misleading. > Not available to users with personal Google Accounts

Yes, perhaps "for Google Workspace Enterprise Plus, Education Plus, and Education Standard customers" could be added to the HN title?

Or perhaps change the title to "narrowly available".

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#36

Post by kevincox »

acatton wrote: post #3

This is purely marketing AFAIT. I don't see how it provides any protection against the 5 eyes or having one's google account breached. The encryption/decription is done with javascript code served to your browser by google (= can be hijacked/changed/…) The only way to do client side encryption is PGP on a native client distributed by a third party.

I think the primary benefit is that in theory you can cut Google off at any time. If you disable the key service they can no longer decrypt your data. So if you decided that Google is no longer trustworthy you can leave and they can't access your data.

Of course this is sort of an odd game where you need to cut their access off before they backdoor it, so you have to somehow predict that Google is going to become malicious and beat them to the punch. If you a reacting to something that they are doing it likely isn't helping much.

Another possible advantage is that you could potentially have logging on key access which could give some idea of data usage. So if Google starts requesting keys for all of your stored data then you can be suspicious that they are siphoning up your data. (Or doing some background maintenance? Who knows?)

In practice this is probably mostly checkbox theater where it is a feature that Google and their users can list.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#37

Post by akerl_ »

groffee wrote: post #33
deelowe wrote: post #19

Earlier quoted context omitted.

At Google, generally available means it's no longer in testing. It's a development lifecycle term.

That's weasel word marketing. They know the majority of their users are going to think 'generally available' is exactly what it sounds like, not their made up meaning. https://en.wikipedia.org/wiki/Weasel_word

If a restaurant near you says their new menu is generally available, do you turn up looking for a free meal without a reservation?

The Google announcement is pretty direct about the plans the feature is included with, and how to enable it.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#38

Post by Crosseye_Jack »

deelowe wrote: post #19
cientifico wrote: post #9

That is not Generally available: Availability * Available to Google Workspace Enterprise Plus, Education Plus, and Education Standard customers * Not available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Education Fundamentals, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers * Not available to users with personal Google A…

At Google, generally available means it's no longer in testing. It's a development lifecycle term.

> At Google, generally available means it's a feature that about to be killed off.

;-)

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#39

Post by [deleted] »

groffee wrote: post #33
deelowe wrote: post #19

Earlier quoted context omitted.

At Google, generally available means it's no longer in testing. It's a development lifecycle term.

That's weasel word marketing. They know the majority of their users are going to think 'generally available' is exactly what it sounds like, not their made up meaning. https://en.wikipedia.org/wiki/Weasel_word

[deleted]

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#40

Post by pmontra »

kevincox wrote: post #36
acatton wrote: post #3

This is purely marketing AFAIT. I don't see how it provides any protection against the 5 eyes or having one's google account breached. The encryption/decription is done with javascript code served to your browser by google (= can be hijacked/changed/…) The only way to do client side encryption is PGP on a native client distributed by a third party.

I think the primary benefit is that in theory you can cut Google off at any time. If you disable the key service they can no longer decrypt your data. So if you decided that Google is no longer trustworthy you can leave and they can't access your data. Of course this is sort of an odd game where you need to cut their access off before they backdoor it, so you have to somehow predict that Google is going to become mal…

I wonder which tool we can use to decrypt the exported messages before importing them into a local (mbox, maildir) or remote message store (IMAP.) At worst we can use the JS code Google sends us, but extracting it from the gmail JS bundle is probably non trivial.
Post reply on HN