Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Client-side encryption for Gmail in Google Workspace is now generally available

workspaceupdates.googleblog.com

Post reply on HN
Print view View original

71–80 of 101 posts

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#71

Post by londons_explore »

prophesi wrote: post #69
JoshTriplett wrote: post #68

Earlier quoted context omitted.

> you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing Some organizations would want to prioritize encryption over search/printing. (Also, there's no reason search and printing couldn't work with encryption.)

At the very least, I can confirm that ProtonMail and Apple's Mail clients let you search through the message contents of encrypted email. I'm sure there's a performance hit, and admins wouldn't be able to search through the encrypted emails of their Workspace users, but that's a much more reasonable tradeoff.

I'd be interested to know the implementation... Most search-over-encrypted-documents implementations either don't scale well (eg. require the client to do all the indexing and upload the encrypted index), or have reduced privacy (allowing the server to infer which words are in which document).

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#72

Post by sneak »

tantalor wrote: post #61
sneak wrote: post #34

Earlier quoted context omitted.

No. Signal is not redownloaded from Signal each time you launch the app, unlike javascript web apps.

You're 100% sure they didn't already ship the code and have the ability to flip a flag to enable message interception per user? Or the ability to execute arbitrary external code?

Signal's feature flags are public as the client is open source and anyone can retrieve the feature flags from the server.

You can also run your own self-built client (alternative implementations are available) and forward the messages securely any way you wish.

Such subterfuge would not remain undetected.

Signal is e2ee in ways that iMessage and WhatsApp are not.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#73

Post by meghan_rain »

mattzito wrote: post #57
idiotsecant wrote: post #56

Earlier quoted context omitted.

[flagged]

I will just repeat over and over again, that is absolutely not true. Your email data is not used for ad targeting, search personalization, or anything else. Nothing inside of Google Workspace - drive, docs, sheets, slides, chat, gmail, keep, etc. is used for any purpose outside of workspace. Source: worked on workspace for years

It makes me happy to know that most people think Google abuses their emails, and you have to fight a frustrating uphill battle to convince them otherwise. :)

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#74

Post by sucinq »

jeremyjh wrote: post #22
jmclnx wrote: post #20

Good for gmail. These days, people really should get their own domain and host there email there. If you do not know how to do this, there are plenty of cheap hosting companies you can use. And if you want to encrypt, use gnupg or that thing Thunderbird now uses. I am a mutt user and gnupg with mutt is rather easy.

What if you want email you send to make it to the inbox of gmail, 365 users?

I suppose jeremyjh@ meant emailing someone with a Google account kind of defeats the purpose of self hosting as your message is now at Google's hands. Self hosting probably makes more sense if people you're emailing are self hosting too.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#75

Post by killjoywashere »

JoshTriplett wrote: post #68
_23sd wrote: post #62

Earlier quoted context omitted.

The feature is meant for especially sensitive documents, you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing. More mature products like Azure Information Protection let you require encryption for certain documents based on policy, but that doesn’t seem to be part of what Google is announcing here.

> you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing Some organizations would want to prioritize encryption over search/printing. (Also, there's no reason search and printing couldn't work with encryption.)

It's more of an issue that people have to interact with vendors outside their direct ecosystem, who maintain different email systems. I can have all the PKI infrastructure I want, if my contracting officer has to coordinate payment of a $10M or $100M deliverable with a foreign company with different laws around encryption, I may have no choice but to send some things unencrypted until we can mutually agree on certain processes.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#76

Post by zugi »

a-dub wrote: post #26

i think i read all the blog posts and announcements, yet i can't for the life of me find a technical explanation of what exactly this does. it looks like it could be like s/mime, or possibly a scheme for encrypting the contents of messages stored in gmail accounts. where are the keys stored? what is the threat model? can anyone enlighten?

Can you only send encrypted messages to recipients who also use Google? If it isn't S/MIME then as far as I'm concerned it almost isn't email. Anyone can already make encrypted ZIP files or other proprietary encrypted attachments and send them via email. If it's not S/MIME, it feels like just a convenience layer on top of that.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#77

Post by patd »

influx wrote: post #59
mattzito wrote: post #57

Earlier quoted context omitted.

I will just repeat over and over again, that is absolutely not true. Your email data is not used for ad targeting, search personalization, or anything else. Nothing inside of Google Workspace - drive, docs, sheets, slides, chat, gmail, keep, etc. is used for any purpose outside of workspace. Source: worked on workspace for years

What about Google Purchases reading my Amazon receipts? https://www.cnbc.com/2019/05/17/google-gmail-tracks-purchase... Now my Amazon emails are neutered. Thanks.

He specifically said Google Workspace which is the non-free version of the Google suite.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#79

Post by fauigerzigerk »

latchkey wrote: post #66
fauigerzigerk wrote: post #31

Earlier quoted context omitted.

To me this feature looks like a box ticking exercise with an eye toward government contracts. Microsoft has it so Google needs it too in order to avoid looking less secure to decision makers who may not know whether or not it will ever be needed.

This is not just tick a checkbox and it is done. Enabling it is non-trivial as it requires setting up a whole bunch of stuff, like integrating with a third party key service provider (or setting up your own).

I didn't mean to say anything about how hard it is to implement.

What I'm saying is that the point of implementing this feature may not be that it's expected to be tremendously useful for a lot of actual users.

Rather I think the point is to not leave the "has client-side encryption" box unchecked in any comparison charts or scoring systems that may influence purchasing decisions.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#80

Post by UncleMeat »

acatton wrote: post #3

This is purely marketing AFAIT. I don't see how it provides any protection against the 5 eyes or having one's google account breached. The encryption/decription is done with javascript code served to your browser by google (= can be hijacked/changed/…) The only way to do client side encryption is PGP on a native client distributed by a third party.

Except that we've got two decades of evidence of people regularly fucking up PGP leaking the contents of entire email threads. If the only thing that works is PGP then nothing works.
Post reply on HN