Gmail E2E is as terrible as expected • Hacker News Board

Re: Gmail E2E is as terrible as expected

#21

Post by bigfatkitten » Sun, Apr 06, 2025, 9:27 PM UTC

p2detar wrote: post #13

The E2E problem has already been solved long time ago. We used to have Thunderbird with an OpenPGP extension and GPG keys. Then there were a whole plethora of products were build around Lotus Notes Domino that provided a central place for securing outgoing E-mail using either S/MIME or GPG keys. All of this on premises. Then came the Cloud and obliterated these products. And for what? edit: typos

> The E2E problem has already been solved long time ago. We used to have Thunderbird with an OpenPGP extension and GPG keys.

It was never really solved, PGP email is a usability disaster.

Client support (especially on mobile) is limited. Headers, including the subject line remain in cleartext. Users forget to click the "encrypt email" button and so messages go out in the clear; sometimes in reply, and so the entire conversation is exposed. Key exchange with new recipients is tedious to do securely.

Not to mention the extra issues caused by HTML in message bodies.

https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you...

Re: Gmail E2E is as terrible as expected

#22

Post by jurschreuder » Sun, Apr 06, 2025, 9:33 PM UTC

People in China could not open a url sent in Gmail. I happened to be in China, I tried to open the webpage and it worked, no firewall.

I hovered on the link in Gmail and Chrome told me left bottom it was just that exact url.

But when I opened the url it got blocked by the great firewall.

Why? Any link in Gmail secretly gets replaced by a link to Google that tracks you and then redirects you to the original link.

The most obnoxious thing about this I think is that Chrome shows the original link.

Re: Gmail E2E is as terrible as expected

#23

Post by tky » Sun, Apr 06, 2025, 9:38 PM UTC

All the takes on this release miss one crucial point: if you want people to adopt E2E encryption, you must reduce friction. For users of Gmail, that means familiar elements and flow to their usual use of Gmail. If this lets even a handful of people use more secure messaging, it’s a win. For Google workspace-centric orgs it’s a good step in the right direction.

If you disagree, go set up GPG on a non-tech’s computer, tell them they need to use Thunderbird or some other helper app(s), and see if you can even go home before being asked to remove it all.

Re: Gmail E2E is as terrible as expected

#24

Post by josephg » Sun, Apr 06, 2025, 9:41 PM UTC

jurschreuder wrote: post #22

People in China could not open a url sent in Gmail. I happened to be in China, I tried to open the webpage and it worked, no firewall. I hovered on the link in Gmail and Chrome told me left bottom it was just that exact url. But when I opened the url it got blocked by the great firewall. Why? Any link in Gmail secretly gets replaced by a link to Google that tracks you and then redirects you to the original link. The…

That’s a classic technique to track click through rates. Google.com has done this forever. The technique is to make an actual link in HTML () then add an event handler which cancels the link’s default behaviour when you click it - and replaces it with javascript, or a tracking link.

I understand why Google.com wants that data. But in an email client it’s extremely obnoxious.

Re: Gmail E2E is as terrible as expected

#25

Post by modeless » Sun, Apr 06, 2025, 9:44 PM UTC

Freak_NL wrote: post #7

This was already happening, unfortunately. The user's mail agent is deemed untrustworthy (and so is the user), so every service which needs to send confidential data just turns your email into a notification with a link. There are so many of these, but often they are limited in scope. For sectors like healthcare you have companies offering this type of service to companies which need to adhere to security theatre sta…

I hate this so much. I will pay for a service that takes all these content-free messages and goes to the website and logs in and extracts the actual message content and puts it in my inbox. Anyone want to make that?

I actually think there is a more general opportunity here with AI. Every app and website and UI I use is optimized by a gaggle of PMs to achieve business objectives that don't necessarily benefit me. AI is getting to the point where soon it will be able to use these non-aligned UIs for me, and present to me a much simpler UI customized just for me, that does what I actually want and no more.

Re: Gmail E2E is as terrible as expected

#26

Post by josephg » Sun, Apr 06, 2025, 9:44 PM UTC

p2detar wrote: post #13

The E2E problem has already been solved long time ago. We used to have Thunderbird with an OpenPGP extension and GPG keys. Then there were a whole plethora of products were build around Lotus Notes Domino that provided a central place for securing outgoing E-mail using either S/MIME or GPG keys. All of this on premises. Then came the Cloud and obliterated these products. And for what? edit: typos

For PGP keys to work, users also need to publicly broadcast who they know and personally trust. It’s a privacy disaster.

Re: Gmail E2E is as terrible as expected

#27

Post by mzajc » Sun, Apr 06, 2025, 9:45 PM UTC

jurschreuder wrote: post #22

People in China could not open a url sent in Gmail. I happened to be in China, I tried to open the webpage and it worked, no firewall. I hovered on the link in Gmail and Chrome told me left bottom it was just that exact url. But when I opened the url it got blocked by the great firewall. Why? Any link in Gmail secretly gets replaced by a link to Google that tracks you and then redirects you to the original link. The…

> The most obnoxious thing about this I think is that Chrome shows the original link.

Not defending Google here, but could it be that the tracking page is opened by onclick() while the browser shows the original href attribute?

I've seen some websites do that for various purposes and opening the link in a new tab (middle mouse click) usually bypasses it.

Re: Gmail E2E is as terrible as expected

#28

Post by smileybarry » Sun, Apr 06, 2025, 9:46 PM UTC

Freak_NL wrote: post #7

This was already happening, unfortunately. The user's mail agent is deemed untrustworthy (and so is the user), so every service which needs to send confidential data just turns your email into a notification with a link. There are so many of these, but often they are limited in scope. For sectors like healthcare you have companies offering this type of service to companies which need to adhere to security theatre sta…

Yep, while I like moving all snail mail to email, I hate that (almost) every single service now just sends a "monthly/quarterly report now available in your account area!" email. A rare few of them at least offer the option of just sending it attached (with the default being a useless reminder email), but most are essentially a chore, because nearly everything here uses phone+2FA as login rather than a password or passkey.

Re: Gmail E2E is as terrible as expected

#29

Post by bob1029 » Sun, Apr 06, 2025, 9:53 PM UTC

Freak_NL wrote: post #7

This was already happening, unfortunately. The user's mail agent is deemed untrustworthy (and so is the user), so every service which needs to send confidential data just turns your email into a notification with a link. There are so many of these, but often they are limited in scope. For sectors like healthcare you have companies offering this type of service to companies which need to adhere to security theatre sta…

I struggle with how the secure email solutions are inherently more secure than just dumping the pdf or ticket details in the email body.

Every vendor's secure email portal I have ever used was ultimately authenticated using my email account. Any one-time passcodes are sent to the same email. Password recovery? Email. If a malicious user is on my PC or otherwise intercepting my mail, they could access 100% of the solutions I've got access to right now.

Re: Gmail E2E is as terrible as expected

#30

Post by sieabahlpark » Sun, Apr 06, 2025, 9:53 PM UTC

jurschreuder wrote: post #22

People in China could not open a url sent in Gmail. I happened to be in China, I tried to open the webpage and it worked, no firewall. I hovered on the link in Gmail and Chrome told me left bottom it was just that exact url. But when I opened the url it got blocked by the great firewall. Why? Any link in Gmail secretly gets replaced by a link to Google that tracks you and then redirects you to the original link. The…

[dead]