Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail E2E is as terrible as expected

michal.sapka.pl

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Gmail E2E is as terrible as expected

#41

Post by SparkyMcUnicorn »

josephg wrote: post #24
jurschreuder wrote: post #22

People in China could not open a url sent in Gmail. I happened to be in China, I tried to open the webpage and it worked, no firewall. I hovered on the link in Gmail and Chrome told me left bottom it was just that exact url. But when I opened the url it got blocked by the great firewall. Why? Any link in Gmail secretly gets replaced by a link to Google that tracks you and then redirects you to the original link. The…

That’s a classic technique to track click through rates. Google.com has done this forever. The technique is to make an actual link in HTML ( ) then add an event handler which cancels the link’s default behaviour when you click it - and replaces it with javascript, or a tracking link. I understand why Google.com wants that data. But in an email client it’s extremely obnoxious.

I thought Gmail didn't support js execution. Did Google make an exception for themselves?

Re: Gmail E2E is as terrible as expected

#42

Post by pas »

aborsy wrote: post #37
bigfatkitten wrote: post #21

Earlier quoted context omitted.

> The E2E problem has already been solved long time ago. We used to have Thunderbird with an OpenPGP extension and GPG keys. It was never really solved, PGP email is a usability disaster. Client support (especially on mobile) is limited. Headers, including the subject line remain in cleartext. Users forget to click the "encrypt email" button and so messages go out in the clear; sometimes in reply, and so the entire c…

It’s a disaster because email providers don’t want to offer E2EE or make it easy. Is it that hard to generate a certificate for each email address client side and store that, and the private key encrypted with the user’s password, on the provider’s server? The majority of email is gmail and Google could make that E2EE by default. Countless products that have successfully implemented public key distribution (proton ma…

that's not the hard part. it's the out-of-band key exchange. (or key discovery/verification. so basically how to avoid the trust on first time use problem.)

Re: Gmail E2E is as terrible as expected

#44

Post by Dylan16807 »

irq-1 wrote: post #33
Freak_NL wrote: post #7

This was already happening, unfortunately. The user's mail agent is deemed untrustworthy (and so is the user), so every service which needs to send confidential data just turns your email into a notification with a link. There are so many of these, but often they are limited in scope. For sectors like healthcare you have companies offering this type of service to companies which need to adhere to security theatre sta…

> The user's mail agent is deemed untrustworthy (and so is the user) Bluesky follows this pattern for the benefit of the user. The internet tradition has always been: if you want to control it, you have to host it.

> if you want to control it

In the context of sending a secure message, the sender maintaining control goes in the negatives column. At best it's a compromise in exchange for specific security features.

Re: Gmail E2E is as terrible as expected

#45

Post by bigthymer »

bob1029 wrote: post #29
Freak_NL wrote: post #7

This was already happening, unfortunately. The user's mail agent is deemed untrustworthy (and so is the user), so every service which needs to send confidential data just turns your email into a notification with a link. There are so many of these, but often they are limited in scope. For sectors like healthcare you have companies offering this type of service to companies which need to adhere to security theatre sta…

I struggle with how the secure email solutions are inherently more secure than just dumping the pdf or ticket details in the email body. Every vendor's secure email portal I have ever used was ultimately authenticated using my email account. Any one-time passcodes are sent to the same email. Password recovery? Email. If a malicious user is on my PC or otherwise intercepting my mail, they could access 100% of the solu…

I always understood it as, the email with link notification thing started as soon as email providers began regularly scanning users' emails. Before then, an email included all the information you needed without having to login to another site.

Re: Gmail E2E is as terrible as expected

#46

Post by Telemakhos »

bigfatkitten wrote: post #21
p2detar wrote: post #13

The E2E problem has already been solved long time ago. We used to have Thunderbird with an OpenPGP extension and GPG keys. Then there were a whole plethora of products were build around Lotus Notes Domino that provided a central place for securing outgoing E-mail using either S/MIME or GPG keys. All of this on premises. Then came the Cloud and obliterated these products. And for what? edit: typos

> The E2E problem has already been solved long time ago. We used to have Thunderbird with an OpenPGP extension and GPG keys. It was never really solved, PGP email is a usability disaster. Client support (especially on mobile) is limited. Headers, including the subject line remain in cleartext. Users forget to click the "encrypt email" button and so messages go out in the clear; sometimes in reply, and so the entire c…

While I'm sure some of these flaws also apply to S/MIME, I feel like its client support (even in Apple iPhone native mail app) is far superior to PGP. Apple made S/MIME installation and use across its ecosystem, and I remember it being easy in kMail once upon a time when I used KDE; why didn't S/MIME ever catch on?

Re: Gmail E2E is as terrible as expected

#47

Post by jack0813 »

modeless wrote: post #25
Freak_NL wrote: post #7

This was already happening, unfortunately. The user's mail agent is deemed untrustworthy (and so is the user), so every service which needs to send confidential data just turns your email into a notification with a link. There are so many of these, but often they are limited in scope. For sectors like healthcare you have companies offering this type of service to companies which need to adhere to security theatre sta…

I hate this so much. I will pay for a service that takes all these content-free messages and goes to the website and logs in and extracts the actual message content and puts it in my inbox. Anyone want to make that? I actually think there is a more general opportunity here with AI. Every app and website and UI I use is optimized by a gaggle of PMs to achieve business objectives that don't necessarily benefit me. AI i…

You can probably do this fairly easily already, like this:

- Fetch your emails using any of the common local mail sync tools

- Some processing to clean up the plaintext version, may not be necessary even

- Send it to an LLM to extract a link

- Open up a headless browser, trigger something like SingleFile to extract its content.

Though you'll have to keep the cookie refreshed, but if it is initially logged in, this should be fine since you can also program something to keep refreshing every once in a while.

Re: Gmail E2E is as terrible as expected

#48

Post by OptionOfT »

smileybarry wrote: post #28
Freak_NL wrote: post #7

This was already happening, unfortunately. The user's mail agent is deemed untrustworthy (and so is the user), so every service which needs to send confidential data just turns your email into a notification with a link. There are so many of these, but often they are limited in scope. For sectors like healthcare you have companies offering this type of service to companies which need to adhere to security theatre sta…

Yep, while I like moving all snail mail to email, I hate that (almost) every single service now just sends a "monthly/quarterly report now available in your account area!" email. A rare few of them at least offer the option of just sending it attached (with the default being a useless reminder email), but most are essentially a chore, because nearly everything here uses phone+2FA as login rather than a password or pa…

For that reason I actually have decided to get everything via snail-mail.

When BofA sends me a new statement I need to:

    * click on the link in my inbox
    * wait for the email-provider to scan the email (and Office 365 does sometimes tell me they can't scan the link)
(either)

    * Enter my username & password
    * Select that I want my 2FA via call or text
    * Wait for the call or text to arrive
    * Enter it (now I'm signed in)
(or)

    * search my house for my YubiKey
    * lean over to insert YubiKey
    * click cancel on the Windows popup for the passkey
    * click cancel on the Bitwarden popup for the passkey
    * click Physical key on the Chrome / Edge popup for passkeys
    * put in YubiKey pin
    * lean over again to physically touch YubiKey
(end)

    * Click no on the next credit card offer
    * Navigate to Credit Cards
    * Click the Credit Card
    * Click Documents
    * Click current statement
or

when I'm on my walk (which I do anyway)

    * insert key in mailbox
    * (no delay) open mailbox
    * (no delay) take out letters
    * (no delay) close mailbox
    * (no delay) remove key
    * walk home
    * open statement
    * validate statement
    * trash statement
Even with passkeys there are too many where the flow can / purposefully is interrupted.

Re: Gmail E2E is as terrible as expected

#49

Post by taneq »

p2detar wrote: post #13

The E2E problem has already been solved long time ago. We used to have Thunderbird with an OpenPGP extension and GPG keys. Then there were a whole plethora of products were build around Lotus Notes Domino that provided a central place for securing outgoing E-mail using either S/MIME or GPG keys. All of this on premises. Then came the Cloud and obliterated these products. And for what? edit: typos

> And for what?

Job security. The software industry was built on the premise that users would buy all new software and hardware every 3 years. In the mid 2000s they collectively realised that software was ‘good enough’ for most users, and that it doesn’t wear out.

SaaS, the subscription model, “the cloud”, they’re all about making the user pay more than once for the same software.

Re: Gmail E2E is as terrible as expected

#50

Post by fn-mote »

smileybarry wrote: post #28
Freak_NL wrote: post #7

This was already happening, unfortunately. The user's mail agent is deemed untrustworthy (and so is the user), so every service which needs to send confidential data just turns your email into a notification with a link. There are so many of these, but often they are limited in scope. For sectors like healthcare you have companies offering this type of service to companies which need to adhere to security theatre sta…

Yep, while I like moving all snail mail to email, I hate that (almost) every single service now just sends a "monthly/quarterly report now available in your account area!" email. A rare few of them at least offer the option of just sending it attached (with the default being a useless reminder email), but most are essentially a chore, because nearly everything here uses phone+2FA as login rather than a password or pa…

> because nearly everything here uses phone+2FA as login

Here in the US we only wish things were that secure.

Unless by 2FA you mean “code sent via SMS”.

Post reply on HN