Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Client-side encryption for Gmail in Google Workspace is now generally available

workspaceupdates.googleblog.com

Post reply on HN
Print view View original

61–70 of 101 posts

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#61

Post by tantalor »

sneak wrote: post #34
tantalor wrote: post #15

Earlier quoted context omitted.

Not saying much. Same is true about any e2e encrypted messaging (Telegram, Signal, etc.) There's no way to tell if they are intercepting your messages clientside, and you'd have to monitor all the network traffic (which would be encrypted with their keys) to detect exfiltration.

No. Signal is not redownloaded from Signal each time you launch the app, unlike javascript web apps.

You're 100% sure they didn't already ship the code and have the ability to flip a flag to enable message interception per user?

Or the ability to execute arbitrary external code?

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#62

Post by _23sd »

londons_explore wrote: post #54
we_never_see_it wrote: post #42

Earlier quoted context omitted.

> Also to be available it must first be enabled by a workspace admin, then by the end user. Just out of curiosity, why would you expect anything different?

I'm very surprised it isn't force enabled by the admin, with the end user having no say in the matter. Admins of many orgs don't like letting the user have options for things like security.

The feature is meant for especially sensitive documents, you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing. More mature products like Azure Information Protection let you require encryption for certain documents based on policy, but that doesn’t seem to be part of what Google is announcing here.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#63

Post by Idiot_in_Vain »

acatton wrote: post #3

This is purely marketing AFAIT. I don't see how it provides any protection against the 5 eyes or having one's google account breached. The encryption/decription is done with javascript code served to your browser by google (= can be hijacked/changed/…) The only way to do client side encryption is PGP on a native client distributed by a third party.

Wonder if there's a browser plugin that can calculate SHA 256 checksum for a page and all linked JS - to help verify that the encryption/decription code has not been compromised.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#64

Post by _23sd »

a-dub wrote: post #26

i think i read all the blog posts and announcements, yet i can't for the life of me find a technical explanation of what exactly this does. it looks like it could be like s/mime, or possibly a scheme for encrypting the contents of messages stored in gmail accounts. where are the keys stored? what is the threat model? can anyone enlighten?

It’s primarily for industries with strict regulatory/compliance requirements on managing sensitive data. The more detailed description is at [1]. Keys are stored in a cloud service, admins and end users use SSO to retrieve a key whenever they need to access an encrypted document. This is supposed to let companies do things like enforce rules on forwarding or printing sensitive emails, revoke access to particular documents if needed, and reduce the scale and risk of leaks if Google or an individual user account was breached. Of course, it’s not perfect in practice.

[1] https://support.google.com/a/answer/10741897

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#65

Post by 3ul3r »

Idiot_in_Vain wrote: post #63
acatton wrote: post #3

This is purely marketing AFAIT. I don't see how it provides any protection against the 5 eyes or having one's google account breached. The encryption/decription is done with javascript code served to your browser by google (= can be hijacked/changed/…) The only way to do client side encryption is PGP on a native client distributed by a third party.

Wonder if there's a browser plugin that can calculate SHA 256 checksum for a page and all linked JS - to help verify that the encryption/decription code has not been compromised.

WhatsApp build something like that: https://engineering.fb.com/2022/03/10/security/code-verify/

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#66

Post by latchkey »

fauigerzigerk wrote: post #31
xinu2020 wrote: post #10

>Availability > >Available to Google Workspace Enterprise Plus, Education Plus, and Education Standard customers >Not available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Education Fundamentals, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers >Not available to users with personal Google Accounts Also to be available it m…

To me this feature looks like a box ticking exercise with an eye toward government contracts. Microsoft has it so Google needs it too in order to avoid looking less secure to decision makers who may not know whether or not it will ever be needed.

This is not just tick a checkbox and it is done. Enabling it is non-trivial as it requires setting up a whole bunch of stuff, like integrating with a third party key service provider (or setting up your own).

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#67

Post by Neil44 »

xinu2020 wrote: post #10

>Availability > >Available to Google Workspace Enterprise Plus, Education Plus, and Education Standard customers >Not available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Education Fundamentals, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers >Not available to users with personal Google Accounts Also to be available it m…

Similar to Microsoft 365 - you need a higher end subscription there too.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#68

Post by JoshTriplett »

_23sd wrote: post #62
londons_explore wrote: post #54

Earlier quoted context omitted.

I'm very surprised it isn't force enabled by the admin, with the end user having no say in the matter. Admins of many orgs don't like letting the user have options for things like security.

The feature is meant for especially sensitive documents, you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing. More mature products like Azure Information Protection let you require encryption for certain documents based on policy, but that doesn’t seem to be part of what Google is announcing here.

> you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing

Some organizations would want to prioritize encryption over search/printing. (Also, there's no reason search and printing couldn't work with encryption.)

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#69

Post by prophesi »

JoshTriplett wrote: post #68
_23sd wrote: post #62

Earlier quoted context omitted.

The feature is meant for especially sensitive documents, you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing. More mature products like Azure Information Protection let you require encryption for certain documents based on policy, but that doesn’t seem to be part of what Google is announcing here.

> you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing Some organizations would want to prioritize encryption over search/printing. (Also, there's no reason search and printing couldn't work with encryption.)

At the very least, I can confirm that ProtonMail and Apple's Mail clients let you search through the message contents of encrypted email. I'm sure there's a performance hit, and admins wouldn't be able to search through the encrypted emails of their Workspace users, but that's a much more reasonable tradeoff.

Re: Client-side encryption for Gmail in Google Workspace is now generally available

#70

Post by a-dub »

_23sd wrote: post #64
a-dub wrote: post #26

i think i read all the blog posts and announcements, yet i can't for the life of me find a technical explanation of what exactly this does. it looks like it could be like s/mime, or possibly a scheme for encrypting the contents of messages stored in gmail accounts. where are the keys stored? what is the threat model? can anyone enlighten?

It’s primarily for industries with strict regulatory/compliance requirements on managing sensitive data. The more detailed description is at [1]. Keys are stored in a cloud service, admins and end users use SSO to retrieve a key whenever they need to access an encrypted document. This is supposed to let companies do things like enforce rules on forwarding or printing sensitive emails, revoke access to particular docu…

ok so it's basically like 0bin for google apps storage. that's a step in the right direction... it's confusing because they present it in the context of email.

although i suppose that's probably what customers are most worried about. corporate scandals tend to frequently be rooted in leaked internal communications.

Post reply on HN