14 ms·

Gmail Will Warn If Message Is Not Authenticated/Encrypted

450 points by AdmiralAsshat 11y ago

jlgaddis 11y ago
I have mixed feelings about this. > Not all affected email will necessarily be dangerous. To me, it sounds like they're saying that most of the "affected email" WILL be dangerous -- just not ALL of it -- and that's highly misleading, of course. Overall, though, I think this will be a good thing if it pushes more organizations ("mail senders") to implement opportunistic encryption for incoming mail and SPF/DKIM signing for outgoing mail. That seems to be what they're referring to; that is, sending to an MX host that doesn't support opportunistic encryption) and/or receiving mail that doesn't have a valid DKIM signature. Did anyone else understand this differently?
- semi-extrinsic 11y ago
  This will be popcorn time for those using Gmail for business. I have a plugin in Thunderbird that shows the DKIM status of incoming email as gray/red/green, meaning no DKIM/DKIM invalid/DKIM valid. Most of the email I get from business accounts (usually on Exchange), including those from the company I work at, have no DKIM. (Yes, I've complained to the ITsec dept. They don't even have SPF set up...) Of the rest, surprisingly many have invalid DKIM sigs.
more_corn 11y ago
meh. This doesn't seem very interesting. What would be really interesting is gmail support for public key encryption. They're perfectly positioned to roll out a user-friendly key management system.
- andygambles 11y ago
  Yep surprised they haven't rolled one out yet. Ideally placed.
  - josteink 11y ago
    And by ideally placed, you mean for the NSA, right? I'd never put any GPG keys of mine in an American cloud provider. That sort of voids the entire point of it.
    - mineshaftgap 11y ago
      It is actually easier for the NSA if you host in Europe, but that is not really the point is it? Take America down a notch is the real goal.
    - scrupulusalbion 11y ago
      More importantly, end-to-end encryption means that your desktop/laptop/tablet/phone/TI-83 is doing the crypto, especially signatures. On a somewhat related note, I remember reading some documentation on a one-time password scheme, which I can't find anymore. It briefly mentioned something about using DES calculators to handle crypto signatures (for what reason i cannot remember). For our purposes, a PGP/GPG hand-held device would be neat, though perhaps cumbersome to actually user.
      - nyan4 11y ago
        > phone/TI-83 is doing the crypto Phone? Can we remotely trust nowadays smartphones not to have a number of backdoors?
        scrupulusalbion 11y ago
        I don't think that phones are secure, but people do use them for things like 2-factor authentication. I suppose that it is the form-factor that is more relevant, since most phones are smaller than a TI-83, so much so that people are willing to carry them around everywhere. Ultimately, what I envision would be a cross between a Blackberry (size, QWERTY keyboard) and the TI-83 (focus on being a simpler, lower-end computer). Heck, one may as well give it a unix-like OS and leave out wireless communications and sophisticated graphics. I think this is feasible, but the market would be quite small.
- Someone1234 11y ago
  Webmail struggles to offer security reassurances when utilising public key encryption. For example if Google allowed you to upload your private key and email would be transparently decrypted, that would be a great user experience, but now you have no way of knowing if the NSA/GCHQ/etc forced Google to give them your private key. If you didn't upload your private key to Google now you need your browser to decrypt your message in-line but preventing the website with the encrypted version from stealing the resulting decrypted version from the secure container. So that requires every browser to add these secure containers, for content to be marked for decryption, and for key storage. If you aren't worried about usability then you could just write a Word document, encrypt it and attach it to an unencrypted email. No browser support, or website support needed.
deleted 11y ago
[deleted]
- acchow 11y ago
  Please elaborate.
- theandrewbailey 11y ago
  > Gmail has always supported encryption in transit using TLS, and will automatically encrypt your incoming and outgoing emails if it can. We support industry-standard authentication to help combat email impersonation. > 1. If you receive a message from, or are about to send a message to, someone whose email service doesn’t support TLS encryption, you’ll see a broken lock icon in the message. > 2. If you receive a message that can’t be authenticated, you’ll see a question mark in place of the sender’s profile photo, corporate logo, or avatar. AKA, it operates like the lock in my URL bar right now except in reverse. By the way Google has explained this feature, it seems fairly good to me. At least it doesn't say "this is secure" because, among other vulnerabilities, the remote server admin can still read what is received (as has always been the case with email).
Animats 11y ago
Other mailers should warn about Gmail, with "Your message was scanned for advertising purposes".
- fwn 11y ago
  I never understood this sentiment. I doubt that there is a way to build a webmailer without processing the emails content at some point. And as it is processed anyway; using it to adjust your ads doesn't appear to me as something significant.
  - Sir_Substance 11y ago
    >I doubt that there is a way to build a webmailer without processing the emails content at some point. It is disingenuous and/or ignorant to suggest that temporarily loading an email into memory for the purpose of displaying it on the users screen is the same as parsing and catagorising the text and storing the results of the analysis in a database for the purpose of manipulating the user.
    - masterzora 11y ago
      > It is disingenuous and/or ignorant to suggest that temporarily loading an email into memory for the purpose of displaying it on the users screen [...] I may be wrong, but I think they were referring to things like spam detection, malware detection, possibly search indexing, and such rather than just "temporarily loading an into memory for the purpose of displaying it."
    - cromwellian 11y ago
      How do you run an efficient server-side search without maintaining a parsed index? I have 40,000 emails in my inbox. You want this to be linearly scanned everytime?
      - Sir_Substance 11y ago
        Yeah, I really do, it'd be funny as hell. Jesus fuck man, clean your inbox.
finnn 11y ago
>If you receive a message that can’t be authenticated, you’ll see a question mark in place of the sender’s profile photo, corporate logo, or avatar. This makes it sound like I (the sender) can set the image displayed if I am using DKIM. Is that the case? Or is it only if I have DKIM and have a Google account with that email?
- lstamour 11y ago
  Gmail uses an associated Google+ profile for authenticated emails, so you need both for it to work going forward, I presume. To get started, check https://www.google.com/business/ https://www.google.com/business/ Outlook uses Facebook and Twitter, if you have these contacts integrated. Yahoo does this too: http://techcrunch.com/2015/03/04/smart-contact-cards-arrive-in-yahoo-mail-featuring-automatically-updated-contact-info-and-links-to-social-profiles/ http://techcrunch.com/2015/03/04/smart-contact-cards-arrive-... There really should be some kind of standard or mail header though. :) Come to think of it, services could support a vcard mime-type attachment, perhaps? Except that likely wouldn't support URLs to profile photos... Maybe we've identified a missing feature of DKIM? ;-)
  - kps 11y ago
    > There really should be some kind of standard or mail header though. :) https://en.wikipedia.org/wiki/X-Face https://en.wikipedia.org/wiki/X-Face
    - Navarr 11y ago
      X-Image-URL is neat - but how do we trust it? Ensure the header is DKIM signed?
  - thrownaway2424 11y ago
    Gmail will prefer the image you include in the sender's contact info, if you manage your own address book, and it only falls back on Google profile pictures if you don't have one (which is the common case).
  - 11y ago
ck2 11y ago
I like this idea but worry novices won't understand what a red flag (lock) really means and only assume the worst.
- fixermark 11y ago
  I think that's the point---they should assume the worst. It's part of a general trend of moving the needle from "Internet services are insecure and if you really want to send something secure, you should be sure your channel is encrypted" to "These channels should always be secure; if they're not, here's a big red flag to warn you that they are not." See also the process of bypassing the "This site is insecure" alarm interstitials in Chrome and Firefox these days for sites with bad secure TLS credentials. The frog has been boiling from "We warn the user with a tiny icon they'll probably ignore" to "Users have to know secret words or convoluted config flows to bypass this inescapable error panel."
MicroBerto 11y ago
In my opinion, you should just behave like your emails are public record. This is the best way of approaching that technology.
- jacobr1 11y ago
  This is more about protecting yourself from incoming phishing attacks than your outgoing mail.
- Esau 11y ago
  That's what I do as email is more akin to a postcard than a letter. If that makes someone uncomfortable, then they should choose another medium.
  - mgbmtl 11y ago
    This is what GMail is doing: making sure that sending an email is like sending a letter (instead of a postcard). TLS email is not 100% secure (private, authenticated, etc), but not 100% insecure either. Verifying TLS for email is an easy step in making email a bit less insecure, and it requires no intervention from users. If you need something secure, then yes, go for GnuPG or other forms of end-to-end encryption (if only I could name a few).
    - ams6110 11y ago
      Yes, TLS protects the information in transit but it does not prevent a malicous intermediary from reading or altering your mail. Sort of like an envelope could be opened at the post office, read, and then resealed before you get it. You need gpg or s/mime to guard against that.
    - dhimes 11y ago
      When I saw the HN headline, I thought they were going to start enforcing the PGP encryption. I think I had a small medical event...
  - a3_nm 11y ago
    > they should choose another medium Which kind of medium do you have in mind? If you want a federated communication medium in wide use that doesn't require you to use proprietary software or a centralized server, there isn't much choice. This is why I'd say it's a worthwhile endeavor to make it possible to communicate securely and privately with email.
nchelluri 11y ago
question about this: if i send mail to my IMAP or POP server over TLS, it may still travel to various spots on the journey to its final destination unencrypted using SMTP, right?
- jcoffland 11y ago
  It's what the email server that you are making the IMAP or POP connection to does next that matters. If you send mail to a Gmail account it should make a TLS connection to Google's servers directly.
jcoffland 11y ago
This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google. I've run my own email server for about 15 years. Every now and then I have to drop everything and implement some new technology that Gmail demands I have. Granted SPF, DMARC and TLS are all great technologies but I take issue with Google making the decision that everyone is going to switch, now and with out sufficient warning.
- tantalor 11y ago
  > some new technology that Gmail demands > everyone is going to switch, now The article is pretty clear that gmail users can keep emailing others who don't support TLS or authentication; they will just now see an additional icon informing them of that condition. Nobody is being demanded to switch anything. disclaimer: works for Google
  - gscott 11y ago
    For now they will just warn on it. In a few months they will send it to spam. Just wait.
    - wnevets 11y ago
      >For now they will just warn on it. In a few months they will send it to spam. Just wait. How many months is a "few"?
    - michaelmior 11y ago
      Maybe. But that's far from "without warning."
    - sangnoir 11y ago
      > For now they will just warn on it. In a few months they will send it to spam As a recipient of all kinds of mail, I'm okay with that. I'd rather not see that unencrypted email than have it QUANTUM INSERT'd or whatever the Chinese equivalent is.
ksk 11y ago
Its great that Google wants all the lines carrying data from their servers to be secure and tamper proof. It would be interesting to see if they ever support end to end encryption which would lock them out of scanning the data as well.
- lern_too_spel 11y ago
  Then how would searching your mail work? That breaks the product on a fundamental level and makes it worse than all competing products for all but a few users with specific needs. The existing end-to-end browser extension is a reasonable compromise.
  - ksk 11y ago
    It would work in the same way as opening any encrypted mailbox works. Your password is used as the key to decrypt your mailbox when you login. The same key could also be used to search the email. Right now they're already telling you that they scan every email. So yeah, you would have to trust them that they do in-fact discard they keys and don't allow decryption in other scenarios. But large companies with tons of cash to lose if they're sued, will rarely blatantly lie about what they're doing.
- asquabventured 11y ago
  lol
kevincox 11y ago
I'm glad that companies are starting to display warnings about insecurity. It used to be that the insecurity was only advertised if something that was supposed to be secure was broken. However not having any security in the first place is often worse. I would like to see this trend continue and start warning everyone about systems that aren't secure.
ecthiender 11y ago
There are really good, albeit few, alternatives: Fastmail (https://www.fastmail.com/ https://www.fastmail.com/) Tutanota (https://tutanota.com/ https://tutanota.com/) Riseup (https://help.riseup.net/ https://help.riseup.net/)
- Diederich 11y ago
  +1 for fastmail. I've been using them for the past few years to host my 'other' main e-mail (the one I've had since 1994) and it's been a delight.
  - keehun 11y ago
    +1 for fastmail, here, too. Amazing service, really good communication during rare downtime, contributes heavily to open-source/community, decent prices, can heavily customize filters/etc, and as far as I'm aware, probably the most mainstream email provider that won't give into the NSA.
    - linkregister 11y ago
      I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to. Since you're in Tennessee (and thus a U.S. Person), you're actually ineligible for collection under FAA 702. Gmail/Hotmail/Yahoo, etc. would actually be the safest place for your information. Of course that assumes that you believe the NSA follows U.S. law. If you don't have that assumption, that also implies that the NSA wouldn't respect Australian sovereignty enough to keep it from infiltrating Fastmail's servers. I'm saying this to illustrate that there's no silver bullet for secure transmission and storage of information.
      - NeutronBoy 11y ago
        > I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to. Nobody is arguing against search warrants. People are concerned about warrantless searches.
a3_nm 11y ago
This is interesting but as pointed out by other comments there is great danger of Gmail abusing their position to make life harder for small email providers. I would be more positive towards this if they gave precise, technical details of their notion of "supporting TLS" and "being authenticated", ideally with a service allowing me to test easily whether my mail server is fine according to them (rather than having to sign up for Gmail to test it).
jcranmer 11y ago
Unfortunately, this is the sort of a change that's a red herring for any actual improvements to email security. The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like that is probably just as easily able to get it from the servers. The authentication feature is even worse. The problem of spam and phishing isn't that email claims to be from important-service@bigbank.com, it's that email claims to be from "Big Bank" <whoisthis@some.really.shady.ru>. It's been noted before that spammers tend to be the most aggressive at uptaking new "anti-spam" technologies like SPF and DKIM, and this sort of validation feature seems like a prime vehicle for exploitation by spammers.
- skybrian 11y ago
  You're arguing that we shouldn't do anything, instead of taking a step in the right direction. Email is an old ecosystem, so it's not possible to make big improvements all at once.
  - infogulch 11y ago
    Another case where The Perfect is the enemy of The Good. Baby steps, people.
  - Zigurd 11y ago
    It's a good step, but a very small step. It's been a long time since the Snowden leaks. You're pretty much naked to state surveillance without: a) An open source client that encrypts your mail b) A public key resource with a web-of-trust All the major Web portals/ecosystems could lock the spooks out of email payloads very effectively. That would still leave other issues to solve, but securing payload in flight and at rest seems like the first real milestone that makes a difference.
  - jcranmer 11y ago
    I'm not arguing that we shouldn't do anything. I'm arguing that the presentation of the data is at best meaningless and at worst downright harmful. DKIM authentication is in no way an attestation that it was sent by its sender. Furthermore, from what I can tell, more damage is caused by spoofing that works on the "I use a very similar name which is hard to see the difference" level (e.g., animenewsnetwork.com versus animenewssnetwork.com). Finding and testing solutions to that problem is something that doesn't require changing or deploying anything to new to the ecosystem, and it would arguably bring more benefit than deploying end-to-end encryption.
tsmarsh 11y ago
Support PGP already!
- fixermark 11y ago
  How? ;)
sinatra 11y ago
I think as HNers, we're focusing too heavily on niche cases (like running your own email server). But, for general public who is still sharing their own (and more importantly, their clients') SSNs, passwords, and other very sensitive information on email, this may be the trigger that educates / trains them to be more careful. I am definitely looking at this as a positive.
- jacquesm 11y ago
  With SSNs the problem is not in the fact that they are in an email, but the fact that they are sensitive information at all.
  - unprepare 11y ago
    SSNs have become a complete joke. Like why would I need to give my SSN to register for an account to take the GRE exam? And why would anyone ever make SSN an optional field? If its not required why would you ever ask for it? https://mygre.ets.org/greweb/createAcct/createAcctMain.jsp https://mygre.ets.org/greweb/createAcct/createAcctMain.jsp
    - bzbarsky 11y ago
      > And why would anyone ever make SSN an optional field? One reason might be that some states have laws on the books that prohibit requiring people to give you their SSN (unless you are actually required to collect it by some other law, of course). > If its not required why would you ever ask for it? All the answers to this are depressing. :(
stock_toaster 11y ago
I wonder how long it will be before Google fully cuts Gmail off from the outside world, much like how they turned gchat from a member of the federated xmpp/jabber ecosystem into hangouts and cut it off from the everyone else. I guess if nothing else, it would probably reduce spam!
tomputer 11y ago
Interesting. I'm wondering if they also warn Gmail users if a mailserver has TLS enabled with a self-signed certificate. Because i think many mailservers actually support TLS but do ignore certificate verification, because of the self-signed certificates.
Nux 11y ago
Will encryption via self-signed certs be accepted?
mayerzahid 11y ago
Agari is on a mission to eliminate email as a channel for cyber attacks and enable businesses and consumers to interact safely. Create your free DMARC record here: https://app.agari.com/dmarc/record_creator https://app.agari.com/dmarc/record_creator Here is a webinar with Steve Jones, Executive Director of DMARC.org, John Rae-Grant of Google and Mike Jones, Agari Director of Product Management talking about email authentication. https://www.agari.com/project/webinar-the-authenticated-email-world/ https://www.agari.com/project/webinar-the-authenticated-emai...
Tepix 11y ago
Want to run your own mail server with TLS, SPF and DKIM? Check out sovereign on github. Makes it easier and includes a lot of other useful stuff such as your own calendar and contacts server.
michaelmior 11y ago
For anyone wishing to run their own mail server, check out Mail-in-a-Box[0]. It's relatively easy to set up, comes with a nice Web GUI and they recently added support for automatic provisioning of TLS certificates with Let's Encrypt. [0] https://mailinabox.email/ https://mailinabox.email/
euske 11y ago
I wish someone made a better (non-SMTP) messaging standard which is secure, efficient, easier to understand/implement and without a clutter of all legacy stuff (and hopefully with a decent reference implementation!). Spams would still remain, but at least that would free us from worrying about the transportation layer security. (But then we might need to reinvent something like DNS on the way, so maybe that's why that no one is trying this.)
dcw303 11y ago
There's a lot of things that I question about Google, but forcing their Gmail customers to adopt more secure practices is worthy of praise. They are the biggest free email provider in the world, and they are owning up to a responsibility to ensure their users can work safely. Those running their own email servers have a similiar responsibility to their own users, even if it's only themselves. You had time to set up the server in the first place, so you have time to make it work with TLS. Now that Let's Encrypt is here there's no excuse to be running an insecure email (or web) server.
vsviridov 11y ago
Cool, just spent 20 minutes getting a proper cert from let's encrypt, and setting postfix to opportunistically encrypt outgoing mail. Used this service to make sure my setup is correct: http://www.checktls.com/index.html http://www.checktls.com/index.html Also, thunderbird apparently does not like Alternate Subject Name for smtp, but with Let's encrypt I can just issue a mail server-specific key.
jbclements 11y ago
I'll tell you what I want: I want Google to help identify non-DKIM-compliant forwarders. As the operator of (yes, I know) a vanity e-mail domain with DKIM, SPF, and DMARC records, I have no problem sending mail to gmail directly; in fact, my outgoing mail uses postmark, so I'm not even directly responsible for my sending reputation. BUT! It drives me crazy that many of my recipients get e-mail at hosts (schools, mostly) that forward the e-mail with differences (encoding changes, subject changes, etc.) that invalidate the DKIM signature. Since they're forwards, the SPF check is going to fail, too, so the end result is that google shoves it into a spam folder. I claim that google definitely has the data to be able to identify these bad forwarders--heck, even mail sent from gmail to these hosts will presumably fail DKIM checks on the way back into google--and I'd love to see them contact these domains, or even publish a list of known bad forwarders, so that I can push them to make changes.
Johnny555 11y ago
How disappointing, when I read the headline I thought Google was supporting PGP signing and encryption of emails. They could easily do so in their web and mobile clients, keeping emails safe from prying eyes. Though that would also prevent analysis of emails for ad targeting, so they'd have to do it as some sort of paid project.
wizkkidd 11y ago
Great news!
Bino 11y ago
Good initiative. Question is; what does the TLS icon indicate; is it just opportunistic TLS, or do they do any verification? What, if so? Some private consortium where only members can get a "green lock"? What's the next step? Do they have DANE https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... in mind, or some other initiative to get verified encryption such as "TES" https://openbit.eu/projekte/trusted-internet-services/ https://openbit.eu/projekte/trusted-internet-services/
- talideon 11y ago
  DANE comes with its own complications: it means you need DNSSEC, and that's a bit of a pain to set up at the best of times, especially with there being no way to currently automating DS/DNSKEY record updates to maintain the trust chain. There have been some mutterings in the IETF ProvReg WG on ways of allowing registrants some ability to automate the process, but it's still early days.
pmlnr 11y ago
I'm gettin tired of seeing 'mail is hard'. No, it's not. You need to learn it, and there are a lot of knobs and buttons, indeed, but it's not hard, especially not with the plethora of tutorials around. Sysadmining was never that easy and was never intended to be done by the general public by clicking on a few 'continue' buttons and as the web is evolving, so is mail. Deal with it.
deleted 11y ago
[deleted]

450 points by AdmiralAsshat 11y ago

I have mixed feelings about this. > Not all affected email will necessarily be dangerous. To me, it sounds like they're saying that most of the "affected email" WILL be dangerous -- just not ALL of it -- and that's highly misleading, of course. Overall, though, I think this will be a good thing if it pushes more organizations ("mail senders") to implement opportunistic encryption for incoming mail and SPF/DKIM signing for outgoing mail. That seems to be what they're referring to; that is, sending to an MX host that doesn't support opportunistic encryption) and/or receiving mail that doesn't have a valid DKIM signature. Did anyone else understand this differently?

semi-extrinsic 11y ago
This will be popcorn time for those using Gmail for business. I have a plugin in Thunderbird that shows the DKIM status of incoming email as gray/red/green, meaning no DKIM/DKIM invalid/DKIM valid. Most of the email I get from business accounts (usually on Exchange), including those from the company I work at, have no DKIM. (Yes, I've complained to the ITsec dept. They don't even have SPF set up...) Of the rest, surprisingly many have invalid DKIM sigs.

more_corn 11y ago

meh. This doesn't seem very interesting. What would be really interesting is gmail support for public key encryption. They're perfectly positioned to roll out a user-friendly key management system.

andygambles 11y ago
Yep surprised they haven't rolled one out yet. Ideally placed.
- josteink 11y ago
  And by ideally placed, you mean for the NSA, right? I'd never put any GPG keys of mine in an American cloud provider. That sort of voids the entire point of it.
  - mineshaftgap 11y ago
    It is actually easier for the NSA if you host in Europe, but that is not really the point is it? Take America down a notch is the real goal.
  - scrupulusalbion 11y ago
    More importantly, end-to-end encryption means that your desktop/laptop/tablet/phone/TI-83 is doing the crypto, especially signatures. On a somewhat related note, I remember reading some documentation on a one-time password scheme, which I can't find anymore. It briefly mentioned something about using DES calculators to handle crypto signatures (for what reason i cannot remember). For our purposes, a PGP/GPG hand-held device would be neat, though perhaps cumbersome to actually user.
    - nyan4 11y ago
      > phone/TI-83 is doing the crypto Phone? Can we remotely trust nowadays smartphones not to have a number of backdoors?
      - scrupulusalbion 11y ago
        I don't think that phones are secure, but people do use them for things like 2-factor authentication. I suppose that it is the form-factor that is more relevant, since most phones are smaller than a TI-83, so much so that people are willing to carry them around everywhere. Ultimately, what I envision would be a cross between a Blackberry (size, QWERTY keyboard) and the TI-83 (focus on being a simpler, lower-end computer). Heck, one may as well give it a unix-like OS and leave out wireless communications and sophisticated graphics. I think this is feasible, but the market would be quite small.
Someone1234 11y ago
Webmail struggles to offer security reassurances when utilising public key encryption. For example if Google allowed you to upload your private key and email would be transparently decrypted, that would be a great user experience, but now you have no way of knowing if the NSA/GCHQ/etc forced Google to give them your private key. If you didn't upload your private key to Google now you need your browser to decrypt your message in-line but preventing the website with the encrypted version from stealing the resulting decrypted version from the secure container. So that requires every browser to add these secure containers, for content to be marked for decryption, and for key storage. If you aren't worried about usability then you could just write a Word document, encrypt it and attach it to an unencrypted email. No browser support, or website support needed.

deleted 11y ago

[deleted]

acchow 11y ago
Please elaborate.
theandrewbailey 11y ago
> Gmail has always supported encryption in transit using TLS, and will automatically encrypt your incoming and outgoing emails if it can. We support industry-standard authentication to help combat email impersonation. > 1. If you receive a message from, or are about to send a message to, someone whose email service doesn’t support TLS encryption, you’ll see a broken lock icon in the message. > 2. If you receive a message that can’t be authenticated, you’ll see a question mark in place of the sender’s profile photo, corporate logo, or avatar. AKA, it operates like the lock in my URL bar right now except in reverse. By the way Google has explained this feature, it seems fairly good to me. At least it doesn't say "this is secure" because, among other vulnerabilities, the remote server admin can still read what is received (as has always been the case with email).

Animats 11y ago

Other mailers should warn about Gmail, with "Your message was scanned for advertising purposes".

fwn 11y ago
I never understood this sentiment. I doubt that there is a way to build a webmailer without processing the emails content at some point. And as it is processed anyway; using it to adjust your ads doesn't appear to me as something significant.
- Sir_Substance 11y ago
  >I doubt that there is a way to build a webmailer without processing the emails content at some point. It is disingenuous and/or ignorant to suggest that temporarily loading an email into memory for the purpose of displaying it on the users screen is the same as parsing and catagorising the text and storing the results of the analysis in a database for the purpose of manipulating the user.
  - masterzora 11y ago
    > It is disingenuous and/or ignorant to suggest that temporarily loading an email into memory for the purpose of displaying it on the users screen [...] I may be wrong, but I think they were referring to things like spam detection, malware detection, possibly search indexing, and such rather than just "temporarily loading an into memory for the purpose of displaying it."
  - cromwellian 11y ago
    How do you run an efficient server-side search without maintaining a parsed index? I have 40,000 emails in my inbox. You want this to be linearly scanned everytime?
    - Sir_Substance 11y ago
      Yeah, I really do, it'd be funny as hell. Jesus fuck man, clean your inbox.

finnn 11y ago

>If you receive a message that can’t be authenticated, you’ll see a question mark in place of the sender’s profile photo, corporate logo, or avatar. This makes it sound like I (the sender) can set the image displayed if I am using DKIM. Is that the case? Or is it only if I have DKIM and have a Google account with that email?

lstamour 11y ago
Gmail uses an associated Google+ profile for authenticated emails, so you need both for it to work going forward, I presume. To get started, check https://www.google.com/business/ https://www.google.com/business/ Outlook uses Facebook and Twitter, if you have these contacts integrated. Yahoo does this too: http://techcrunch.com/2015/03/04/smart-contact-cards-arrive-in-yahoo-mail-featuring-automatically-updated-contact-info-and-links-to-social-profiles/ http://techcrunch.com/2015/03/04/smart-contact-cards-arrive-... There really should be some kind of standard or mail header though. :) Come to think of it, services could support a vcard mime-type attachment, perhaps? Except that likely wouldn't support URLs to profile photos... Maybe we've identified a missing feature of DKIM? ;-)
- kps 11y ago
  > There really should be some kind of standard or mail header though. :) https://en.wikipedia.org/wiki/X-Face https://en.wikipedia.org/wiki/X-Face
  - Navarr 11y ago
    X-Image-URL is neat - but how do we trust it? Ensure the header is DKIM signed?
- thrownaway2424 11y ago
  Gmail will prefer the image you include in the sender's contact info, if you manage your own address book, and it only falls back on Google profile pictures if you don't have one (which is the common case).
- 11y ago

ck2 11y ago

I like this idea but worry novices won't understand what a red flag (lock) really means and only assume the worst.

fixermark 11y ago
I think that's the point---they should assume the worst. It's part of a general trend of moving the needle from "Internet services are insecure and if you really want to send something secure, you should be sure your channel is encrypted" to "These channels should always be secure; if they're not, here's a big red flag to warn you that they are not." See also the process of bypassing the "This site is insecure" alarm interstitials in Chrome and Firefox these days for sites with bad secure TLS credentials. The frog has been boiling from "We warn the user with a tiny icon they'll probably ignore" to "Users have to know secret words or convoluted config flows to bypass this inescapable error panel."

MicroBerto 11y ago

In my opinion, you should just behave like your emails are public record. This is the best way of approaching that technology.

jacobr1 11y ago
This is more about protecting yourself from incoming phishing attacks than your outgoing mail.
Esau 11y ago
That's what I do as email is more akin to a postcard than a letter. If that makes someone uncomfortable, then they should choose another medium.
- mgbmtl 11y ago
  This is what GMail is doing: making sure that sending an email is like sending a letter (instead of a postcard). TLS email is not 100% secure (private, authenticated, etc), but not 100% insecure either. Verifying TLS for email is an easy step in making email a bit less insecure, and it requires no intervention from users. If you need something secure, then yes, go for GnuPG or other forms of end-to-end encryption (if only I could name a few).
  - ams6110 11y ago
    Yes, TLS protects the information in transit but it does not prevent a malicous intermediary from reading or altering your mail. Sort of like an envelope could be opened at the post office, read, and then resealed before you get it. You need gpg or s/mime to guard against that.
  - dhimes 11y ago
    When I saw the HN headline, I thought they were going to start enforcing the PGP encryption. I think I had a small medical event...
- a3_nm 11y ago
  > they should choose another medium Which kind of medium do you have in mind? If you want a federated communication medium in wide use that doesn't require you to use proprietary software or a centralized server, there isn't much choice. This is why I'd say it's a worthwhile endeavor to make it possible to communicate securely and privately with email.

nchelluri 11y ago

question about this: if i send mail to my IMAP or POP server over TLS, it may still travel to various spots on the journey to its final destination unencrypted using SMTP, right?

jcoffland 11y ago
It's what the email server that you are making the IMAP or POP connection to does next that matters. If you send mail to a Gmail account it should make a TLS connection to Google's servers directly.

jcoffland 11y ago

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google. I've run my own email server for about 15 years. Every now and then I have to drop everything and implement some new technology that Gmail demands I have. Granted SPF, DMARC and TLS are all great technologies but I take issue with Google making the decision that everyone is going to switch, now and with out sufficient warning.

tantalor 11y ago
> some new technology that Gmail demands > everyone is going to switch, now The article is pretty clear that gmail users can keep emailing others who don't support TLS or authentication; they will just now see an additional icon informing them of that condition. Nobody is being demanded to switch anything. disclaimer: works for Google
- gscott 11y ago
  For now they will just warn on it. In a few months they will send it to spam. Just wait.
  - wnevets 11y ago
    >For now they will just warn on it. In a few months they will send it to spam. Just wait. How many months is a "few"?
  - michaelmior 11y ago
    Maybe. But that's far from "without warning."
  - sangnoir 11y ago
    > For now they will just warn on it. In a few months they will send it to spam As a recipient of all kinds of mail, I'm okay with that. I'd rather not see that unencrypted email than have it QUANTUM INSERT'd or whatever the Chinese equivalent is.

ksk 11y ago

Its great that Google wants all the lines carrying data from their servers to be secure and tamper proof. It would be interesting to see if they ever support end to end encryption which would lock them out of scanning the data as well.

lern_too_spel 11y ago
Then how would searching your mail work? That breaks the product on a fundamental level and makes it worse than all competing products for all but a few users with specific needs. The existing end-to-end browser extension is a reasonable compromise.
- ksk 11y ago
  It would work in the same way as opening any encrypted mailbox works. Your password is used as the key to decrypt your mailbox when you login. The same key could also be used to search the email. Right now they're already telling you that they scan every email. So yeah, you would have to trust them that they do in-fact discard they keys and don't allow decryption in other scenarios. But large companies with tons of cash to lose if they're sued, will rarely blatantly lie about what they're doing.
asquabventured 11y ago
lol

kevincox 11y ago

I'm glad that companies are starting to display warnings about insecurity. It used to be that the insecurity was only advertised if something that was supposed to be secure was broken. However not having any security in the first place is often worse. I would like to see this trend continue and start warning everyone about systems that aren't secure.

ecthiender 11y ago

There are really good, albeit few, alternatives: Fastmail (https://www.fastmail.com/ https://www.fastmail.com/) Tutanota (https://tutanota.com/ https://tutanota.com/) Riseup (https://help.riseup.net/ https://help.riseup.net/)

Diederich 11y ago
+1 for fastmail. I've been using them for the past few years to host my 'other' main e-mail (the one I've had since 1994) and it's been a delight.
- keehun 11y ago
  +1 for fastmail, here, too. Amazing service, really good communication during rare downtime, contributes heavily to open-source/community, decent prices, can heavily customize filters/etc, and as far as I'm aware, probably the most mainstream email provider that won't give into the NSA.
  - linkregister 11y ago
    I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to. Since you're in Tennessee (and thus a U.S. Person), you're actually ineligible for collection under FAA 702. Gmail/Hotmail/Yahoo, etc. would actually be the safest place for your information. Of course that assumes that you believe the NSA follows U.S. law. If you don't have that assumption, that also implies that the NSA wouldn't respect Australian sovereignty enough to keep it from infiltrating Fastmail's servers. I'm saying this to illustrate that there's no silver bullet for secure transmission and storage of information.
    - NeutronBoy 11y ago
      > I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to. Nobody is arguing against search warrants. People are concerned about warrantless searches.

a3_nm 11y ago

This is interesting but as pointed out by other comments there is great danger of Gmail abusing their position to make life harder for small email providers. I would be more positive towards this if they gave precise, technical details of their notion of "supporting TLS" and "being authenticated", ideally with a service allowing me to test easily whether my mail server is fine according to them (rather than having to sign up for Gmail to test it).

jcranmer 11y ago

Unfortunately, this is the sort of a change that's a red herring for any actual improvements to email security. The use of unencrypted or encrypted link to the receiving email provider's MX server doesn't change all that much in terms of who can read the email: it's still sitting in plaintext on the recipient's server (as well as the sender's server), and the group of actors who can sniff traffic on the backbone like that is probably just as easily able to get it from the servers. The authentication feature is even worse. The problem of spam and phishing isn't that email claims to be from important-service@bigbank.com, it's that email claims to be from "Big Bank" <whoisthis@some.really.shady.ru>. It's been noted before that spammers tend to be the most aggressive at uptaking new "anti-spam" technologies like SPF and DKIM, and this sort of validation feature seems like a prime vehicle for exploitation by spammers.

skybrian 11y ago
You're arguing that we shouldn't do anything, instead of taking a step in the right direction. Email is an old ecosystem, so it's not possible to make big improvements all at once.
- infogulch 11y ago
  Another case where The Perfect is the enemy of The Good. Baby steps, people.
- Zigurd 11y ago
  It's a good step, but a very small step. It's been a long time since the Snowden leaks. You're pretty much naked to state surveillance without: a) An open source client that encrypts your mail b) A public key resource with a web-of-trust All the major Web portals/ecosystems could lock the spooks out of email payloads very effectively. That would still leave other issues to solve, but securing payload in flight and at rest seems like the first real milestone that makes a difference.
- jcranmer 11y ago
  I'm not arguing that we shouldn't do anything. I'm arguing that the presentation of the data is at best meaningless and at worst downright harmful. DKIM authentication is in no way an attestation that it was sent by its sender. Furthermore, from what I can tell, more damage is caused by spoofing that works on the "I use a very similar name which is hard to see the difference" level (e.g., animenewsnetwork.com versus animenewssnetwork.com). Finding and testing solutions to that problem is something that doesn't require changing or deploying anything to new to the ecosystem, and it would arguably bring more benefit than deploying end-to-end encryption.

tsmarsh 11y ago

Support PGP already!

fixermark 11y ago
How? ;)

sinatra 11y ago

I think as HNers, we're focusing too heavily on niche cases (like running your own email server). But, for general public who is still sharing their own (and more importantly, their clients') SSNs, passwords, and other very sensitive information on email, this may be the trigger that educates / trains them to be more careful. I am definitely looking at this as a positive.

jacquesm 11y ago
With SSNs the problem is not in the fact that they are in an email, but the fact that they are sensitive information at all.
- unprepare 11y ago
  SSNs have become a complete joke. Like why would I need to give my SSN to register for an account to take the GRE exam? And why would anyone ever make SSN an optional field? If its not required why would you ever ask for it? https://mygre.ets.org/greweb/createAcct/createAcctMain.jsp https://mygre.ets.org/greweb/createAcct/createAcctMain.jsp
  - bzbarsky 11y ago
    > And why would anyone ever make SSN an optional field? One reason might be that some states have laws on the books that prohibit requiring people to give you their SSN (unless you are actually required to collect it by some other law, of course). > If its not required why would you ever ask for it? All the answers to this are depressing. :(

stock_toaster 11y ago

I wonder how long it will be before Google fully cuts Gmail off from the outside world, much like how they turned gchat from a member of the federated xmpp/jabber ecosystem into hangouts and cut it off from the everyone else. I guess if nothing else, it would probably reduce spam!

tomputer 11y ago

Interesting. I'm wondering if they also warn Gmail users if a mailserver has TLS enabled with a self-signed certificate. Because i think many mailservers actually support TLS but do ignore certificate verification, because of the self-signed certificates.

Nux 11y ago

Will encryption via self-signed certs be accepted?

mayerzahid 11y ago

Agari is on a mission to eliminate email as a channel for cyber attacks and enable businesses and consumers to interact safely. Create your free DMARC record here: https://app.agari.com/dmarc/record_creator https://app.agari.com/dmarc/record_creator Here is a webinar with Steve Jones, Executive Director of DMARC.org, John Rae-Grant of Google and Mike Jones, Agari Director of Product Management talking about email authentication. https://www.agari.com/project/webinar-the-authenticated-email-world/ https://www.agari.com/project/webinar-the-authenticated-emai...

Tepix 11y ago

Want to run your own mail server with TLS, SPF and DKIM? Check out sovereign on github. Makes it easier and includes a lot of other useful stuff such as your own calendar and contacts server.

michaelmior 11y ago

For anyone wishing to run their own mail server, check out Mail-in-a-Box[0]. It's relatively easy to set up, comes with a nice Web GUI and they recently added support for automatic provisioning of TLS certificates with Let's Encrypt. [0] https://mailinabox.email/ https://mailinabox.email/

euske 11y ago

I wish someone made a better (non-SMTP) messaging standard which is secure, efficient, easier to understand/implement and without a clutter of all legacy stuff (and hopefully with a decent reference implementation!). Spams would still remain, but at least that would free us from worrying about the transportation layer security. (But then we might need to reinvent something like DNS on the way, so maybe that's why that no one is trying this.)

dcw303 11y ago

There's a lot of things that I question about Google, but forcing their Gmail customers to adopt more secure practices is worthy of praise. They are the biggest free email provider in the world, and they are owning up to a responsibility to ensure their users can work safely. Those running their own email servers have a similiar responsibility to their own users, even if it's only themselves. You had time to set up the server in the first place, so you have time to make it work with TLS. Now that Let's Encrypt is here there's no excuse to be running an insecure email (or web) server.

vsviridov 11y ago

Cool, just spent 20 minutes getting a proper cert from let's encrypt, and setting postfix to opportunistically encrypt outgoing mail. Used this service to make sure my setup is correct: http://www.checktls.com/index.html http://www.checktls.com/index.html Also, thunderbird apparently does not like Alternate Subject Name for smtp, but with Let's encrypt I can just issue a mail server-specific key.

jbclements 11y ago

I'll tell you what I want: I want Google to help identify non-DKIM-compliant forwarders. As the operator of (yes, I know) a vanity e-mail domain with DKIM, SPF, and DMARC records, I have no problem sending mail to gmail directly; in fact, my outgoing mail uses postmark, so I'm not even directly responsible for my sending reputation. BUT! It drives me crazy that many of my recipients get e-mail at hosts (schools, mostly) that forward the e-mail with differences (encoding changes, subject changes, etc.) that invalidate the DKIM signature. Since they're forwards, the SPF check is going to fail, too, so the end result is that google shoves it into a spam folder. I claim that google definitely has the data to be able to identify these bad forwarders--heck, even mail sent from gmail to these hosts will presumably fail DKIM checks on the way back into google--and I'd love to see them contact these domains, or even publish a list of known bad forwarders, so that I can push them to make changes.

Johnny555 11y ago

How disappointing, when I read the headline I thought Google was supporting PGP signing and encryption of emails. They could easily do so in their web and mobile clients, keeping emails safe from prying eyes. Though that would also prevent analysis of emails for ad targeting, so they'd have to do it as some sort of paid project.

wizkkidd 11y ago

Great news!

Bino 11y ago

Good initiative. Question is; what does the TLS icon indicate; is it just opportunistic TLS, or do they do any verification? What, if so? Some private consortium where only members can get a "green lock"? What's the next step? Do they have DANE https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... in mind, or some other initiative to get verified encryption such as "TES" https://openbit.eu/projekte/trusted-internet-services/ https://openbit.eu/projekte/trusted-internet-services/

talideon 11y ago
DANE comes with its own complications: it means you need DNSSEC, and that's a bit of a pain to set up at the best of times, especially with there being no way to currently automating DS/DNSKEY record updates to maintain the trust chain. There have been some mutterings in the IETF ProvReg WG on ways of allowing registrants some ability to automate the process, but it's still early days.

pmlnr 11y ago

I'm gettin tired of seeing 'mail is hard'. No, it's not. You need to learn it, and there are a lot of knobs and buttons, indeed, but it's not hard, especially not with the plethora of tutorials around. Sysadmining was never that easy and was never intended to be done by the general public by clicking on a few 'continue' buttons and as the web is evolving, so is mail. Deal with it.

deleted 11y ago

[deleted]