4 ms·
> Yep surprised they haven't rolled one out yet. Ideally placed. In fact, they will fight tooth and nail against it since their business model relies on having
by cornholio 11y ago
> Yep surprised they haven't rolled one out yet. Ideally placed.
In fact, they will fight tooth and nail against it since their business model relies on having access to the plain text of the message. It's the very reason they are releasing this technology: a user sees a padlock icon that's confusing similar to other "encrypted" mail offerings, for example OpenPGP. For Google, it's essential that end-to-end encryption does not become the norm and that plain text emails are kept inside their walled garden.
That being said, as a form of opportunistic encryption, TLS on the SMTP layer is great and there are really no excuses not to use it in 2016. Google could push it aggressively and add an (user optional) delay against servers that try to deliver email over a plain connection: "472 Try again in 30 sec or use STARTTLS"
- tyre 11y agoHow would I search my encrypted inbox? Either Google knows my private key, in which case this doesn't seem to buy us anything, or I can't search. I search a lot.
- cornholio 11y agoWith encrypted indexes maintained on the client end. Web search is a complex problem, but searching a single user's mailbox is child's play, you don't need Google for that. Client end processing could work for advertising too, but at that point you have an information leak that severely weakens security, the client will ask for adds relevant to terms found in the message.