6 ms·
If they had end-to-end encryption, then Google wouldn't be able to read the emails; meaning to gain value, Google would have to charge for the service.
by nxzero 11y ago
If they had end-to-end encryption, then Google wouldn't be able to read the emails; meaning to gain value, Google would have to charge for the service.
- dorfsmay 11y agoGoogle does charge for email services, for anybody using gmail with their own domain, which is a lot of small companies and probably a few medium size one.
- nxzero 11y agoRight, though my guess is that doing custom domains and end-to-end encryption as a service are not comparable services or markets.
- dave2000 11y agoThey could mine for keywords on the client. They'd not need to store those against who you are sending the message to. It would be less intrusive than is the case now, but not as secure as then knowing nothing about what you're sending. Where would draft emails be stored in an end to end encrypted system? They'd need to store the information on their servers in a way that they can recover it for subsequent editing.
- sp332 11y agoHow is sending "keywords" back to a central server more secure than just mining them on the server?
- delroth 11y agoIt's not (only?) a question of "gaining value". End-to-end encryption is fundamentally incompatible with many features that Gmail users rely on. I would recommend reading https://moderncrypto.org/mail-archive/messaging/2014/000780.html https://moderncrypto.org/mail-archive/messaging/2014/000780.... from an ex Gmail anti-abuse tech lead. And for 99.99% of Gmail users, protecting automatically against untargeted phishing and malware attacks is a larger security improvement than having e2e encryption.
- ikeboy 11y ago>The third problem is that spam filters rely quite heavily on security through obscurity, because it works well. Hm.
- Zigurd 11y agoPermission-based email. It's an established solution. IM works this way because it doesn't have spam filters.
- macns 11y agoA quick google search on 'permission based email service' shows email lists- marketing related results, do you know any of such service provider? Maybe some day email will fade away giving its place to an IM, though I'm not sure it will always be spam-filter free.
- Zigurd 11y agoBoxbe is one that I have encountered people using: http://www.boxbe.com/help http://www.boxbe.com/help It's a little surprising this was never a standard part of email. It's the same workflow as granting permission to be contacted by IM. Based on a quick search, you are right that the phrase "permission based email" has been SEO'ed into uselessness by email marketing services. What should it be called? Screening? But the spam filtering services have almost SEO'ed that into uselessness.
- chflags 11y agoThe way they word these releases certainly makes it sound like they have users' best interests in mind. But honestly, as you have highlighted, these announcements should be insulting to users' intelligence. "Dear Users: Please allow us to store copies of all your sensitive data, including every email ever sent or received, in perpetuity. In return, to the extent the law permits us to do so, we'll let you know (_ex post facto_) when some other third party is having a look at it." The solution to the problem if indeed there is a problem here is not going to come from Google. The problem _is_ Google. The only parties who need a copy of an email are the sender and the recipient. If you really care about privacy, security, whatever, then "store and forward" and "POP" via some third party (Google, etc.) is not the proper way to implement email. Hypothesis: Google does not charge for Gmail because, quite simply, no one would pay.
- LeifCarrotson 11y ago> The only parties who need a copy of an email are the sender and the recipient. Emphasis on "need". Most recipients also like to have a third-party anti-spam service also have a copy of their email. Assuming the encryption costs are low enough, spammers and virus senders would like nothing better than to cripple anti-spam learning tools by having each recipient recieve a cryptographically unique opaque blob. This would force users to develop their own training corpus and react to new spam and virus outbreaks individually. You may argue that you could still use anti-spam locally, but it wouldn't be as good. While I wouldn't mind sending decrypted spam out to a server and getting updates to my local anti-spam program, no one would want to send legitimate mail, so the service would have no "ham" to train against. I suppose encryption could help in the fight against spam by requiring CPU time to encrypt the email. 10 seconds per email would be hard to notice for a real human responding to messages, but might make spam unprofitable.
- NoGravitas 11y agoI wonder if it would be good enough to use a public spam corpus built on volunteer contributions, while using only a private ham corpus.
- massemphasis 11y agoIt is just naive or dumb to think Google is left alone when they don't give access to the government. Of course they give access, but in the interest of being a vital source of intelligence and data they put on an act.
- 1123581321 11y agoI don't see why Gmail has to be all-or-nothing. I would like to see Google continue their free/cheap service as is, and offer a more expensive service with better security. I think Google would be able to greatly improve the interface for end-to-end encryption if they chose to. However, the company seems disinterested in cooperating less with law enforcement and spy agencies.
- thomasthomas 11y agoI would suspect this is because when 99% of users hear of an upgraded gmail service that costs money, they will start asking questions as to what's wrong with their current gmail service. They get so much synergy across products from users data it's probably not worth it to point out current gmail drawbacks to 100% of customers: even if x% switch to premium, 1-x are now aware of drawbacks of using google across all products and could unpredictably hurt top line rev.