5 ms·
Google stopped working on End-to-End at least a year ago: https://motherboard.vice.com/en_us/article/google-yahoo-end-to-end-email-encryption-work-in-progress
by mtgx 10y ago
Google stopped working on End-to-End at least a year ago:
https://motherboard.vice.com/en_us/article/google-yahoo-end-to-end-email-encryption-work-in-progress https://motherboard.vice.com/en_us/article/google-yahoo-end-...
And now they've "open sourced it" with minimal changes since then. Sounds to me like they stopped working on it, but they didn't want to keep getting asked by the tech media and crypto people about the project's status. So they went "Here, it's all yours now! You're welcome. Yes, we know how awesome we are."
But it doesn't look quite finished, so I wonder if anyone will bother to complete Google's half-assed job. Google didn't even bother to integrate it with Key Transparency before open sourcing it. That speaks volumes as well.
They've recently also released a centralized/hosted version of S/MIME for enterprise users as well, again showing their complete disinterest in continuing to support end-to-end crypto.
https://security.googleblog.com/2017/02/hosted-smime-by-google-provides.html https://security.googleblog.com/2017/02/hosted-smime-by-goog...
I'm guessing they stopped working on End-to-End around the time they started working on the hosted S/MIME. I wouldn't get my hopes up about Google supporting end-to-end crypto in the future. Now I'm starting to wonder if they'll also kill the feature in Allo, or just hide it some more in future releases, so that it becomes even harder to use.
- jamesgeck0 10y agoThat Motherboard article doesn't indicate that Google stopped working on the project, merely that progress is very slow.
- lclarkmichalek 10y agoE2E email is a bit of a lost cause, so probably better that they not waste their time.
- CaptSpify 10y agowhy do you say that?
- jasonvorhe 10y agoBecause it's the reality of things.
- CaptSpify 10y agoThat's not an answer
- whyever 10y agoIt is extremely hard to use compared to Signal or Whatsapp and has worse cryptographic properties.
- drdaeman 10y agoCounterexample to "hard to use" point: Protonmail. (Arguably, it's easier to use for some scenarios, compared to Signal or WhatsApp, because one doesn't need to have a reachable mobile phone number.) As for the crypto - I think, OpenPGP isn't broken or "worse", just has different properties (like lack of standardized PFS, which has both cons and pros). But, yes, protocol limitations for metadata security (e.g. subject lines) are an issue.
- baobrain 10y agoProblem with protonmail is that it is only end to end encrypted within their system...
- drdaeman 10y agoIt's not the only problem they have (there are a lot of important functionality missing or limited), but it's not related to "extremely hard to use" point, and it's all doable and isn't done because they have limited resources.
- CaptSpify 10y agoI highly disagree. Additionally, I'm not convinced Signal or Whatsapp in their current conditions viable replacements.
- bubblethink 10y agoChrome apps are themselves deprecated. This looks dead on arrival. Hosted S/MIME is entirely different. It's completely unrelated to their general E2E efforts. The enterprise S/MIME solution is mostly to sell security to enterprises, not privacy to individuals.
- quantumwannabe 10y agoDoes client side S/MIME (which is E2E) work in Gmail/Google Apps provided you have a client that supports it (e.g. Outlook)? If so, I'm not sure what the problem is with them not officially supporting it other than the awkwardness of dealing with certificates.
- zigzigzag 10y agoYes it does work.