4 ms·

I do not understand why for over a decade Google resists implementing end-to-end encryption in Gmail. For example, it would help with "man-in-the-middle" attac

I do not understand why for over a decade Google resists implementing end-to-end encryption in Gmail. For example, it would help with "man-in-the-middle" attacks they are citing as motivation from MTA-STS.

Waterluvian 8y ago
If they can't currently or in the future sniff out things about the content of your email, what's the point of gmail as a product?
LeonM 8y ago
Because there is no practical method to do so. Email was never designed to be end-to-end encrypted and implementing end-to-end encryption would mean that everybody must switch to an end-to-end encryption capable protocol. Google is not resisting, they would implement end-to-end if they could, but they can't. FWIW: As long as the email does not leave Google (i.e. an email between 2 gmail inboxes) it is actually already encrypted end-to-end (AFIAK).
- OrgNet 8y ago
  They could easily do it for communications between gmail users... they just don't want to do it. > FWIW: As long as the email does not leave Google (i.e. an email between 2 gmail inboxes) it is actually already encrypted end-to-end (AFIAK). no, end-to-end means from user1-to-user2, not from user1-to-gmail and then from gmail-to-user2 (ie: gmail should never be able to see the content of your communications if it was truly end-to-end)
sydli 8y ago
even with e2e email like pgp or s/mime, a lot of email metadata (even subject lines, commonly) gets leaked onto the wire. improving transport security prevents that.
elehack 8y ago
Simple, non-evil answer: because it would severely impede spam prevention. This extensive writeup has details: https://moderncrypto.org/mail-archive/messaging/2014/000780.html https://moderncrypto.org/mail-archive/messaging/2014/000780.... Long story short, to control spam, you basically have 2 options: 1. Control who can send messages 2. Inspect message content 3. Impose costs Signal and WhatsApp chose (1). E-mail (and probably any federated protocol) requires (2) or (3), and there is no universally-adopted (3) for e-mail.
- jakeogh 8y ago
  Their business model is to mine your mail. Spam censorship is just a feature that happens to fall out.
  - ac29 8y ago
    Google hasn't used email contents for ad targeting in a couple years: https://blog.google/products/gmail/g-suite-gains-traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/ https://blog.google/products/gmail/g-suite-gains-traction-in...
    - jakeogh 8y ago
      Just call it "sentiment analysis". Forgive me if I don't take their words at face value.

Waterluvian 8y ago

If they can't currently or in the future sniff out things about the content of your email, what's the point of gmail as a product?

LeonM 8y ago

Because there is no practical method to do so. Email was never designed to be end-to-end encrypted and implementing end-to-end encryption would mean that everybody must switch to an end-to-end encryption capable protocol. Google is not resisting, they would implement end-to-end if they could, but they can't. FWIW: As long as the email does not leave Google (i.e. an email between 2 gmail inboxes) it is actually already encrypted end-to-end (AFIAK).

OrgNet 8y ago
They could easily do it for communications between gmail users... they just don't want to do it. > FWIW: As long as the email does not leave Google (i.e. an email between 2 gmail inboxes) it is actually already encrypted end-to-end (AFIAK). no, end-to-end means from user1-to-user2, not from user1-to-gmail and then from gmail-to-user2 (ie: gmail should never be able to see the content of your communications if it was truly end-to-end)

sydli 8y ago

even with e2e email like pgp or s/mime, a lot of email metadata (even subject lines, commonly) gets leaked onto the wire. improving transport security prevents that.

elehack 8y ago

Simple, non-evil answer: because it would severely impede spam prevention. This extensive writeup has details: https://moderncrypto.org/mail-archive/messaging/2014/000780.html https://moderncrypto.org/mail-archive/messaging/2014/000780.... Long story short, to control spam, you basically have 2 options: 1. Control who can send messages 2. Inspect message content 3. Impose costs Signal and WhatsApp chose (1). E-mail (and probably any federated protocol) requires (2) or (3), and there is no universally-adopted (3) for e-mail.

jakeogh 8y ago
Their business model is to mine your mail. Spam censorship is just a feature that happens to fall out.
- ac29 8y ago
  Google hasn't used email contents for ad targeting in a couple years: https://blog.google/products/gmail/g-suite-gains-traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/ https://blog.google/products/gmail/g-suite-gains-traction-in...
  - jakeogh 8y ago
    Just call it "sentiment analysis". Forgive me if I don't take their words at face value.