14 ms·

Gmail confidential mode is not secure or private

356 points by rahuldottech 7y ago

dheera 7y ago
"Options for recipients to forward, copy, print, or download this email's contents will be disabled." I simply don't understand how they think they can get away with this foolishness. I can forward, copy, print, or download ANYTHING that passes over my ethernet cables. Your silly UI will ultimately never stop me from wiresharking my own cables in my own home and doing whatever the hell I want with any bits of information that enter my space. All it does is fool a bunch of less-tech-savvy people into a false sense of security.
- willbw 7y ago
  Exactly. Especially on a desktop operating system. On iOS at least you can have applications give notification over things like screenshotting i.e. Wickr, but if you are on desktop it's stupidly easy to retransmit or download the contents of an email. Maybe Gmail is just admitting that this is the reality (which it is).
- gruez 7y ago
  >Your silly UI will ultimately never stop me from wiresharking my own cables Or for the less technically inclined, opening the email on your phone/tablet and put it in a photocopier.
  - Shebanator 7y ago
    Sure, but that is equally true for products like protonmail that use end-to-end encryption and for those that don't do any encryption at all.
    - mulmen 7y ago
      e2e encryption solves a totally different problem. If you don't trust the intended recipient of a message don't send it. e2e helps make sure nobody else receives the message. Google is making an entirely different claim about controlling the actions of a third party. It's fundamentally impossible to do what Google is claiming.
      - pwodhouse 7y ago
        What is Google claiming that you think is impossible?
        mulmen 7y ago
        That the recipient can't "forward, copy, download, or print" the message and that the message expiration will prevent the recipient from viewing the message.
        anyfoo 7y ago
        From what you have pasted, it seems that they just claim to disable those options in their UI?
        deleted 7y ago
        [deleted]
  - paulcole 7y ago
    Won't the light from the copier reflect off the screen and ruin the image? When I was in college (early 2000s) a local company sold notes/study guides for different courses. But they were printed in black text on dark green paper to prevent photocopying and sharing. Good idea on their part but I used my digital camera to take photos of the pages and cranked up the details to make them look like blackish text on whiteish paper. Ended up selling them to all my friends.
    - dheera 7y ago
      So open the e-mail on a Kindle, or put an antiglare screen in front of your phone, or just take a picture of one phone with another phone if the screenshot button doesn't work. I do remember some app not "letting" me screenshot something with stock Android, which I felt to be a violation of my freedom. Obviously in my case just use a modified Android ROM without the silly anti-screenshotting logic, or screenshot it with adb over USB, but for the less-technically inclined, take a picture of the phone.
      - TeMPOraL 7y ago
        > I do remember some app not "letting" me screenshot something with stock Android, which I felt to be a violation of my freedom. Bank apps tend to do that. When I first hit this issue, it also felt like a violation of my freedom, and it was also very annoying because I badly needed to make that screenshot.
        UnFleshedOne 7y ago
        I think bank apps do this less to stop you from making screenshots, and more to stop that new Candy Clash app you just installed from making that screenshot.
        anoncake 7y ago
        That's what sandboxing is for.
- a254613e 7y ago
  Why is it hard to understand? Because your average user will not "wireshark their own cables", and those who do will use different methods of secure communication. You'd be surprised how many users are unable to bypass various extremely simple restrictions - and this is the target market for these features. On top of that self deleting email will make it also a bit harder to prove that the screenshot is real - unless you get a court order to get the senders outbox folder from google and the data still exists there.
  - consp 7y ago
    > On top of that self deleting email will make it also a bit harder to prove that the screenshot is real Except it isn't deleted from your send folder.
    - zerkten 7y ago
      How do you know this? Enterprises have archival/deletion policies automatically applied and emails you forward to outside parties are often tracked in legal hold platforms. It's not unusual for whole sales organizations in particular industries have all emails archived under legal hold requirements (whether sent or received.) Another set of organizations will purge all of the same email older than than a certain date. None of these measures are particularly hard to defeat for a bright user, but many of the risks at the company-level are mitigated. This is mostly to solve challenges with regulation or company certification, but it can make a real difference when someone is handling a privacy incident.
- derefr 7y ago
  Consider for a moment: a company or school set up as an Enterprise Mobile Device Management provider, handing everyone out ChromeOS devices, setting up their GSuite domain so that nobody can connect to their GSuite GMail accounts except through the ChromeOS device (or an equivalent MDMed mobile device), and setting up an automatic, un-disable-able VPN on those devices for accessing Google domains. I think that’s the scenario Google had in mind when designing this feature. For enterprise users, where the enterprise controls the hardware, the policy-level controls actually have teeth, because people don’t have root over the devices in their possession. For everyone else, it’s not “real security”, but rather just a gateway drug to get you used to the workflow that “real security” would provide in an enterprise context. (Context: I used to work at IBM, and they had a very similar setup—company issued laptop, app that enforces MDM profile installation, VPN that checks with the app to ensure MDM is active before connecting, email servers only accessibly through said VPN, and, on top of all that, a policy-enforcing email app [IBM Notes] where you can delete already-sent things out of other enterprise-users’ inboxes, send expiring emails, etc.)
  - lawfulcactus 7y ago
    It's worth mentioning that all these measures can be fairly trivially defeated by the analog loophole[1]. I suppose it's harder to prove authenticity in that case, however. https://en.wikipedia.org/wiki/Analog_loophole https://en.wikipedia.org/wiki/Analog_loophole
    - afandian 7y ago
      Allow me to sell your organisation some VR goggles with iris-reading DRM protection. Your browser won't display on any other screen. And Google Services won't work in any other browser.
      - deleted 7y ago
        [deleted]
      - rndgermandude 7y ago
        I can still remember the message (or at least important bits) and can write it down when at home or tell it to other people.
- devrand 7y ago
  All DLP products are like this. They impose basic limitations that can easily be bypassed by anyone remotely technically inclined. I've come to the conclusion that these products are just to cover the low-hanging fruit situations of someone accidentally doing something that they shouldn't have. In other words, it's a UI integrated "DO NOT FORWARD" message from an e-mail.
  - mc32 7y ago
    I think this is correct. This is to help management say that if if there is a policy and it’s violated that it can’t have been accidental because extra conscious steps have to be taken which violate policy. Making it easier to make people adhere to policy (and discipline as well).
- michaelmior 7y ago
  I'm surprised no one has come up with a browser extension yet that circumvents this. I'm guessing it would be fairly trivial to do so.
  - kybernetikos 7y ago
    I'd be surprised if the built in print to pdf function doesn't already circumvent this.
    - anjsimmo 7y ago
      Google (ab)uses the @media print CSS rule to hide the message content and replace it with "Printing is not allowed by the sender of this message." However, I've found you can print confidential emails if you comment-out/disable all the @media print rules using Firefox developer tools: https://grokprivacy.org/2018/06/24/archiving-self-destructing-gmail-with-firefox/ https://grokprivacy.org/2018/06/24/archiving-self-destructin...
  - rndgermandude 7y ago
    There is honestly no actual demand for something like that, I'd guess. Screenshots are easy, and your OS usually comes with a built-in tool. And how to use that tool (or find a tool) is a matter of typing "how do I screenshot on X" into google. And if even this is still too "technical" for a user, I have seen people take literal shots of their screens, with their phone camera or whatever.
    - michaelmior 7y ago
      Sure, but screenshots don't give you text. Sure you can re-type or use some OCR tool after the fact, but it's one extra step.
- jayd16 7y ago
  People still this Snapchat is secure. Frustratingly, you're not going to win this battle.
- sigmar 7y ago
  >Note: Although confidential mode helps prevent the recipients from accidentally sharing your email, it doesn't prevent recipients from taking screenshots or photos of your messages or attachments. Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. If you click the "learn more" in gmail it says that ^. Gmail seems pretty upfront about what "confidentiality mode" does.
  - TeMPOraL 7y ago
    > Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. I guess me exercising my right to do whatever I want with my bits on my computer is me having "malicious programs". What in the actual fsck.
    - reroute1 7y ago
      It's not saying exercising your rights is having malicious programs, they are not mutually exclusive and they didn't make that claim.
      - a1369209993 7y ago
        Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. Recipients who do not have malicious programs on their computer also may still be able to copy or download your messages or attachments.
        sigmar 7y ago
        It is using "malicious" to mean "intending to circumvent your intention to keep this email confidential." Is there a different word that could be substituted to maintain that meaning?
        a1369209993 7y ago
- FDSGSG 7y ago
  >All it does is fool a bunch of less-tech-savvy people into a false sense of security. Nonsense, it does a great job of discouraging people from forwarding, copying, printing or downloading the emails contents. Sure, it'll do nothing with a malicious recipient but incompetent recipients are vastly more common than malicious recipients.
  - hitpointdrew 7y ago
    You have to be a special kind of stupid to not be able to get around this "security".
    - FDSGSG 7y ago
      Who cares? This isn't supposed to stop anyone from intentionally doing bad things, this is supposed to make people stop and think "Huh, maybe I'm just not supposed to forward this email" It's really bizarre that so many people on HN can't seem to understand this. Do you guys ever interact with other human beings?
      - veidr 7y ago
        That's an outlandish take, because it's entirely divorced from what Google is claiming. If they were saying, "this feature makes it clear to your employees that they shouldn't forward this email" then this entire HN thread would not exist.
        tdb7893 7y ago
        This article is put out by a competitor. Also a significant portion of people on HN really don't like big tech companies (which is fair but besides the point here) so I would've been more surprised if there was nuances conversation about it here.
    - erichurkman 7y ago
      I think of it less as stopping people from 'getting around' the 'security' and more an extra level of protection & awareness against accidental forwards or replies. It can't stop malicious actors, of course.
- brokenkebab 7y ago
  No foolishness. Such features intended to enhance handling of sensitive data when users' laziness, or lack of understanding is the problem - and it works well in this way. Malicious recipient can do anything, of course, but usually you don't send your secrets to people you don't trust at all.
- sowbug 7y ago
  Dude, come on. You do understand. The feature is like a fence in a yard. It separates the honest from the dishonest, forcing the clueless/negligent/reckless to pick a side. Nobody believes fences stop criminals, and nobody believes Gmail has ended the DRM arms race.
  - kryogen1c 7y ago
    > Nobody believes fences stop criminals I agree with the thrust of your comment, but this isnt true. Measures like this do prevent some crime. When i didnt lock my car and someone stole the gift cards out of it, locking the doors would have prevented it. Just because the car is still stealable doesnt mean door locks are security theater. Putting an unlocked package cabinet for deliveries on your porch lowers incidences of theft without making it impossible.
  - reaperducer 7y ago
    Nobody believes fences stop criminals Then why is every military base surrounded by a fence?
  - dang 7y ago
    Can you please edit out personal swipes from your HN comments? This post would be just fine without the first two bits. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - sowbug 7y ago
      Thanks for the reminder, dang. You're right.
- tzs 7y ago
  > Your silly UI will ultimately never stop me from wiresharking my own cables in my own home and doing whatever the hell I want with any bits of information that enter my space. Their silly UI won't, but what about HTTPS? Won't wiresharking your own cables only get you the ciphertext from the HTTPS session which would be useless to you without the ephemeral key?
  - Avamander 7y ago
    TLS MITM proxies are still doable with your own CA
- hirsin 7y ago
  It's not the point. Most "information theft" is people not realizing that they shouldn't share the information. If someone is dedicated enough to exfiltrate information they'll just take a picture of the screen. But now it's really clear that that's what they're doing. Source - same discussion years ago at Microsoft when Windows introduced this at an OS level to prevent screenshots of confidential mail.
- Avamander 7y ago
  You overestimate the average user :/
- la_barba 7y ago
  Well you can't claim anything as "secure" either because someone somewhere has a 0-day. It just depends on where you draw the line, and for what application you're using it.
- anjsimmo 7y ago
  All that's needed is to disable a few browser options https://boingboing.net/2018/07/22/adversarial-interop.html https://boingboing.net/2018/07/22/adversarial-interop.html I actually tried the "wiresharking my own cables" approach, but because it's encrypted, you also need to dump the ephemeral encryption keys. There's a simple guide on how to do this here: https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/ https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...
CraftThatBlock 7y ago
In other news, water is wet. More at 11
- OrgNet 7y ago
  most users don't know about this feature and more importantly don't know that Google is lying... so more publicity is better.
cmsimike 7y ago
Gmail has no incentive to create anything secure or private because that would prevent them from going through your email to show ads. [This is wrong] Update! Gmail changed this behavior a while ago. Went under my radar: https://variety.com/2017/digital/news/google-gmail-ads-emails-1202477321/ https://variety.com/2017/digital/news/google-gmail-ads-email... Thanks!
- lloydde 7y ago
  “We will not scan or read your Gmail messages to show you ads.” https://support.google.com/mail/answer/6603?hl=en https://support.google.com/mail/answer/6603?hl=en
  - cmsimike 7y ago
    You're absolutely right. Turns out they changed this behavior in 2017. Thanks for making me look into it.
    - lloydde 7y ago
      You’re welcome. I found it fascinating at the time of the change, and still do, that email is sacred, but all other activity is open for manipation-based-advertising.
      - wibble10 7y ago
        If they don’t scrape your email how is this page generated then? https://myaccount.google.com/purchases https://myaccount.google.com/purchases
        franzunix 7y ago
        good question
        jvolkman 7y ago
        Nobody said the emails aren't scanned; they're just not used as context for ads. Obviously they're scanned, otherwise spam filtering wouldn't be possible.
AndrewKemendo 7y ago
I'm always curious how the Project Managers working on these projects think about posts like these. It's a very public call-out, effectively saying "this product is not what they say it is and is dangerous." Especially when it's obviously true, I'd be curious if anyone here can speak to the mental state of someone on the receiving end. For example I was publicly put on blast for something that was false about me. So in that case I just blew it off because it was wrong, and no reaction was really necessary. It was still very stressful though personally and for my family. I wonder how these product teams across Google and FB primarily feel in these cases.
- Spooky23 7y ago
  They probably eye-roll the deliberate misinterpretation of the feature by a competitor. Particular ironic given that that company's marketing schtick is that the first listed security feature is "We are incorporated in Switzerland" Outlook has had the same feature for 20 years.
- ben509 7y ago
  They don't handle it well. I worked on a service that had some severe technical constraints at a prior job. (Basically, we were hosting a vendor's network device to the cloud, and it really wasn't designed for it, and it also wasn't a really great device.) We had one customer that loved to blog about us. The customer wasn't being all that unreasonable (from their perspective) and the higher-ups knew about the constraints we were operating under, but they still panicked every time a blog came out about us. More broadly, I think if you talk to any journo in the trade press, some companies can be incredibly thin-skinned about any percieved negative press, and threats and intimidation are very common for percieved slights. And the trade press typically rolls over because those companies are their advertisers. It's why you typically see so many puff pieces, how-tos and PR reprints rather than actual journalism.
mfer 7y ago
I like posts being out there like this. I expect many non-technical users will get the wrong impression about confidential mode. Impression is different from the stated words and can be filled in by our subconscious thoughts about the space between what is said. When words are explicitly said it can cause people to think things through.
- dwighttk 7y ago
  heh... my subconscious was sure there was a "from this article" at the end of your second sentence and had to reread it a couple of times to figure out what you were saying...
- 1001101 7y ago
  I find that false promises of security are worse than none at all.
- lorenzobr 7y ago
  Except that most non-technical users will never read ProtonMail blog.
lern_too_spel 7y ago
This is a feature that Outlook already has and corporate users expect. It's for making forwarding sensitive emails or any of their content require intent instead of being accidental.
- dheera 7y ago
  If "accidental" is the true worry, display a confirmation/warning box before forwarding. There are valid reasons to need to forward even e-mails marked confidential, including lawsuits, harassment cases, or even just asking your own lawyer before signing an agreement, among others. Deciding when a piece of information should not have been forwarded is the job of the workplace or law, not the e-mail client.
  - lern_too_spel 7y ago
    > If "accidental" is the true worry, display a confirmation/warning box before forwarding. Gmail supports other MUAs using IMAP and POP, so that doesn't work. The fact that there are valid reasons to forward sensitive emails is why there is an escape hatch. It's only the accidental forwards and copies that this is meant to stop.
    - dheera 7y ago
      We can invent a new e-mail header X-Confidential: true, and clients will start to adopt the warning behavior over time. If Gmail supports it off the bat it will already cover a huge fraction of the market.
      - lern_too_spel 7y ago
        That's a strictly worse solution to the problem with no advantages.
      - UncleMeat 7y ago
        Or we can build a system that just works and doesn't rely on adoption by other clients. Yes if we had a header that everybody used and respected it would work. But that's a lot harder.
craftyguy 7y ago
This 'article' is a Proton Mail spam piece.
lern_too_spel 7y ago
All of this is clearly explained in the setting to enable the mode for a domain. It's for making forwarding sensitive emails or any of their content require intent instead of being accidental, and people who are used to Exchange/Outlook already understand this feature. Domain administrators still need to keep copies for legal compliance.
tantalor 7y ago
> This is not an expiring email. It can still be accessed by Google and potentially exposed to governments or hackers. This "expiration" could protect the receiver from subpoena/discovery ("Sorry I don't have it anymore") but it sounds like the sender is still liable to produce the original message on demand.
ijpoijpoihpiuoh 7y ago
Modes like this are not intended to provide hard security. They are not designed to deal with malicious recipients. Rather, they're intended to provide a barrier to accidental or unthinking dissemination of confidential content. It is also designed to prevent permanent retention and the ongoing risk that represents. It solves or limits the fallout from the "silly friend" and "new enemy" problems. There is no way to convey information to a malicious human s.t. that human cannot convey it onwards to unwanted recipients. The best you can do is provide strong disincentives. Some options for doing this: make sure that your recipients generally don't want to hurt you. Make them fear you (even that doesn't always work, see [1]). [1]: https://en.wikipedia.org/wiki/Reality_Winner https://en.wikipedia.org/wiki/Reality_Winner
gyaniv 7y ago
Yes, Google isn't untrustworthy and doesn't care about the users privacy, we knew that, but the general public that isn't as aware (at this point it's hard to be completely unaware) also doesn't read this private company blog, so it doesn't really help much (except advertise the company). We should be thinking of ways to improve the situation for everyone (not saying I have the solution), but personally (and unfortunately) I don't think this would have any impact.
- mda 7y ago
  I would trust Google and Gmail way more than protonmail and whatever company behind it for protecting my private data to be honest.
  - oarsinsync 7y ago
    I understand the perspective and opinion, but I like to think about incentives and consequences. What's Google's incentive to protect your privacy, and what are the consequences if they fail to? Compared to a firm that is marketing services on the proposition of privacy being at the core, the risks to Google's business, reputation and finances are likely minimal. Whereas, if one of the firms that markets providing services focused on your privacy is found to be intentionally and wilfully violating that, it ceases to be a violation of trust and becomes a violation of contract, false advertising... essentially fraud, and the consequences of deliberately misleading and defrauding customers is more significant than an accidental (or wilful) privacy breach by a corporation that openly markets itself as not respecting its users privacy.
  - notyourloops 7y ago
    Why trust either of them?
  - okmokmz 7y ago
    You'd trust a company thats primary business model is based on the mass collection, analysis, and monetization of user data to protect your private data? Not saying I trust proton mail, but as far as I'm concerned Google is a malicious actor when it comes to my data same as Facebook, and I believe it's in individuals's best interest to limit their exposure
dewey 7y ago
> It can still be accessed by Google and potentially exposed to governments or hackers. The article makes the classic mistake of assuming everyone has the full security apparatus of a country after them. This feature is obviously not built as an alternative to Signal or for the Snowdens of this world. These probably know better than using unencrypted email already. For the average user it's an improvement of the current status.
- ilikehurdles 7y ago
  It's an article posted by protonmail, an email service that would be used by the Snowdens of this world. I think it's just a nice way for them to further get their company name out.
- mulmen 7y ago
  So you reference Snowden then pretend dragnet surveillance doesn't exist? If you are on the internet the NSA is spying on you and everyone else. This is not an improvement because it makes guarantees that simply aren't true. These compromises are made to further Google's bottom line, not protect users. Don't pretend this is some kind of incremental improvement. It's a marketing gimmick.
  - dewey 7y ago
    > If you are on the internet the NSA is spying on you and everyone else. There's a difference between passively collecting and actively targeting.
    - crazypyro 7y ago
      Right, but the switch is flipped from passive collection to active targeting in secret court hearings* and if they already have been passively collecting, you could go from no concern to being actively targeted without ever knowing. They couldn't do this if they weren't drag-netting. *FISA courts have 11 denied requests and over 34,000 approved.
      - 7y ago
cfmcdonald 7y ago
The point of confidential mode is for corporate users. When the CEO sends out that confidential mail to the company, it adds a speed bump to users who are about to copy out data that they have been told they should not, so they get a chance to realize they should not do this, and then removes all plausible deniability when they choose to bypass that speed bump.
- notimetorelax 7y ago
  Agree to that, it’s a pretty strong signal stating possible appropriate uses. If I receive an encrypted MS Office document with Do Not Forward policy, I know that if I want to share it further I need to ask the permission from the sender.
- privateSFacct 7y ago
  Actually, in many corporate cases BOTH parties want to keep the info confidential - the CEO sends over salary details to CFO to load into payroll system. After it's all loaded and printed for the files (or saved in the HR system), they BOTH want it to auto-expire out of their emails, but both are too busy to scrape back through old emails after a month to delete things. So this confidential mode let's this happen naturally. When the CFO's email is hacked (which it will be eventually at some company) then all is not lost. I'm sure many other users will find it useful.
  - mulmen 7y ago
    So confidential mode is a cumbersome retention mechanism? A simple email rule can do this for all messages.
    - privateSFacct 7y ago
      Some messages are MUCH more sensitive than others. You might have a default 3-5 year rule (many corps do). That’s way too long for some messages. especially if sending across an ou boundary where you don’t know the retention treatment this will be great. Sales teams can be very sloppy w email -> auto import into CRMs, sharing permissions, delegating permissions, running their own optimization apps etc. Because the want to claim credits for sales they don’t like tight retention limits etc
weliveindetail 7y ago
Jeopardy: An email option that encourages people to add OTHER people's phone numbers to Google's database.
mulmen 7y ago
"When we launched ProtonMail nearly five years ago, we pioneered a new kind of email service: one that gives you control of our own data." This is a very unfortunate typo.
bo1024 7y ago
Nor is it email!
kabwj 7y ago
Does Gmail give away your data to the Swiss government, though?
- silversconfused 7y ago
  Yes, and without a warrant too.
hitpointdrew 7y ago
Article makes good points. But clearly they are promoting their own product, over Gmail, and compete directly with them. One thing I find troubling is that they seem to be making their own false claim. >Because we do not have access to the recipient’s private key, we are never able to read the message. We do have access to metadata, like the email addresses, timestamp, and subject line. I am not sure how proton could send messages to anyone if they didn't know the recipients address! EDIT: I'm stupid, please disregard this. They clearly state that the DO have access to metadata (for some reason my head read it as DO NOT).
- kdmccormick 7y ago
  I don't see where they claim they don't know the recipient's address.
  - deleted 7y ago
    [deleted]
  - hitpointdrew 7y ago
    I'm an idiot. I miss read the sentence.
- sylvanaar 7y ago
  It literally says that they have access to the email address in what you quoted.
david927 7y ago
Gmail confidential mode is not secure nor private
ddingus 7y ago
This makes as much sense as the Outlook recall feature did. User Bob would like to recall email titled, "that sex party last night" Riiiight
- ben509 7y ago
  Recalls make a lot of sense if mass announcements are sent with mistakes, so people aren't confused by having the incorrect version in a busy inbox.
  - ddingus 7y ago
    Yes, exactly. For benign purposes, some sense is seen. Otherwise, the whole idea is silly.
bombtracks666 7y ago
This article (https://choosetoencrypt.com/news/gmails-new-confidential-mode-is-not-confidential/ https://choosetoencrypt.com/news/gmails-new-confidential-mod...) pointed that out in October 2018.
deleted 7y ago
[deleted]
rolltiide 7y ago
All of this applies to making a new protonmail account too Requires SMS verification or an impassable captcha loop if over TOR And payment with a credit card The cryptocurrency payment option with non-user identifiable info only being available to existing protonmail accounts where that info was already harvested So it is ironic to see protonmail calling out those specific things about gmail confidential
- slips 7y ago
  Protonmail does those thongs to try and prevent bad actors or bots from making encrypted accounts to hide their shady tracks. Not for data collection that they'll sell for a profit. Don't be so glib as to state you can't see the difference.
  - rolltiide 7y ago
    From their home page: > Secure Your Communications with ProtonMail > Anonymous Email > No personal information is required to create your secure email account. requires personal information to create the secure email account "Protonmail does those thongs to try and prevent bad actors or bots from making encrypted accounts to hide their shady tracks." oh okay, pack it up everyone, don't listen to glib ole me coming to a rational conclusion its IRONIC that I have to trust them as much as I have to trust Gmail confidential's claims about what they may actually do with the data collection. or what they may be coerced to do with the data collection. "Swiss law" doesn't prevent that.
  - privateSFacct 7y ago
    The point is they flat out lie in this article about requiring it.
- MYEUHD 7y ago
  solving a ReCAPTCHA ( a google product that fingerprints users) is required to create an account even when not using TOR.
  - rolltiide 7y ago
silversconfused 7y ago
This makes all the pointy hair bosses out there demanding faxes and hardcopies seem wise. Imagine, getting an email that tried to block forwarding... the nerve.
dboreham 7y ago
I first had this argument (obviously I was on the sane side of the argument) in 1994. Amusing to see it persist for 25 years and to even permeate Google.
paul7986 7y ago
Google knows more about you then your mom! Sorry and personally that’s too much for me!
m3kw9 7y ago
Google and privacy in the same sentence, no one would bet their house on it if they were to choose
- idlewords 7y ago
  Google is very good at protecting data from unauthorized access. Many of the people who work there see themselves, with justification, as the guardians of privacy in that narrow sense.
idlewords 7y ago
Email in general is not secure or private. It bugs me to see ProtonMail making claims like 'end-to-end encryption' about a webmail service.
privateSFacct 7y ago
Wow, marketing spam from a competitor. We send confidential docs regularly to users, who need access to those docs for perhaps 1 week at most. No one wants / needs to keep these around, but no one goes through their email carefully to delete these items. If that users email was hacked -> they have a big problem. If we can mark the items for a 3 week retention and then expire those items for them, that great - and this lets us do that. The whole I can wireshark my network -> 99.9% of the confidential info we send goes to other folks who ALSO want to keep it confidential. Getting rid of stuff you no longer need to maintain is a key way of helping avoid big document dumps. The proof is in the pudding. Either this will help google sell to business (it will in our case in a big way). Or folks will say it is a stupid feature and decide idiots like Protonmail who can't seem to understand the point of these features now deserve our business. My confidence in a place like protonmail goes down based on this, and I'd love to get a feel for their security history and overpromises (ie, webmail client has got to easily be able to log and hack encryption etc).
- joosters 7y ago
  There's no need to call Protonmail idiots in order to put across your views on the subject, keep it civil. Plus, it makes your argument look weak if you have to resort to name-calling.
  - privateSFacct 7y ago
    Let me be super clear than. "Gmail confidential mode is little more than a marketing strategy." FALSE - This type of approach has real and direct security benefits. The fact that proton can't see understand that makes them idiots. "Gmail’s confidential mode is little more than a marketing trick designed to pacify users concerned about privacy." FALSE - Many business users using google are less concerned about privacy than they are about SECURITY. In the business context, most privacy is already given up, your employer can go through your emails. They can vault them up, do e-discovery on them etc etc. These aren't folks fighting off nation states. These are folks who someone in the office WILL click the bogus link and have their account taken over - and the business wants to reduce the blast radius. Saying this is a marketing "trick" is silly and the fact that proton can't see that makes them idiots.
cotelletta 7y ago
Protonmail's Android app still doesn't do threads. Posting this just to embarrass them into fixing it.
threwawasy1228 7y ago
Protonmail is a fantastic service, I switched to an account with them in the last few years and have not logged into my gmail since. Can't say enough good things about their offerings. I'm glad to see them making arguments like these in public to out their competitors practices.
- slenk 7y ago
  You mean creating blog spam that misses the point?

356 points by rahuldottech 7y ago

"Options for recipients to forward, copy, print, or download this email's contents will be disabled." I simply don't understand how they think they can get away with this foolishness. I can forward, copy, print, or download ANYTHING that passes over my ethernet cables. Your silly UI will ultimately never stop me from wiresharking my own cables in my own home and doing whatever the hell I want with any bits of information that enter my space. All it does is fool a bunch of less-tech-savvy people into a false sense of security.

willbw 7y ago
Exactly. Especially on a desktop operating system. On iOS at least you can have applications give notification over things like screenshotting i.e. Wickr, but if you are on desktop it's stupidly easy to retransmit or download the contents of an email. Maybe Gmail is just admitting that this is the reality (which it is).
gruez 7y ago
>Your silly UI will ultimately never stop me from wiresharking my own cables Or for the less technically inclined, opening the email on your phone/tablet and put it in a photocopier.
- Shebanator 7y ago
  Sure, but that is equally true for products like protonmail that use end-to-end encryption and for those that don't do any encryption at all.
  - mulmen 7y ago
    e2e encryption solves a totally different problem. If you don't trust the intended recipient of a message don't send it. e2e helps make sure nobody else receives the message. Google is making an entirely different claim about controlling the actions of a third party. It's fundamentally impossible to do what Google is claiming.
    - pwodhouse 7y ago
      What is Google claiming that you think is impossible?
      - mulmen 7y ago
        That the recipient can't "forward, copy, download, or print" the message and that the message expiration will prevent the recipient from viewing the message.
        anyfoo 7y ago
        From what you have pasted, it seems that they just claim to disable those options in their UI?
        deleted 7y ago
        [deleted]
- paulcole 7y ago
  Won't the light from the copier reflect off the screen and ruin the image? When I was in college (early 2000s) a local company sold notes/study guides for different courses. But they were printed in black text on dark green paper to prevent photocopying and sharing. Good idea on their part but I used my digital camera to take photos of the pages and cranked up the details to make them look like blackish text on whiteish paper. Ended up selling them to all my friends.
  - dheera 7y ago
    So open the e-mail on a Kindle, or put an antiglare screen in front of your phone, or just take a picture of one phone with another phone if the screenshot button doesn't work. I do remember some app not "letting" me screenshot something with stock Android, which I felt to be a violation of my freedom. Obviously in my case just use a modified Android ROM without the silly anti-screenshotting logic, or screenshot it with adb over USB, but for the less-technically inclined, take a picture of the phone.
    - TeMPOraL 7y ago
      > I do remember some app not "letting" me screenshot something with stock Android, which I felt to be a violation of my freedom. Bank apps tend to do that. When I first hit this issue, it also felt like a violation of my freedom, and it was also very annoying because I badly needed to make that screenshot.
      - UnFleshedOne 7y ago
        I think bank apps do this less to stop you from making screenshots, and more to stop that new Candy Clash app you just installed from making that screenshot.
        anoncake 7y ago
        That's what sandboxing is for.
a254613e 7y ago
Why is it hard to understand? Because your average user will not "wireshark their own cables", and those who do will use different methods of secure communication. You'd be surprised how many users are unable to bypass various extremely simple restrictions - and this is the target market for these features. On top of that self deleting email will make it also a bit harder to prove that the screenshot is real - unless you get a court order to get the senders outbox folder from google and the data still exists there.
- consp 7y ago
  > On top of that self deleting email will make it also a bit harder to prove that the screenshot is real Except it isn't deleted from your send folder.
  - zerkten 7y ago
    How do you know this? Enterprises have archival/deletion policies automatically applied and emails you forward to outside parties are often tracked in legal hold platforms. It's not unusual for whole sales organizations in particular industries have all emails archived under legal hold requirements (whether sent or received.) Another set of organizations will purge all of the same email older than than a certain date. None of these measures are particularly hard to defeat for a bright user, but many of the risks at the company-level are mitigated. This is mostly to solve challenges with regulation or company certification, but it can make a real difference when someone is handling a privacy incident.
derefr 7y ago
Consider for a moment: a company or school set up as an Enterprise Mobile Device Management provider, handing everyone out ChromeOS devices, setting up their GSuite domain so that nobody can connect to their GSuite GMail accounts except through the ChromeOS device (or an equivalent MDMed mobile device), and setting up an automatic, un-disable-able VPN on those devices for accessing Google domains. I think that’s the scenario Google had in mind when designing this feature. For enterprise users, where the enterprise controls the hardware, the policy-level controls actually have teeth, because people don’t have root over the devices in their possession. For everyone else, it’s not “real security”, but rather just a gateway drug to get you used to the workflow that “real security” would provide in an enterprise context. (Context: I used to work at IBM, and they had a very similar setup—company issued laptop, app that enforces MDM profile installation, VPN that checks with the app to ensure MDM is active before connecting, email servers only accessibly through said VPN, and, on top of all that, a policy-enforcing email app [IBM Notes] where you can delete already-sent things out of other enterprise-users’ inboxes, send expiring emails, etc.)
- lawfulcactus 7y ago
  It's worth mentioning that all these measures can be fairly trivially defeated by the analog loophole[1]. I suppose it's harder to prove authenticity in that case, however. https://en.wikipedia.org/wiki/Analog_loophole https://en.wikipedia.org/wiki/Analog_loophole
  - afandian 7y ago
    Allow me to sell your organisation some VR goggles with iris-reading DRM protection. Your browser won't display on any other screen. And Google Services won't work in any other browser.
    - deleted 7y ago
      [deleted]
    - rndgermandude 7y ago
      I can still remember the message (or at least important bits) and can write it down when at home or tell it to other people.
devrand 7y ago
All DLP products are like this. They impose basic limitations that can easily be bypassed by anyone remotely technically inclined. I've come to the conclusion that these products are just to cover the low-hanging fruit situations of someone accidentally doing something that they shouldn't have. In other words, it's a UI integrated "DO NOT FORWARD" message from an e-mail.
- mc32 7y ago
  I think this is correct. This is to help management say that if if there is a policy and it’s violated that it can’t have been accidental because extra conscious steps have to be taken which violate policy. Making it easier to make people adhere to policy (and discipline as well).
michaelmior 7y ago
I'm surprised no one has come up with a browser extension yet that circumvents this. I'm guessing it would be fairly trivial to do so.
- kybernetikos 7y ago
  I'd be surprised if the built in print to pdf function doesn't already circumvent this.
  - anjsimmo 7y ago
    Google (ab)uses the @media print CSS rule to hide the message content and replace it with "Printing is not allowed by the sender of this message." However, I've found you can print confidential emails if you comment-out/disable all the @media print rules using Firefox developer tools: https://grokprivacy.org/2018/06/24/archiving-self-destructing-gmail-with-firefox/ https://grokprivacy.org/2018/06/24/archiving-self-destructin...
- rndgermandude 7y ago
  There is honestly no actual demand for something like that, I'd guess. Screenshots are easy, and your OS usually comes with a built-in tool. And how to use that tool (or find a tool) is a matter of typing "how do I screenshot on X" into google. And if even this is still too "technical" for a user, I have seen people take literal shots of their screens, with their phone camera or whatever.
  - michaelmior 7y ago
    Sure, but screenshots don't give you text. Sure you can re-type or use some OCR tool after the fact, but it's one extra step.
jayd16 7y ago
People still this Snapchat is secure. Frustratingly, you're not going to win this battle.
sigmar 7y ago
>Note: Although confidential mode helps prevent the recipients from accidentally sharing your email, it doesn't prevent recipients from taking screenshots or photos of your messages or attachments. Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. If you click the "learn more" in gmail it says that ^. Gmail seems pretty upfront about what "confidentiality mode" does.
- TeMPOraL 7y ago
  > Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. I guess me exercising my right to do whatever I want with my bits on my computer is me having "malicious programs". What in the actual fsck.
  - reroute1 7y ago
    It's not saying exercising your rights is having malicious programs, they are not mutually exclusive and they didn't make that claim.
    - a1369209993 7y ago
      Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. Recipients who do not have malicious programs on their computer also may still be able to copy or download your messages or attachments.
      - sigmar 7y ago
        It is using "malicious" to mean "intending to circumvent your intention to keep this email confidential." Is there a different word that could be substituted to maintain that meaning?
        a1369209993 7y ago
FDSGSG 7y ago
>All it does is fool a bunch of less-tech-savvy people into a false sense of security. Nonsense, it does a great job of discouraging people from forwarding, copying, printing or downloading the emails contents. Sure, it'll do nothing with a malicious recipient but incompetent recipients are vastly more common than malicious recipients.
- hitpointdrew 7y ago
  You have to be a special kind of stupid to not be able to get around this "security".
  - FDSGSG 7y ago
    Who cares? This isn't supposed to stop anyone from intentionally doing bad things, this is supposed to make people stop and think "Huh, maybe I'm just not supposed to forward this email" It's really bizarre that so many people on HN can't seem to understand this. Do you guys ever interact with other human beings?
    - veidr 7y ago
      That's an outlandish take, because it's entirely divorced from what Google is claiming. If they were saying, "this feature makes it clear to your employees that they shouldn't forward this email" then this entire HN thread would not exist.
      - tdb7893 7y ago
        This article is put out by a competitor. Also a significant portion of people on HN really don't like big tech companies (which is fair but besides the point here) so I would've been more surprised if there was nuances conversation about it here.
  - erichurkman 7y ago
    I think of it less as stopping people from 'getting around' the 'security' and more an extra level of protection & awareness against accidental forwards or replies. It can't stop malicious actors, of course.
brokenkebab 7y ago
No foolishness. Such features intended to enhance handling of sensitive data when users' laziness, or lack of understanding is the problem - and it works well in this way. Malicious recipient can do anything, of course, but usually you don't send your secrets to people you don't trust at all.
sowbug 7y ago
Dude, come on. You do understand. The feature is like a fence in a yard. It separates the honest from the dishonest, forcing the clueless/negligent/reckless to pick a side. Nobody believes fences stop criminals, and nobody believes Gmail has ended the DRM arms race.
- kryogen1c 7y ago
  > Nobody believes fences stop criminals I agree with the thrust of your comment, but this isnt true. Measures like this do prevent some crime. When i didnt lock my car and someone stole the gift cards out of it, locking the doors would have prevented it. Just because the car is still stealable doesnt mean door locks are security theater. Putting an unlocked package cabinet for deliveries on your porch lowers incidences of theft without making it impossible.
- reaperducer 7y ago
  Nobody believes fences stop criminals Then why is every military base surrounded by a fence?
- dang 7y ago
  Can you please edit out personal swipes from your HN comments? This post would be just fine without the first two bits. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - sowbug 7y ago
    Thanks for the reminder, dang. You're right.
tzs 7y ago
> Your silly UI will ultimately never stop me from wiresharking my own cables in my own home and doing whatever the hell I want with any bits of information that enter my space. Their silly UI won't, but what about HTTPS? Won't wiresharking your own cables only get you the ciphertext from the HTTPS session which would be useless to you without the ephemeral key?
- Avamander 7y ago
  TLS MITM proxies are still doable with your own CA
hirsin 7y ago
It's not the point. Most "information theft" is people not realizing that they shouldn't share the information. If someone is dedicated enough to exfiltrate information they'll just take a picture of the screen. But now it's really clear that that's what they're doing. Source - same discussion years ago at Microsoft when Windows introduced this at an OS level to prevent screenshots of confidential mail.
Avamander 7y ago
You overestimate the average user :/
la_barba 7y ago
Well you can't claim anything as "secure" either because someone somewhere has a 0-day. It just depends on where you draw the line, and for what application you're using it.
anjsimmo 7y ago
All that's needed is to disable a few browser options https://boingboing.net/2018/07/22/adversarial-interop.html https://boingboing.net/2018/07/22/adversarial-interop.html I actually tried the "wiresharking my own cables" approach, but because it's encrypted, you also need to dump the ephemeral encryption keys. There's a simple guide on how to do this here: https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/ https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...

CraftThatBlock 7y ago

In other news, water is wet. More at 11

OrgNet 7y ago
most users don't know about this feature and more importantly don't know that Google is lying... so more publicity is better.

cmsimike 7y ago

Gmail has no incentive to create anything secure or private because that would prevent them from going through your email to show ads. [This is wrong] Update! Gmail changed this behavior a while ago. Went under my radar: https://variety.com/2017/digital/news/google-gmail-ads-emails-1202477321/ https://variety.com/2017/digital/news/google-gmail-ads-email... Thanks!

lloydde 7y ago
“We will not scan or read your Gmail messages to show you ads.” https://support.google.com/mail/answer/6603?hl=en https://support.google.com/mail/answer/6603?hl=en
- cmsimike 7y ago
  You're absolutely right. Turns out they changed this behavior in 2017. Thanks for making me look into it.
  - lloydde 7y ago
    You’re welcome. I found it fascinating at the time of the change, and still do, that email is sacred, but all other activity is open for manipation-based-advertising.
    - wibble10 7y ago
      If they don’t scrape your email how is this page generated then? https://myaccount.google.com/purchases https://myaccount.google.com/purchases
      - franzunix 7y ago
        good question
      - jvolkman 7y ago
        Nobody said the emails aren't scanned; they're just not used as context for ads. Obviously they're scanned, otherwise spam filtering wouldn't be possible.

AndrewKemendo 7y ago

I'm always curious how the Project Managers working on these projects think about posts like these. It's a very public call-out, effectively saying "this product is not what they say it is and is dangerous." Especially when it's obviously true, I'd be curious if anyone here can speak to the mental state of someone on the receiving end. For example I was publicly put on blast for something that was false about me. So in that case I just blew it off because it was wrong, and no reaction was really necessary. It was still very stressful though personally and for my family. I wonder how these product teams across Google and FB primarily feel in these cases.

Spooky23 7y ago
They probably eye-roll the deliberate misinterpretation of the feature by a competitor. Particular ironic given that that company's marketing schtick is that the first listed security feature is "We are incorporated in Switzerland" Outlook has had the same feature for 20 years.
ben509 7y ago
They don't handle it well. I worked on a service that had some severe technical constraints at a prior job. (Basically, we were hosting a vendor's network device to the cloud, and it really wasn't designed for it, and it also wasn't a really great device.) We had one customer that loved to blog about us. The customer wasn't being all that unreasonable (from their perspective) and the higher-ups knew about the constraints we were operating under, but they still panicked every time a blog came out about us. More broadly, I think if you talk to any journo in the trade press, some companies can be incredibly thin-skinned about any percieved negative press, and threats and intimidation are very common for percieved slights. And the trade press typically rolls over because those companies are their advertisers. It's why you typically see so many puff pieces, how-tos and PR reprints rather than actual journalism.

mfer 7y ago

I like posts being out there like this. I expect many non-technical users will get the wrong impression about confidential mode. Impression is different from the stated words and can be filled in by our subconscious thoughts about the space between what is said. When words are explicitly said it can cause people to think things through.

dwighttk 7y ago
heh... my subconscious was sure there was a "from this article" at the end of your second sentence and had to reread it a couple of times to figure out what you were saying...
1001101 7y ago
I find that false promises of security are worse than none at all.
lorenzobr 7y ago
Except that most non-technical users will never read ProtonMail blog.

lern_too_spel 7y ago

This is a feature that Outlook already has and corporate users expect. It's for making forwarding sensitive emails or any of their content require intent instead of being accidental.

dheera 7y ago
If "accidental" is the true worry, display a confirmation/warning box before forwarding. There are valid reasons to need to forward even e-mails marked confidential, including lawsuits, harassment cases, or even just asking your own lawyer before signing an agreement, among others. Deciding when a piece of information should not have been forwarded is the job of the workplace or law, not the e-mail client.
- lern_too_spel 7y ago
  > If "accidental" is the true worry, display a confirmation/warning box before forwarding. Gmail supports other MUAs using IMAP and POP, so that doesn't work. The fact that there are valid reasons to forward sensitive emails is why there is an escape hatch. It's only the accidental forwards and copies that this is meant to stop.
  - dheera 7y ago
    We can invent a new e-mail header X-Confidential: true, and clients will start to adopt the warning behavior over time. If Gmail supports it off the bat it will already cover a huge fraction of the market.
    - lern_too_spel 7y ago
      That's a strictly worse solution to the problem with no advantages.
    - UncleMeat 7y ago
      Or we can build a system that just works and doesn't rely on adoption by other clients. Yes if we had a header that everybody used and respected it would work. But that's a lot harder.

craftyguy 7y ago

This 'article' is a Proton Mail spam piece.

lern_too_spel 7y ago

All of this is clearly explained in the setting to enable the mode for a domain. It's for making forwarding sensitive emails or any of their content require intent instead of being accidental, and people who are used to Exchange/Outlook already understand this feature. Domain administrators still need to keep copies for legal compliance.

tantalor 7y ago

> This is not an expiring email. It can still be accessed by Google and potentially exposed to governments or hackers. This "expiration" could protect the receiver from subpoena/discovery ("Sorry I don't have it anymore") but it sounds like the sender is still liable to produce the original message on demand.

ijpoijpoihpiuoh 7y ago

Modes like this are not intended to provide hard security. They are not designed to deal with malicious recipients. Rather, they're intended to provide a barrier to accidental or unthinking dissemination of confidential content. It is also designed to prevent permanent retention and the ongoing risk that represents. It solves or limits the fallout from the "silly friend" and "new enemy" problems. There is no way to convey information to a malicious human s.t. that human cannot convey it onwards to unwanted recipients. The best you can do is provide strong disincentives. Some options for doing this: make sure that your recipients generally don't want to hurt you. Make them fear you (even that doesn't always work, see [1]). [1]: https://en.wikipedia.org/wiki/Reality_Winner https://en.wikipedia.org/wiki/Reality_Winner

gyaniv 7y ago

Yes, Google isn't untrustworthy and doesn't care about the users privacy, we knew that, but the general public that isn't as aware (at this point it's hard to be completely unaware) also doesn't read this private company blog, so it doesn't really help much (except advertise the company). We should be thinking of ways to improve the situation for everyone (not saying I have the solution), but personally (and unfortunately) I don't think this would have any impact.

mda 7y ago
I would trust Google and Gmail way more than protonmail and whatever company behind it for protecting my private data to be honest.
- oarsinsync 7y ago
  I understand the perspective and opinion, but I like to think about incentives and consequences. What's Google's incentive to protect your privacy, and what are the consequences if they fail to? Compared to a firm that is marketing services on the proposition of privacy being at the core, the risks to Google's business, reputation and finances are likely minimal. Whereas, if one of the firms that markets providing services focused on your privacy is found to be intentionally and wilfully violating that, it ceases to be a violation of trust and becomes a violation of contract, false advertising... essentially fraud, and the consequences of deliberately misleading and defrauding customers is more significant than an accidental (or wilful) privacy breach by a corporation that openly markets itself as not respecting its users privacy.
- notyourloops 7y ago
  Why trust either of them?
- okmokmz 7y ago
  You'd trust a company thats primary business model is based on the mass collection, analysis, and monetization of user data to protect your private data? Not saying I trust proton mail, but as far as I'm concerned Google is a malicious actor when it comes to my data same as Facebook, and I believe it's in individuals's best interest to limit their exposure

dewey 7y ago

> It can still be accessed by Google and potentially exposed to governments or hackers. The article makes the classic mistake of assuming everyone has the full security apparatus of a country after them. This feature is obviously not built as an alternative to Signal or for the Snowdens of this world. These probably know better than using unencrypted email already. For the average user it's an improvement of the current status.

ilikehurdles 7y ago
It's an article posted by protonmail, an email service that would be used by the Snowdens of this world. I think it's just a nice way for them to further get their company name out.
mulmen 7y ago
So you reference Snowden then pretend dragnet surveillance doesn't exist? If you are on the internet the NSA is spying on you and everyone else. This is not an improvement because it makes guarantees that simply aren't true. These compromises are made to further Google's bottom line, not protect users. Don't pretend this is some kind of incremental improvement. It's a marketing gimmick.
- dewey 7y ago
  > If you are on the internet the NSA is spying on you and everyone else. There's a difference between passively collecting and actively targeting.
  - crazypyro 7y ago
    Right, but the switch is flipped from passive collection to active targeting in secret court hearings* and if they already have been passively collecting, you could go from no concern to being actively targeted without ever knowing. They couldn't do this if they weren't drag-netting. *FISA courts have 11 denied requests and over 34,000 approved.
    - 7y ago

cfmcdonald 7y ago

The point of confidential mode is for corporate users. When the CEO sends out that confidential mail to the company, it adds a speed bump to users who are about to copy out data that they have been told they should not, so they get a chance to realize they should not do this, and then removes all plausible deniability when they choose to bypass that speed bump.

notimetorelax 7y ago
Agree to that, it’s a pretty strong signal stating possible appropriate uses. If I receive an encrypted MS Office document with Do Not Forward policy, I know that if I want to share it further I need to ask the permission from the sender.
privateSFacct 7y ago
Actually, in many corporate cases BOTH parties want to keep the info confidential - the CEO sends over salary details to CFO to load into payroll system. After it's all loaded and printed for the files (or saved in the HR system), they BOTH want it to auto-expire out of their emails, but both are too busy to scrape back through old emails after a month to delete things. So this confidential mode let's this happen naturally. When the CFO's email is hacked (which it will be eventually at some company) then all is not lost. I'm sure many other users will find it useful.
- mulmen 7y ago
  So confidential mode is a cumbersome retention mechanism? A simple email rule can do this for all messages.
  - privateSFacct 7y ago
    Some messages are MUCH more sensitive than others. You might have a default 3-5 year rule (many corps do). That’s way too long for some messages. especially if sending across an ou boundary where you don’t know the retention treatment this will be great. Sales teams can be very sloppy w email -> auto import into CRMs, sharing permissions, delegating permissions, running their own optimization apps etc. Because the want to claim credits for sales they don’t like tight retention limits etc

weliveindetail 7y ago

Jeopardy: An email option that encourages people to add OTHER people's phone numbers to Google's database.

mulmen 7y ago

"When we launched ProtonMail nearly five years ago, we pioneered a new kind of email service: one that gives you control of our own data." This is a very unfortunate typo.

bo1024 7y ago

Nor is it email!

kabwj 7y ago

Does Gmail give away your data to the Swiss government, though?

silversconfused 7y ago
Yes, and without a warrant too.

hitpointdrew 7y ago

Article makes good points. But clearly they are promoting their own product, over Gmail, and compete directly with them. One thing I find troubling is that they seem to be making their own false claim. >Because we do not have access to the recipient’s private key, we are never able to read the message. We do have access to metadata, like the email addresses, timestamp, and subject line. I am not sure how proton could send messages to anyone if they didn't know the recipients address! EDIT: I'm stupid, please disregard this. They clearly state that the DO have access to metadata (for some reason my head read it as DO NOT).

kdmccormick 7y ago
I don't see where they claim they don't know the recipient's address.
- deleted 7y ago
  [deleted]
- hitpointdrew 7y ago
  I'm an idiot. I miss read the sentence.
sylvanaar 7y ago
It literally says that they have access to the email address in what you quoted.

david927 7y ago

Gmail confidential mode is not secure nor private

ddingus 7y ago

This makes as much sense as the Outlook recall feature did. User Bob would like to recall email titled, "that sex party last night" Riiiight

ben509 7y ago
Recalls make a lot of sense if mass announcements are sent with mistakes, so people aren't confused by having the incorrect version in a busy inbox.
- ddingus 7y ago
  Yes, exactly. For benign purposes, some sense is seen. Otherwise, the whole idea is silly.

bombtracks666 7y ago

This article (https://choosetoencrypt.com/news/gmails-new-confidential-mode-is-not-confidential/ https://choosetoencrypt.com/news/gmails-new-confidential-mod...) pointed that out in October 2018.

deleted 7y ago

[deleted]

rolltiide 7y ago

All of this applies to making a new protonmail account too Requires SMS verification or an impassable captcha loop if over TOR And payment with a credit card The cryptocurrency payment option with non-user identifiable info only being available to existing protonmail accounts where that info was already harvested So it is ironic to see protonmail calling out those specific things about gmail confidential

slips 7y ago
Protonmail does those thongs to try and prevent bad actors or bots from making encrypted accounts to hide their shady tracks. Not for data collection that they'll sell for a profit. Don't be so glib as to state you can't see the difference.
- rolltiide 7y ago
  From their home page: > Secure Your Communications with ProtonMail > Anonymous Email > No personal information is required to create your secure email account. requires personal information to create the secure email account "Protonmail does those thongs to try and prevent bad actors or bots from making encrypted accounts to hide their shady tracks." oh okay, pack it up everyone, don't listen to glib ole me coming to a rational conclusion its IRONIC that I have to trust them as much as I have to trust Gmail confidential's claims about what they may actually do with the data collection. or what they may be coerced to do with the data collection. "Swiss law" doesn't prevent that.
- privateSFacct 7y ago
  The point is they flat out lie in this article about requiring it.
MYEUHD 7y ago
solving a ReCAPTCHA ( a google product that fingerprints users) is required to create an account even when not using TOR.
- rolltiide 7y ago

silversconfused 7y ago

This makes all the pointy hair bosses out there demanding faxes and hardcopies seem wise. Imagine, getting an email that tried to block forwarding... the nerve.

dboreham 7y ago

I first had this argument (obviously I was on the sane side of the argument) in 1994. Amusing to see it persist for 25 years and to even permeate Google.

paul7986 7y ago

Google knows more about you then your mom! Sorry and personally that’s too much for me!

m3kw9 7y ago

Google and privacy in the same sentence, no one would bet their house on it if they were to choose

idlewords 7y ago
Google is very good at protecting data from unauthorized access. Many of the people who work there see themselves, with justification, as the guardians of privacy in that narrow sense.

idlewords 7y ago

Email in general is not secure or private. It bugs me to see ProtonMail making claims like 'end-to-end encryption' about a webmail service.

privateSFacct 7y ago

Wow, marketing spam from a competitor. We send confidential docs regularly to users, who need access to those docs for perhaps 1 week at most. No one wants / needs to keep these around, but no one goes through their email carefully to delete these items. If that users email was hacked -> they have a big problem. If we can mark the items for a 3 week retention and then expire those items for them, that great - and this lets us do that. The whole I can wireshark my network -> 99.9% of the confidential info we send goes to other folks who ALSO want to keep it confidential. Getting rid of stuff you no longer need to maintain is a key way of helping avoid big document dumps. The proof is in the pudding. Either this will help google sell to business (it will in our case in a big way). Or folks will say it is a stupid feature and decide idiots like Protonmail who can't seem to understand the point of these features now deserve our business. My confidence in a place like protonmail goes down based on this, and I'd love to get a feel for their security history and overpromises (ie, webmail client has got to easily be able to log and hack encryption etc).

joosters 7y ago
There's no need to call Protonmail idiots in order to put across your views on the subject, keep it civil. Plus, it makes your argument look weak if you have to resort to name-calling.
- privateSFacct 7y ago
  Let me be super clear than. "Gmail confidential mode is little more than a marketing strategy." FALSE - This type of approach has real and direct security benefits. The fact that proton can't see understand that makes them idiots. "Gmail’s confidential mode is little more than a marketing trick designed to pacify users concerned about privacy." FALSE - Many business users using google are less concerned about privacy than they are about SECURITY. In the business context, most privacy is already given up, your employer can go through your emails. They can vault them up, do e-discovery on them etc etc. These aren't folks fighting off nation states. These are folks who someone in the office WILL click the bogus link and have their account taken over - and the business wants to reduce the blast radius. Saying this is a marketing "trick" is silly and the fact that proton can't see that makes them idiots.

cotelletta 7y ago

Protonmail's Android app still doesn't do threads. Posting this just to embarrass them into fixing it.

threwawasy1228 7y ago

Protonmail is a fantastic service, I switched to an account with them in the last few years and have not logged into my gmail since. Can't say enough good things about their offerings. I'm glad to see them making arguments like these in public to out their competitors practices.

slenk 7y ago
You mean creating blog spam that misses the point?