4 ms·

>Note: Although confidential mode helps prevent the recipients from accidentally sharing your email, it doesn't prevent recipients from taking screenshots or ph

by sigmar 7y ago

>Note: Although confidential mode helps prevent the recipients from accidentally sharing your email, it doesn't prevent recipients from taking screenshots or photos of your messages or attachments. Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. If you click the "learn more" in gmail it says that ^. Gmail seems pretty upfront about what "confidentiality mode" does.

TeMPOraL 7y ago
> Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. I guess me exercising my right to do whatever I want with my bits on my computer is me having "malicious programs". What in the actual fsck.
- reroute1 7y ago
  It's not saying exercising your rights is having malicious programs, they are not mutually exclusive and they didn't make that claim.
  - a1369209993 7y ago
    Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. Recipients who do not have malicious programs on their computer also may still be able to copy or download your messages or attachments.
    - sigmar 7y ago
      It is using "malicious" to mean "intending to circumvent your intention to keep this email confidential." Is there a different word that could be substituted to maintain that meaning?
      - a1369209993 7y ago
        Actually, I was just pointing out the tautology B -> (A -> B). If you have B, then sure, A implies B, and not-A also implies B. Although on further consideration, my previous comment may actually be wrong: "malicious programs" includes ones that attempt to violate the user's right to copy, and recipients who do not have the malicious program Gmail on their computer might not be able to copy or download your messages or attachments.
      - TeMPOraL 7y ago
        IME the "artificially and ineffectively trying to enforce e-mail confidentiality" part is malicious in itself. You don't get to tell me what I can do with a physical letter I get from you, so you shouldn't be able to do that with an e-mail either.
danShumway 7y ago
> Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. Even this is really poorly worded. You don't need a "malicious" program on your computer, you just need to go to your browser menu and hit the print button. This still makes it sound like the average user won't be able to save your email unless they're doing some kind of tech mumbo-jumbo -- that your real risk is if an IT person gets a hold of it. But printing or saving a web page are basically the first thing I would teach anyone to do if I were mentoring them on how to use a computer. Probably every secretary in your office already knows how to get around this restriction.
- junar 7y ago
  > Recipients of the confidential message will have options to forward, copy, print, and download disabled. Doesn't seem to be that easy. You're probably not going to get a copy without taking a screenshot, opening up developer tools or digging into your browser's cache.
  - danShumway 7y ago
    I checked, you can go to the menu at the top of your browser, and hit File->Save Page As. It took me about 15 seconds. You can also save the page as HTML only, which both prevents any weird clientside tricks that Google might like to try in the future and makes the file more portable. Assuming you don't want to save the HTML page, you still might not even need to download a separate program to screenshot it. New installs of Firefox just have a button on the toolbar labeled, "Take a Screenshot". It'll grab the entire page without forcing you to do any scrolling, and doesn't require you to know anything about HTML. I tested, and it bypasses all of the security features on confidential emails. People are arguing that this is designed to prevent accidental sharing, which is a really good point that I think I agree with overall. However, HN is a tech site and I'm seeing comments that say the only way you could beat this is to dig into your developer tools. If a nontrivial portion of HN users think this service is more secure than it actually is, how much more uninformed are ordinary users? Saving a web page is not going to be a difficult problem for most people in your office to solve. So my objection here would be, Google isn't doing a good enough job of informing even tech-literate people of just how easy this is to circumvent. A CEO is going to look at this and think, "well, I guess they're doing voodoo magic so most people in my office won't be able to share." The reality is, pretty much anyone in your office who wants to be able to beat this will be able to figure out how to do so.
elliekelly 7y ago
But it’s (quite literally) _not_ upfront when the pertinent information is hidden behind “learn more.” I’d be curious what the click-rate is on that link. Also, I can think of a lot of ways to bypass the “confidentiality” settings that require no malware whatsoever. Not only is their giant asterisk hidden, it’s wildly inaccurate and misleading.

by sigmar 7y ago

TeMPOraL 7y ago

> Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. I guess me exercising my right to do whatever I want with my bits on my computer is me having "malicious programs". What in the actual fsck.

reroute1 7y ago
It's not saying exercising your rights is having malicious programs, they are not mutually exclusive and they didn't make that claim.
- a1369209993 7y ago
  Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. Recipients who do not have malicious programs on their computer also may still be able to copy or download your messages or attachments.
  - sigmar 7y ago
    It is using "malicious" to mean "intending to circumvent your intention to keep this email confidential." Is there a different word that could be substituted to maintain that meaning?
    - a1369209993 7y ago
      Actually, I was just pointing out the tautology B -> (A -> B). If you have B, then sure, A implies B, and not-A also implies B. Although on further consideration, my previous comment may actually be wrong: "malicious programs" includes ones that attempt to violate the user's right to copy, and recipients who do not have the malicious program Gmail on their computer might not be able to copy or download your messages or attachments.
    - TeMPOraL 7y ago
      IME the "artificially and ineffectively trying to enforce e-mail confidentiality" part is malicious in itself. You don't get to tell me what I can do with a physical letter I get from you, so you shouldn't be able to do that with an e-mail either.

danShumway 7y ago

> Recipients who have malicious programs on their computer may still be able to copy or download your messages or attachments. Even this is really poorly worded. You don't need a "malicious" program on your computer, you just need to go to your browser menu and hit the print button. This still makes it sound like the average user won't be able to save your email unless they're doing some kind of tech mumbo-jumbo -- that your real risk is if an IT person gets a hold of it. But printing or saving a web page are basically the first thing I would teach anyone to do if I were mentoring them on how to use a computer. Probably every secretary in your office already knows how to get around this restriction.

junar 7y ago
> Recipients of the confidential message will have options to forward, copy, print, and download disabled. Doesn't seem to be that easy. You're probably not going to get a copy without taking a screenshot, opening up developer tools or digging into your browser's cache.
- danShumway 7y ago
  I checked, you can go to the menu at the top of your browser, and hit File->Save Page As. It took me about 15 seconds. You can also save the page as HTML only, which both prevents any weird clientside tricks that Google might like to try in the future and makes the file more portable. Assuming you don't want to save the HTML page, you still might not even need to download a separate program to screenshot it. New installs of Firefox just have a button on the toolbar labeled, "Take a Screenshot". It'll grab the entire page without forcing you to do any scrolling, and doesn't require you to know anything about HTML. I tested, and it bypasses all of the security features on confidential emails. People are arguing that this is designed to prevent accidental sharing, which is a really good point that I think I agree with overall. However, HN is a tech site and I'm seeing comments that say the only way you could beat this is to dig into your developer tools. If a nontrivial portion of HN users think this service is more secure than it actually is, how much more uninformed are ordinary users? Saving a web page is not going to be a difficult problem for most people in your office to solve. So my objection here would be, Google isn't doing a good enough job of informing even tech-literate people of just how easy this is to circumvent. A CEO is going to look at this and think, "well, I guess they're doing voodoo magic so most people in my office won't be able to share." The reality is, pretty much anyone in your office who wants to be able to beat this will be able to figure out how to do so.

elliekelly 7y ago

But it’s (quite literally) _not_ upfront when the pertinent information is hidden behind “learn more.” I’d be curious what the click-rate is on that link. Also, I can think of a lot of ways to bypass the “confidentiality” settings that require no malware whatsoever. Not only is their giant asterisk hidden, it’s wildly inaccurate and misleading.