4 ms·

GMail will probably never encrypt our emails for us. But what it could do is automatically decrypt someone else's email and verify the signature. This would m

GMail will probably never encrypt our emails for us. But what it could do is automatically decrypt someone else's email and verify the signature. This would make encryption much more accessible without any (advertising) cost to Google.

jmillikin 14y ago
Automatic decryption would require uploading a copy of the recipient's private key to Gmail, which rather defeats the purpose of end-to-end encryption. For protecting mail in transit, SMTP TLS is just as secure and much easier to deploy.
- AnthonyMouse 14y ago
  SMTP TLS has to be deployed by the email server admin. Google could implement PGP (with the private key stored on their server) and it would work with any PGP-compatible email client regardless of support by the peer's email server. So for example, if your company runs your email server and doesn't use SMTP TLS, you can still use e.g. Thunderbird with GPG and correspond with someone who uses gmail without the gmail user having to take any steps whatsoever -- it would be trivial for google to supply a page like 'https://gmail.com/[username@gmail.com]/PGP https://gmail.com/[username@gmail.com]/PGP (and autogenerate a new key for any guessed address to thwart spammers guessing addresses), where you could get a copy of the user's public key and then send encrypted messages without the gmail user having to do a single thing. That doesn't keep the email private from Google, but if your only concern is to keep your communications private from your email provider for some reason (or from your ISP etc. if you like your email provider other than the fact that they don't use SMTP TLS), it gives you something you didn't have before.
  - jmillikin 14y ago
    "That doesn't keep the email private from Google, but if your only concern is to keep your communications private from your email provider" If you use Gmail, then Google is your email provider.
    - AnthonyMouse 14y ago
      And if you don't use Gmail, but you're corresponding with someone who does, then Gmail is not your email provider.

jmillikin 14y ago

Automatic decryption would require uploading a copy of the recipient's private key to Gmail, which rather defeats the purpose of end-to-end encryption. For protecting mail in transit, SMTP TLS is just as secure and much easier to deploy.

AnthonyMouse 14y ago
SMTP TLS has to be deployed by the email server admin. Google could implement PGP (with the private key stored on their server) and it would work with any PGP-compatible email client regardless of support by the peer's email server. So for example, if your company runs your email server and doesn't use SMTP TLS, you can still use e.g. Thunderbird with GPG and correspond with someone who uses gmail without the gmail user having to take any steps whatsoever -- it would be trivial for google to supply a page like 'https://gmail.com/[username@gmail.com]/PGP https://gmail.com/[username@gmail.com]/PGP (and autogenerate a new key for any guessed address to thwart spammers guessing addresses), where you could get a copy of the user's public key and then send encrypted messages without the gmail user having to do a single thing. That doesn't keep the email private from Google, but if your only concern is to keep your communications private from your email provider for some reason (or from your ISP etc. if you like your email provider other than the fact that they don't use SMTP TLS), it gives you something you didn't have before.
- jmillikin 14y ago
  "That doesn't keep the email private from Google, but if your only concern is to keep your communications private from your email provider" If you use Gmail, then Google is your email provider.
  - AnthonyMouse 14y ago
    And if you don't use Gmail, but you're corresponding with someone who does, then Gmail is not your email provider.