News for hackers. Stuff that matters.
Re:More Encryption, More Notifications, More Email Security by nxzero on Friday March 25, 2016 @09:10AM (#11359798)
If they had end-to-end encryption, then Google wouldn't be able to read the emails; meaning to gain value, Google would have to charge for the service.
Re:More Encryption, More Notifications, More Email Security by delroth on Friday March 25, 2016 @09:25AM (#11359868)
It's not (only?) a question of "gaining value". End-to-end encryption is fundamentally incompatible with many features that Gmail users rely on. I would recommend reading https://moderncrypto.org/mail-archive/messaging/2014/000780.... from an ex Gmail anti-abuse tech lead. And for 99.99% of Gmail users, protecting automatically against untargeted phishing and malware attacks is a larger security improvement than having e2e encryption.
Re:More Encryption, More Notifications, More Email Security by sliverstorm on Friday March 25, 2016 @03:27PM (#11362112)
protecting automatically against untargeted phishing and malware attacks is a larger security improvement than having e2e encryption.

Not to mention, from what I heard out of the mouths of ordinary folks, that protection is literally one of the leading reasons GMail took over. It was nearly spam-proof, and people loved it. (That and lots of free storage)

Re:More Encryption, More Notifications, More Email Security by ikeboy on Friday March 25, 2016 @10:24AM (#11360224)
>The third problem is that spam filters rely quite heavily on security through obscurity, because it works well.

Hm.

Re:More Encryption, More Notifications, More Email Security by Zigurd on Friday March 25, 2016 @11:57AM (#11360786)
Permission-based email. It's an established solution. IM works this way because it doesn't have spam filters.
Re:More Encryption, More Notifications, More Email Security by macns on Friday March 25, 2016 @01:55PM (#11361549)
A quick google search on 'permission based email service' shows email lists- marketing related results, do you know any of such service provider?

Maybe some day email will fade away giving its place to an IM, though I'm not sure it will always be spam-filter free.

Re:More Encryption, More Notifications, More Email Security by Zigurd on Friday March 25, 2016 @02:17PM (#11361713)
Boxbe is one that I have encountered people using: http://www.boxbe.com/help It's a little surprising this was never a standard part of email. It's the same workflow as granting permission to be contacted by IM.

Based on a quick search, you are right that the phrase "permission based email" has been SEO'ed into uselessness by email marketing services. What should it be called? Screening? But the spam filtering services have almost SEO'ed that into uselessness.

Re:More Encryption, More Notifications, More Email Security by macns on Friday March 25, 2016 @03:24PM (#11362095)
Boxbe is an interesting service, thanks. Maybe this 'permission-based' was never a standard because spam didn't exist back then and, later when it did exist, didn't play well with the idea of mailing lists. In the latter context it's funny how this search term is SEO'd to return marketing services!

Having just read a former google abuse team member's take on end to end encryption and anti-spam[1], this topic now looks a lot more complex. Regarding IM's, he mentions how spam-free WhatsApp is and argues that spam is a lot easier to fight when you have central control because you can change anything at any time at any point (client or server).

[1] Mike Hearn, https://moderncrypto.org/mail-archive/messaging/2014/000780....

Re:More Encryption, More Notifications, More Email Security by Zigurd on Friday March 25, 2016 @03:42PM (#11362182)
IM is low in spam because spammers would have to wheedle their way onto your contact list to spam you. Same for social networks. You just delete or block spammy "friends."
Re:More Encryption, More Notifications, More Email Security by paulryanrogers on Saturday March 26, 2016 @09:36AM (#11365603)
Whitelist based email
Re:More Encryption, More Notifications, More Email Security by mtgx on Friday March 25, 2016 @11:05AM (#11360423)
Even so, they could provide the option, which probably no more than 1-2% of the users would ever use - those who actually need their privacy to be protected, while the rest probably "won't care".

Leave it up to the users to decide whether they want to use end-to-end encryption despite a potential spam problem. It's also not like people couldn't use multiple email addresses.

Re:More Encryption, More Notifications, More Email Security by sliverstorm on Friday March 25, 2016 @03:29PM (#11362119)
So... install Thunderbird & GPG, and encrypt your mail end-to-end and use IMAP?
Re:More Encryption, More Notifications, More Email Security by relearn on Friday March 25, 2016 @12:35PM (#11361012)
If you were developing a product, would you invest time, money, and research into a feature that (maybe) one or two percent of your users would utilize?
Re:More Encryption, More Notifications, More Email Security by mtgx on Friday March 25, 2016 @12:49PM (#11361100)
Google already said in the above article that "only" 0.1% of its users get targeted by state-sponsored attacks (which by the way is about 500,000 users) - so why even bother building that then, by your logic? Clearly, just a waste of resources (probably the same for two-factor auth, Security Key, etc).

How many times have we heard companies "China has a 1 billion people - imagine if we only got 1% of that market with our product!". But we're talking about a feature of a product here, not an entire product that only gets 1% of a market's userbase.

0.1% here, 1% there, another 10% over there - all of these features add-up to create a great product that everyone loves because of the aggregate of features but also because of that "one" feature they love individually.

Another thing to remember is that the enthusiasts are the market-builders. You can't just win with a product that surveys well with 80% of the market. I don't think most of the phone or smartphone customers in 2007 wanted a touchscreen phone. Probably (well, literally, actually) only 1% of the market wanted it then.

Also, we don't know how important this feature could be to gain Google more trust. Telegram for instance has gotten promoted as a private messenger that uses end-to-end encryption - and yet its end-to-end encryption isn't even enabled by default (so same scenario that I was talking about), while its "normal" encryption is probably worse and less secure than what Google uses for Hangouts.

Re:More Encryption, More Notifications, More Email Security by Kadin on Friday March 25, 2016 @06:13PM (#11363088)
I'd argue that Google implemented it because they don't want their product to be implicated in a high-profile attack; if someone disappeared because their Gmail credentials were phished, it could easily blow back on Google and contribute to a perception that Google services are fundamentally insecure.

It might be a harder sell to implement E2E crypto, although perhaps the same argument might apply some day. The notifications are probably just low-hanging fruit.

Re:More Encryption, More Notifications, More Email Security by chflags on Friday March 25, 2016 @11:27AM (#11360583)
The way they word these releases certainly makes it sound like they have users' best interests in mind.

But honestly, as you have highlighted, these announcements should be insulting to users' intelligence.

"Dear Users: Please allow us to store copies of all your sensitive data, including every email ever sent or received, in perpetuity. In return, to the extent the law permits us to do so, we'll let you know (_ex post facto_) when some other third party is having a look at it."

The solution to the problem if indeed there is a problem here is not going to come from Google.

The problem _is_ Google.

The only parties who need a copy of an email are the sender and the recipient. If you really care about privacy, security, whatever, then "store and forward" and "POP" via some third party (Google, etc.) is not the proper way to implement email.

Hypothesis: Google does not charge for Gmail because, quite simply, no one would pay.

Re:More Encryption, More Notifications, More Email Security by LeifCarrotson on Friday March 25, 2016 @12:23PM (#11360930)
> The only parties who need a copy of an email are the sender and the recipient.

Emphasis on "need". Most recipients also like to have a third-party anti-spam service also have a copy of their email.

Assuming the encryption costs are low enough, spammers and virus senders would like nothing better than to cripple anti-spam learning tools by having each recipient recieve a cryptographically unique opaque blob. This would force users to develop their own training corpus and react to new spam and virus outbreaks individually.

You may argue that you could still use anti-spam locally, but it wouldn't be as good. While I wouldn't mind sending decrypted spam out to a server and getting updates to my local anti-spam program, no one would want to send legitimate mail, so the service would have no "ham" to train against.

I suppose encryption could help in the fight against spam by requiring CPU time to encrypt the email. 10 seconds per email would be hard to notice for a real human responding to messages, but might make spam unprofitable.

Re:More Encryption, More Notifications, More Email Security by NoGravitas on Friday March 25, 2016 @01:29PM (#11361346)
I wonder if it would be good enough to use a public spam corpus built on volunteer contributions, while using only a private ham corpus.
Re:More Encryption, More Notifications, More Email Security by vectorjohn on Friday March 25, 2016 @07:01PM (#11363393)
Mmmmmm, ham corpus :)
Re:More Encryption, More Notifications, More Email Security by dorfsmay on Friday March 25, 2016 @09:20AM (#11359843)
Google does charge for email services, for anybody using gmail with their own domain, which is a lot of small companies and probably a few medium size one.
Re:More Encryption, More Notifications, More Email Security by nxzero on Friday March 25, 2016 @09:31AM (#11359903)
Right, though my guess is that doing custom domains and end-to-end encryption as a service are not comparable services or markets.
Re:More Encryption, More Notifications, More Email Security by 1123581321 on Friday March 25, 2016 @02:59PM (#11361959)
I don't see why Gmail has to be all-or-nothing. I would like to see Google continue their free/cheap service as is, and offer a more expensive service with better security. I think Google would be able to greatly improve the interface for end-to-end encryption if they chose to. However, the company seems disinterested in cooperating less with law enforcement and spy agencies.
Re:More Encryption, More Notifications, More Email Security by thomasthomas on Friday March 25, 2016 @04:02PM (#11362278)
I would suspect this is because when 99% of users hear of an upgraded gmail service that costs money, they will start asking questions as to what's wrong with their current gmail service. They get so much synergy across products from users data it's probably not worth it to point out current gmail drawbacks to 100% of customers: even if x% switch to premium, 1-x are now aware of drawbacks of using google across all products and could unpredictably hurt top line rev.
Re:More Encryption, More Notifications, More Email Security by massemphasis on Friday March 25, 2016 @01:30PM (#11361355)
It is just naive or dumb to think Google is left alone when they don't give access to the government. Of course they give access, but in the interest of being a vital source of intelligence and data they put on an act.
Re:More Encryption, More Notifications, More Email Security by dave2000 on Friday March 25, 2016 @09:18AM (#11359831)
They could mine for keywords on the client. They'd not need to store those against who you are sending the message to. It would be less intrusive than is the case now, but not as secure as then knowing nothing about what you're sending. Where would draft emails be stored in an end to end encrypted system? They'd need to store the information on their servers in a way that they can recover it for subsequent editing.
Re:More Encryption, More Notifications, More Email Security by sp332 on Friday March 25, 2016 @10:17AM (#11360189)
How is sending "keywords" back to a central server more secure than just mining them on the server?
Re:More Encryption, More Notifications, More Email Security by dave2000 on Friday March 25, 2016 @10:26AM (#11360233)
I'm suggesting a way Google can monetise end to end encrypted emails.
Re:More Encryption, More Notifications, More Email Security by sp332 on Friday March 25, 2016 @10:50AM (#11360338)
By decrypting them at the end and sending them back to the middle, completely defeating the purpose!
Re:More Encryption, More Notifications, More Email Security by edraferi on Friday March 25, 2016 @01:48PM (#11361510)
You get improvement by returning a restricted feature set, but yes.