The biggest benefit of this is removing the email from archives, so weeks, months, or years later if the account gets compromised the gains are lower. For example an email with the subject "HIV Test Results" has a far different value with and without a body included.
A more down-to-earth example is I just sent my wife a W-2 via email for our taxes. I asked her to delete the email after downloading the document. But instead I could have just set an expiration on the contents and poof it is gone.
Even with the first, Google supports forwarding all mail to an arbitrary email address, which means the "Gmail" becomes a text-file stored on a dovecot server (or other regular mail server) somewhere.
So unless they break delivery (you can forward only some subset of emails) - there's no way for the sender to have any better guarantee than "please delete after reading".
At least the pgp spec has (had?) an "eyes only" flag that, while it didn't guarantee anything, at least meant compliant software would try hard to not leave a plain text copy on the filesystem.
Why break delivery when you can break sending?
just store the contents locally, and replace the body with some URL that the user has to click..
then, when non-gmail users have been desensitized to clicking links in emails 'because gmail', and get viruses constantly, sell them gmail as a way to have email without risk of viruses.
win win!
Yes, there is a flag that means "for your eyes only", see RFC [0] and GPG esoteric options [1].
[0]: https://tools.ietf.org/html/rfc4880#section-5.9
[1]: https://www.gnupg.org/documentation/manuals/gnupg/GPG-Esoter...
I’m organizing mail sent to me. 10k text files. The last thing I want is to debug why search isn’t finding the message because some vendor 4 years ago flagged their invoice with an expiration date.
This is not a function that as a receiver of email I want. So they can make a new protocol that I don’t use instead of overloading email.
Also, it’s a bit scary for some of the slippery slope possibilities. Will my filesystem do the same? The last thing I want is DRM checking every file.
Stuff on my machines is my data. If you don’t want me to have it, don’t send it to me. Etc etc.
You receive and email. You assume that it’ll get stored in your inbox forever.
I almost want to say it’s a bug, not a feature. And I’m pretty open to software changes even if it’s a pain to get used to. But changing something as fundamental as the nature of emails in this regard gives rise to something other than an email.
Mind you, this is a better case than for Gmail users who will probably see the content inline with their mail, only for it to disappear later.
So why would I believe Google now?
This is an augmentation to what postini had, and now in core G Suite, of defined retention periods for email. Now, users can make one-off decisions on a per-email basis.
It's like the secret discussion/chat system that uber uses, I can't find the name, that guarantees protection against legal discovery by encrypting the chat and making sure it is ephemeral.
There are valid (maybe not morally, but legally) reasons to have defined retention periods and this is a nice addition to that.
It does bring Google into the Apple privacy-is-our-business sphere in that cooperating parties that solely use gmail have much better assurance that they don't leave traces behind.
Wickr, but while it guarantees protection from discovery, it doesn't guarantee freedom from implication. It is not legal to use such services to hide illegal activity, which is what Judge Alsup clearly laid out in the case. How would you know if illegal information was being traded? Because Uber management implied that employees should use Wickr if they were going to talk about anything illegal, which, uh, isn't something you want to do.
https://www.nutter.com/pp/publication-Apple-v-Samsung-Electr...
https://www.lexology.com/library/detail.aspx?g=30282c16-31e3... (HTML version)
Apple supporting it won't help apple users one bit, because nobody else uses an actual application to check mails anymore. It's mostly web mail clients everywhere, and they obviously can't use encryption.
A few more privacy scandals break, and if Apple had an end-to-end encryption story that sounds roughly like: “If you’re using Apple products and services, you probably don’t need to think too much about the techy parts.” I could easily see Apple cementing their position for anyone even remotely concerned about privacy.
Apple the computer company. Apple the media company. Apple the smartphone conpany. Apple the consumer privacy and protection company? I could see it.
* On the device? Oops--device broke, guess my emails are gone forever
* In the "cloud"? -- Oops, can't guarantee encryption
Who generated the keys and how do you build trust?
For both of these, you can trust Apple do do the right thing, but that's putting all your eggs into that basket, similar to iMessage.
you're right its not an unsolved problem, its an unsolvable problem.
There is little point in encrypting mails between apple users, if the keys are kept on the apple servers. What would it achieve after all? Apple, and by extension every nation of importance would still have access.
the only reward you'd get from that is getting locked into the apple ecosphere even stronger, because now you won't be able to read your mail archive anymore unless you use an apple device.
And you obviously can kiss search goodbye. There is no way to search encrypted data after all, unless you decrypt it.
Got any data to back that up? I do, and so do a lot of my friends and colleagues.
Of course, hopefully PGP, and not some custom, private API like iMessage.
Of course, no one uses it or even realizes it's there because S/MIME is terrible.
I was playing around with using my own CA to issue certificates for internal stuff. I created a personal certificate for myself and imported it to my keychain - without doing anything, Apple Mail was digitally signing my messages. On the other side, however, people saw digital signatures that couldn't be verified and got confused by that.
[0] https://support.apple.com/en-ca/guide/mail/sign-encrypt-mess...
Basically if I send you a message using it, I have deniability. Screen shot all you want, I can simply say I never sent it. If we do go to court over something sent -- you will end up showing a screen shot or a copy and pasted text file. Those will be tough to support in court. Have fun going after an Uruguay tech company for deleted data.
This is different with standard email. A subpoena sent to gmail will reveal ip addresses (sender and receiver), what time it was sent, the fact that you logged in with account 9328439, the fact I logged in with account 298238, someone from google testifying it was sent and read, on and on.
I don't know what google is trying to do -- but what privnote did is really useful and an obvious win.
I'm not a trial lawyer, but I suspect that it's not a great defence strategy to deny basic matters of fact.
I'm not so sure about that. If you leave enough incriminating evidence in the note itself, it wouldn't take too much to convince the jury or judge. For example, if you write something that only you had knowledge of in the note, then it can be used as evidence to convince the jury that you wrote it.
This site is a good idea but should be viewed as part of an overall strategy.
From these screenshots, Google calls the note an email, integrates it with their email client, and removes some normal email controls for forwarding, etc. That violates people's expectations of email, in terms of recipients' control of their data and vendor neutrality. Those are things I don't want changed about email!
One approach is to decouple ephemeral messages from email or GMail like privnote, which avoids confusion or lock-in. You still should make precise promises, though; I think "disappearing message" is a bad way to say "we delete our copy." Seems 100% feasible but then it's just Google Privnote.
Another option is to keep it integrated but tweak it to try not to mess up email, by making the feature "expiration request" or something, and maybe many clients comply by default but don't force it, except possibly when account owner != user (work networks). That helps cooperating parties without being either vendor-specific or DRM-y. I can even imagine vendors working together on that, especially with handling of user data in focus right now. Senders can try to figure out if your recipient contacts/domains claim support for the feature so you don't try to use it when it's clearly meaningless.
A fear is that Google considers it a feature to mess with the email ecosystem by adding vendor-specific stuff, or that Google'll talk about security a lot and just happen to propose lots more solutions involving more Google lock-in. I'd like to see what comes out of Google I/O to get more of a sense.
This solves quite a few problems. Then, Google can start on other problems, like PGP.
https://blog.google/products/gmail/g-suite-gains-traction-in...
I have to wonder if the same concept would / could be applied to such emails? The email might be gone from my account and yours, but it's still in a digital landfill somewhere. Free to be reviewed, sans warrants, etc. Perhaps?
Hmm, there could be a business opportunity for the USPS. They could sell 'stamped' trash bags, good for transport to the town dump, which could only be collected by authorized carriers, namely the regular trash collectors.
Pawing through those bags would be tampering with mail, a federal crime IIRC ( ah, here we go: https://about.usps.com/securing-the-mail/mailtampering.htm )
Probably not a market hit, though, no one really cares. Not to mention the bags would highlight "the good stuff".
- Might it be possible? - Could it be argued? - Are the courts and laws up to speed on such things?
For example, how would this play in a FISA court? Special case? Yes; not plain vanilla law.
If you post a reply to a wrong comment, please explain how it's wrong while remaining civil. Then we all learn something, and you don't damage the community.
If Google was serious about privacy it would pgp-encrypt everything so only the client, client-side can decrypt it, just like what protonmail does.
pfff, 'self destructing emails', what a heaping pile of razzle dazzle no-ops that is -- this is more likely subliminal advertisement for the new mission impossible movie.