Is google really encrypting each individuals email based on a password they have no knowledge of? I know privacy oriented email hosts have tried to achieve this, but google?

I'd hope the phone tech support understand the goal was to regain access to the account, through a reset or whatever mechanism, and not to just know the password. But maybe if my dad worded it like I did the same confusion could've happened.

> Is google really encrypting each individuals email based on a password they have no knowledge of?

We're talking about giving out a forgotten password, not getting access to email contents.

I used to work on the indexing system, not GMail, but my vague recollection is there are some master private keys (necessary for lawful intercept, etc.) locked in hardware modules for email storage, where very few binaries are able to get the hardware modules to perform public key decryptions. There are strong safeguards on humans using some of the binaries that do have access. Access to these encryption keys is orthogonal to access to the account password. My recollection of the Aurora attacks is that the intruders got access to some systems that were able to decrypt/display senders and subjects, but we believed they were unable to get at the email bodies.

They mean google does not have access to the password, as that is done via a one-way hash.

They can do a password reset, however would need sufficient proof of account ownership. Having access to the account is unfortunately not enough proof to show ownership, as that could be achieved with access to someone else’s device.