To me this feature looks like a box ticking exercise with an eye toward government contracts. Microsoft has it so Google needs it too in order to avoid looking less secure to decision makers who may not know whether or not it will ever be needed.

Sure, it ticks this exact box that the help article mentions:

> Your organization operates in a highly regulated industry, like aerospace and defense, financial services, or government.

This is not just tick a checkbox and it is done. Enabling it is non-trivial as it requires setting up a whole bunch of stuff, like integrating with a third party key service provider (or setting up your own).

I didn't mean to say anything about how hard it is to implement.

What I'm saying is that the point of implementing this feature may not be that it's expected to be tremendously useful for a lot of actual users.

Rather I think the point is to not leave the "has client-side encryption" box unchecked in any comparison charts or scoring systems that may influence purchasing decisions.

> Also to be available it must first be enabled by a workspace admin, then by the end user.

Just out of curiosity, why would you expect anything different?

I'm very surprised it isn't force enabled by the admin, with the end user having no say in the matter.

Admins of many orgs don't like letting the user have options for things like security.

The feature is meant for especially sensitive documents, you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing. More mature products like Azure Information Protection let you require encryption for certain documents based on policy, but that doesn’t seem to be part of what Google is announcing here.

> you wouldn’t want it turned on for everything in the organization because it limits useful features like search and printing

Some organizations would want to prioritize encryption over search/printing. (Also, there's no reason search and printing couldn't work with encryption.)

At the very least, I can confirm that ProtonMail and Apple's Mail clients let you search through the message contents of encrypted email. I'm sure there's a performance hit, and admins wouldn't be able to search through the encrypted emails of their Workspace users, but that's a much more reasonable tradeoff.

I'd be interested to know the implementation... Most search-over-encrypted-documents implementations either don't scale well (eg. require the client to do all the indexing and upload the encrypted index), or have reduced privacy (allowing the server to infer which words are in which document).

> require the client to do all the indexing and upload the encrypted index

Or just require the client to do the indexing and the searching, and not upload the index anywhere.

Yep. Not sure how Apple/Proton implement it, but that's exactly what Tutanota does. https://tutanota.com/blog/posts/first-search-encrypted-data

And when you log in from a new device...? Do you now need to wait days while 1000,000 emails from the last decade are all downloaded and indexed?

That's an issue with or without client-side encryption. Even with IMAP, you have to download the message before its contents can be searched. While subject/sender/recipient can be searched instantly with IMAP, regardless of encryption.

This is a limitation of your client or server. Not IMAP.

No, it's a limitation by IMAP that is rectified by the server/client.

IMAP's SEARCH TEXT command is at least 35 years old.[1]

[1] https://datatracker.ietf.org/doc/html/rfc1064

Maybe if you have that many emails and 3G only and can't load a backup for some reason.

It's more of an issue that people have to interact with vendors outside their direct ecosystem, who maintain different email systems. I can have all the PKI infrastructure I want, if my contracting officer has to coordinate payment of a $10M or $100M deliverable with a foreign company with different laws around encryption, I may have no choice but to send some things unencrypted until we can mutually agree on certain processes.

Yeah, It's understandable that they would use this as a differentiator, but in reality, we all gain when encryption is rolled out more broadly.

Who is "we" in this context?

Not surprising, the main point of gmail is vacuuming up all that sweet, sweet email data.

I will just repeat over and over again, that is absolutely not true. Your email data is not used for ad targeting, search personalization, or anything else. Nothing inside of Google Workspace - drive, docs, sheets, slides, chat, gmail, keep, etc. is used for any purpose outside of workspace.

Source: worked on workspace for years

What about Google Purchases reading my Amazon receipts?

https://www.cnbc.com/2019/05/17/google-gmail-tracks-purchase...

Now my Amazon emails are neutered.

Thanks.

He specifically said Google Workspace which is the non-free version of the Google suite.

This applies to the paid and free versions equally

FTA: "We don’t use any information from your Gmail messages to serve you ads, and that includes the email receipts and confirmations shown on the Purchase page"

Other companies like unroll.me, however, were absolutely data mining your receipts and then selling the results.

It makes me happy to know that most people think Google abuses their emails, and you have to fight a frustrating uphill battle to convince them otherwise. :)

Google isn't monetizing my email contents? I have to admit I'm skeptical but if that's the case I can't imagine that staying true forever. What incentive does google have to run Gmail then? How does Gmail make money?

Two ways I can see as an outsider: 1. Google Drive/One/whatever subscriptions to pay for more storage if you want to keep your old emails/files in their cloud. 2. Keeping people signed into their Google account for email could make them easier to track as they're also identified/signed in elsewhere on the web.

Gmail runs ads in the consumer version, but the ads are powered by the search and activity elsewhere.

But also workspace more broadly wants people to use Gmail in their personal lives so they want to use it at work, which then is a paid business.

Similar to Microsoft 365 - you need a higher end subscription there too.