Google is Testing Self-Destructing Emails in New Gmail (techcrunch.com)

The upcoming update to Gmail might include a feature which would allow users to send emails that expire after a user-defined period of time. From a report: Working on an email service is hard as you have to be compatible with all sorts of email providers and email clients. But it doesn't seem to be stopping Google as the company is now evolving beyond the simple POP3/IMAP/SMTP protocols. Based on those screenshots, expiring emails work pretty much like expiring emails in ProtonMail. After some time, the email becomes unreadable. In the compose screen, there's a tiny lock icon called "confidential mode." It says that the recipient won't be able to forward email content, copy and paste, download or print the email.

Comments

O rly?

[Anonymous Coward]

I receive data on my computer. It is then uncrypted and displayed on my screen. Ergo, stored in clear in RAM. What prevents me from finding a way to copy-paste this data?

Re:O rly?

[MightyYar]

Nothing - it's not for you or any other thinking person. It's meant for the same people who use the other insanely popular "self-destructing" message apps. They undoubtedly know it is stupid, but ultimately they need to compete with stupid.

Re:O rly?

[ctilsie242]

I also receive data. The E-mail message gets read, and auto-archived on my encrypted IMAP server VM. Unless Google changes IMAP to have expiration dates and forces Dovecot to respect that, the message is going to remain.

Usually I see two ways of having disappearing E-mail work. One is that the E-mail stays with the provider. This works, but once a protocol like IMAP, POP, or another snarfs the E-mail and copies/moves it, that protection is useless. Another way is requiring a special extension, be it a web app, or the content only viewable in some specific program. That also works, but in the age of ransomware, who trusts running a content viewer?

Re: O rly?

[Anonymous Coward]

Then it would have to eliminate every other worldwide email provider.

They're making strong inroads into just that.

Re:O rly?

[AvitarX]

Or, they could prevent you from sending them to non Google servers, or they could convert the email into a link as soon as it leaves Google (this could even be true for people receiving their Google mail via POP3 or IMAP). The link could be forwarded, but break in x number of days. And they could enforce whatever nonsense in a browser visiting that link.

None of this is to say it isn't stupid, simply that it's a pretty easy thing to do to force browser viewing of the email, no matter where it goes.

I highly doubt they'll be able to effectively block printing and copy paste from a web browser.

Re:O rly?

[goose-incarnated]

I also receive data. The E-mail message gets read, and auto-archived on my encrypted IMAP server VM. Unless Google changes IMAP to have expiration dates and forces Dovecot to respect that, the message is going to remain.

Usually I see two ways of having disappearing E-mail work. One is that the E-mail stays with the provider. This works, but once a protocol like IMAP, POP, or another snarfs the E-mail and copies/moves it, that protection is useless. Another way is requiring a special extension, be it a web app, or the content only viewable in some specific program. That also works, but in the age of ransomware, who trusts running a content viewer?

I use IMAP to read gmail. I'm probably not the only one. They would have to disable IMAP/POP for those messages. Then they would have to enforce gmail usage via their chrome browser only so that they can lock down the copy-n-paste hole.

Ultimately it becomes a proprietary message reader that can also read emails and surf the web (approved content only)! Once the a monopoly is achieved they can introduce foolproof google-only DRM into their browser.

The DRM won't be used for Hollywood releases, it will be used to detect wrongthink.

Of course proprietary email standards never took off before, so there is not reason to be afraid that it will take off now.

Re:O rly?

[sexconker]

If you're using Gmail you'll see it.
Otherwise you'll get an email with a link. The link takes you to Google Docs to view the shit.

Re:O rly?

[taustin]

If I can read it, I can copy it. The only way to keep me from copying an email is to keep me from reading it.

Re:O rly?

[aaarrrgggh]

But there is no way to plug the analog hole. You can still take a screenshot... it might need to be from another device, but it is there.

But, one thing works in its favor-- verification. If I have a screenshot of a document there is no way for me to prove its authenticity. Without some kind of verification means, much information loses its value.

Re:O rly?

[cstacy]

And they could enforce whatever nonsense in a browser visiting that link.

This means that mail reading apps need a new feature: auto-archive linked web content. When a message includes an (e.g. unlikely trivial IMG self-destruct implementation) link, and you have enabled (for this message, or for the domain) Show Web Content, then in addition to showing the content, you save it. If the pixels appear in your browser (or email app that includes a browser, like most do), then you can save them for yourself. Depending on how they write the Javascript, it might be less straightforward to analyze to get the desired content. (In the worse case, if it's in my video frame buffer...) But at the end of whatever nonsense Google (or whoever) comes up with, there is visible content such as an image. And there is no way to stop that from being automatically copied and conveniently saved as part of the message.

If I was making this feature in the app, I would automatically save the content the first time, along with retrieval metadata. That metadata could include the entire page contents (that is, the Javascipt and everything, not just all the downloaded pixels). This would then be hashed. On subsequent viewings of the message, I would compare the hash to see if I need to download another version. Message presentation would then include an indication that this was saved content, and indicate whether it had changed. Options on the message include: Always Show Original vs. Show Latest Content. Either way, the message presentation shows what's going on and let's you click to see other versions that you've captured.

Some people would like to see the latest content, presumably a little picture of a charred envelop and the words "Message self-destructed after reading on 4/1/2018 01:02:03 EDT". There could even be a setting in the app to disable offering by default the historical versions. Or even settings to disable capturing the initial version (or later versions, or more than x number of versions, etc.) For those who like to go along with the self-destruct fantasy.

There are security issues associated with this, most of which should already be addressed by existing apps, since people send HTML mail all the time. Basically what's going on is that every time you retrieve the message, you are downloading a new virus. And every time you display it you are executing potential malware (even if it's just showing you a captured JPEG, it could be a crafted one). General security principles should take care of stateful tactics based on having downloaded previous versions, but that's something to think about since you've now introduced thises new data store features into the app.

Re:O rly?

[o_ferguson]

Conversely, once this "feature" is poplar, you can just produce a "screenshot" of whatever shit you want, and then claim it was sent as an "expiring email." No need to prove it was actually sent anymore. Anyone who uses "expiring email" willingly opens themselves up to whatever fakes other people desire to produce.

Re:O rly?

[skids]

Without some kind of verification means, much information loses its value.

Trusted timestamping the screenshot is probably better proof even than having it in your inbox, as there's no telling how easy forgeries are to send through the system on a closed source SaaS.

Re:O rly?

[93 Escort Wagon]

But, one thing works in its favor-- verification. If I have a screenshot of a document there is no way for me to prove its authenticity. Without some kind of verification means, much information loses it's value.

Unless the email trail is 100% through Google's servers (and probably even then), it will contain headers which allow tracking of the email across the servers which have handled it. So I would think you could "Show Original", then save that as a PDF or take a screenshot, and be able to verify the veracity of your copy.

That said - I generally use IMAP (via an application like Apple Mail or Thunderbird) to check my work mail, which is Google apps-based. Should I start getting messages that say something like "you must click on this link to view this email", I will either ignore the message as spam or respond to the sender telling them why I am not going to click on a link which purports to show me an email message. But I can't believe the bright minds at Google would be stupid enough to not see the problems in doing something like that (/snark)...

Re:O rly?

[93 Escort Wagon]

If you're using Gmail you'll see it.
Otherwise you'll get an email with a link. The link takes you to Google Docs to view the shit.

We've spent the last decade or so training users never to click on links in emails. This seems like a good reason to double down on that practice.

Screenshot...

[b0s0z0ku]

So easy to take a screenshot. Also, it's ultimately up to the browser whether to enable copy/paste or not.

Re:Screenshot...

[Joce640k]

Screenshots would never be admissible as evidence.

Re:Screenshot...

[MobyDisk]

FYI: Just because something can be doctored does not mean it is not permitted as evidence. The most common form of evidence is witness testimony, which is inaccurate, easily altered, and degrades over time.

Re:Screenshot...

[alvinrod]

Assuming it weren't, it wouldn't be too much more difficult to take a video of the entire process of opening the email. Even better if as you take that video it is uploaded some some cloud service that time stamps everything as well. At some point you've got evidence that is every bit as good as the email itself and if you won't accept that, then what good would the actual email do as evidence?

Re: Screenshot...

[aviators99]

Can someone point me to a reference that states that GMail keeps messages more than a month after deletion, as AC parent says?

Re:Screenshot...

[nine-times]

I think that misses the point somewhat. The purpose isn't to necessarily to prevent the recipient from having continued access to the information if they want it. The point is to prevent the recipient from leaving the message in their inbox out of carelessness.

It's not uncommon for someone's email account to be compromised, and then the attacker might have access to every email ever sent or received from the account. If you "expire" emails after some period of time, it lowers the risk that those emails will be compromised during that kind of attack.

Re: Screenshot...

[Anonymous Coward]

Itâ(TM)s called the Investigatory Powers Act in the UK and itâ(TM)s actually 1 years retention of data for all national level or international level companies. Small, local companies donâ(TM)t have to comply. GPs claim of 7 years is based on the older Regulatory Investigative Powers from 2000-2016.

It applies to data and service providers so for the ISP itâ(TM)s web history, email, phone calls. For data and service providers its all data and meta data.

Itâ(TM)s a horrible piece of legislation and currently being fought in the UK courts by many parties. In the Mainland EU they are trying to pretend that they disagree with the UK at EU parliament level but have the same data collection program only itâ(TM)s classified in the EU so nobody talks about it. In the UK people in the know are raging but the general public have no idea.

The US is no better, infact the UK collects extra data in conjunction with the US as part of the US Prism Program

I work with these systems every day, I work digital forensics with a large police county. You donâ(TM)t even have to be law enforcement to get access, your kids school can request access, your doctor can request access, pretty much anyone in a public service job can request your web and email history.

First google link in search: https://www.theguardian.com/law/2015/oct/30/telecoms-companies-to-retain-browsing-data-under-new-law

Some of the Agencies that can access collected data:
https://www.independent.co.uk/life-style/gadgets-and-tech/news/investigatory-powers-bill-act-snoopers-charter-browsing-history-what-does-it-mean-a7436251.html

Re: Screenshot...

[Anonymous Coward]

google doesn't delete anything. EVER. deleted emails? nope. dmca'd search results? nope. removed youtube videos? nope. nothing. ever. gets. deleted.

you don't need a reference to cite. they can't make money off anything that's been deleted. they can't have their treasure trove of data that makes TLAs and competitors drool, with deleted data.

Re:Screenshot...

[Ol Olsoc]

Screenshots would never be admissible as evidence.

If a text email is allowed, but not an image, it would be allowing a lesser secure mode as legit.

I can alter a text message with no problem at all. I'm good at photoshopping too, but would almost certainly leave some evidence that I altered an image.

Re:Screenshot...

[tlhIngan]

Also, it's ultimately up to the browser whether to enable copy/paste or not.

And I know Firefox lets you bypass those blocks by holding the Shift key and right-clicking. (This stops Javascript execution of the right-click event, so the regular right-click Firefox menu will display with all the normal options).

I assume other browsers have similar features to bypass Javascript.

Re:Screenshot...

[Anonymous Coward]

As a real lawyer, I use screenshots all the time. Usually, I use them with text messages and Facebook posts, but I could see it working here too. The courts I am in front of allow screenshots because a lot of time, they are the only evidence available in a way accessible to the Court. The thinking of the courts is that you want the best evidence available to be what is admitted. If you don't have the better evidence but have a good reason why, they will let you do so.

You cannot haul your cell phone provider in front of the court for every little dispute, nor can you bring Apple, or Facebook, so they let in screenshots. In the case of emails, they prefer printouts with full headers but not everyone knows that so in small claims, they will allow lesser evidence in.

In this case, because the email, by its nature, destroys itself, screenshots are all that would remain of said email. Therefore, the best evidence available to a party is the screenshot, so if the disagreement is about the content of the message, then screenshots will almost have to be admitted if the actual content is in dispute. No better evidence + Good reason why == admissible evidence. Of course, all this assumes there are no other objections to the evidence (relevance, hearsay, privilege, etc.).

Extensions?

[hcs_$reboot]

Not long before a bunch of extensions are released to automatically save a copy of all these "self destructive" emails...

DRM for emails?

[TimMD909]

DRM for emails? Do not want.

Snapchat, LAWL

[nctritech]

It's Snapchat for email. Snapchat is stupid. This is stupid. *takes screenshot*

Re:Confused

[Anonymous Coward]

It's perfectly consistent.

The email are 'self-destructing' only from the user's perspective. Google can still read them.

Re:Confused

[Brett Buck]

Google and its customers (hint: you are NOT the customer) will still have full access, only users will be inconvenienced.

the further proprietization of email.

[nimbius]

self-destructing, secured, or even recall-able messages have been the hallmark of feature sets demanded by users without so much as a cursory understanding of email. Since most of human civilization uses GMail im sure the hubris of google rides high in testing this new "feature" but for power users or those outside the domain of the big G, this is feature is as useless as 'do not track.'

mash away at self destruct all you like. Once the message leaves your Google mailserver and enters my Postfix, its mine.

Re:the further proprietization of email.

[Dr. Evil]

Embrace, extend, extinguish.

Remember to use takeout.google.com to get your mbox before you shut down your gmail.

I’m so sick of these ‘free’ accounts.

Embrace, extend, and extinguish?

[mi]

the company is now evolving beyond the simple POP3/IMAP/SMTP protocols

I find this rather worrying for the future of e-mail...

Translation provided

[Chris Mattern]

"the company is now evolving beyond the simple POP3/IMAP/SMTP protocols."

Translation: "Those leave complete control of the recipients mailboxes in the hands of the recipient. We can't have that."

Works how I expect - with a Google link

[m.w.hurley]

Did anybody read the article? Funny I know. Looks like it will work like our company's secure email used internally for PHI. When I get a secure email I get a link to the secure email system. If you're a gmail user, Google will magically make it load like a regular email. If you're running your own email server or are otherwise outside gmail, all you'll have in your system is the link.
Yes you can work around it with a screenshot or copy/paste. But the act of running your own system will not magically make it be in your system unless you do something manually like that. Maybe some wget shenanigans.
I wonder how doing that will play out with various computer usage laws in place in US or elsewhere. Same for that proton mail I saw mentioned in the article. Sure the data's in your system, but if you're told up front that you're not allowed to store it outside of their system, would that be breaking the law? Or how could it play out during e-discovery if one of these manually saved emails is found after the expiration date? So maybe not only could you be "violating" Google's access policy, but would you also "violate" the Google user who sent the message?

Mission: IMPOSSIBLE

[p51d007]

Will it come with the (tv version) Mission: Impossible guy saying this tape will self destruct in 5 seconds...Good luck Jim!

Too many idiots in this thread

[Chameleon Man]

You all think you're so smart saying "Lol, I can copy/paste or screenshot it!". That's not the point, dummies! Say you want to send someone some info you don't want hanging around in their inbox. They get it, use the info to access...whatever...and then you get assured that they don't just hoard that email. If a user's email is compromised, it's just a house of cards as they can easily skim through and see all the services you're signed up for and reset passwords to those, including banking, credit cards, etc. It's advised to keep your inbox clean to prevent stuff like this from happening, at least now companies that send out the emails will have some control over this.

Exactly

[fyngyrz]

If I can read it, I can copy it. The only way to keep me from copying an email is to keep me from reading it.

Yep. No matter what they do, there's always screen-capture, and if not at some point in the future with the OS (Windows and OSX and Linux can all do this at present), then with a camera; your phone or a DSLR or an HD video camera, etc.

If it's ever readable, it's readable forever if anyone who can read it wants it to be. End of story.