Slashdot Mirror
Does Gmail's 'Confidential Mode' Go Far Enough? (engadget.com)
Last month, Gmail's big redesign became default for everyone, changing up the aesthetic appearance of the email service and introducing several new features. One of the key features, Confidential Mode, lets you add an "expiration date" and passcode to emails either in the web interface or via SMS, but not everyone is so trusting of its ability to keep your private data secure. "Recipients of these confidential emails won't be able to copy, paste, download, print or forward the message, and attachments will be disabled," notes Engadget.
The Electronic Frontier Foundation (EFF) doesn't think this new mode is secure at all. It's not encrypted end-to-end, so Google could read your messages in transit, and the expiring messages do not disappear from your Sent mail, which means they are retrievable. What's more is that if you use an SMS passcode, you might need to give Google your recipient's phone number. Because of these reasons, Slashdot reader shanen doesn't believe the new feature goes far enough to secure your data. They write: [M]y initial reaction is that I now need a new feature for Gmail. I want an option to reject incoming email from any person who wants to use confidential mode to communicate with me. Whatever conspiracy you are trying to hide, I'm not interested. So can anyone convince me you have a legitimate need for confidential mode? The main features I still want are completely different. Easiest one to describe would be future delivery of email, preferably combined with a tickler system.
The Electronic Frontier Foundation (EFF) doesn't think this new mode is secure at all. It's not encrypted end-to-end, so Google could read your messages in transit, and the expiring messages do not disappear from your Sent mail, which means they are retrievable. What's more is that if you use an SMS passcode, you might need to give Google your recipient's phone number. Because of these reasons, Slashdot reader shanen doesn't believe the new feature goes far enough to secure your data. They write: [M]y initial reaction is that I now need a new feature for Gmail. I want an option to reject incoming email from any person who wants to use confidential mode to communicate with me. Whatever conspiracy you are trying to hide, I'm not interested. So can anyone convince me you have a legitimate need for confidential mode? The main features I still want are completely different. Easiest one to describe would be future delivery of email, preferably combined with a tickler system.
How does it stop someone from taking a photo of your displayed e-mail with another device? Even if it somehow stops me taking a screenshot, there's no way from keeping me from taking a shot of the screen.
Sounds like privacy-theater to me.
Our reign has gone on long enough. Indeed. Summon the meteors.
Every other secure mail service or add-on of which I am aware, Lavabit, Protonmail, PGP add-ons, etc., regard encryption is the very foundation of private email.
Without that there really is no security that really matters.
Starships were meant to fly, Hands up and touch the sky - Nicky Minaj
This is utterly ridiculous bullshit. As long as you can do a screen capture or simply photograph the screen, the recipient can create a record of the email. "Confidential emails" my ass.
I've fallen off your lawn, and I can't get up.
Hillary and her staff wish they had that feature. And regarding the sent folder, last I checked you can delete emails in there. And of course wipe you local HD, smash you smartphone.
>google
>confidential
right, and facebook values your privacy, too
The "confidential" mode only prevent someone who stole your unlocked phone from reading those particular messages.
The contents of your messages is available to Google and U.S. intelligence services for years, and the metrics collected from the messages will be stored and available forever.
This doesn't apply to just your gmail account, but every single account added to the GMail app, because that's how it's built, to collect information on you.
Don't think for second that you have private communication when you use Google's apps or services.
How are you going to complain about a fee service? Don't use it if you have a problem with the features.
Only the State obtains its revenue by coercion. - Murray Rothbard
There are real tangible benefits to running a private email server if you are looking for more privacy for your email.
That is, unless you are in a government job.
If something can be read with the bare human eyes, it can be copied, pasted, downloaded, printed and forwarded because it can be as easily captured by any digital camera, OCR'ed and reused any way you want. From the look of it Google's implementation and wording are clearly a sham or meant for hillbillies.
Protonmail fares much better in this regard (real encryption and self-destruction beyond the expiration date) and they don't claim your recipient will not able to download or copy your message.
Every time I've received an encrypted email, I have regretted reading it. In general, the person who was really paranoid about people reading his email was really paranoid in general. So, years ago I made it my personal policy to reject them.
Bruce Perens.
Eh?
Actually? The reason she "got away with it" (wasn't prosecuted) was because hundreds and in fact thousands of other similarly positioned officials also did, including Jeb Bush, Colin Powell, and...
https://www.nytimes.com/2017/09/25/us/politics/private-email-trump-kushner-bannon.html
Geekmux doesn't understand the difference between this and general IP encryption? Wow.
Is it that hard to conceive?
Any electronic communication is intrinsically unsuitable.
On either end there needs to be a moment when the information is plain text readable, thus copyable, thus insecure.
If I can gain control of your end device, I can read it.
Even DHT (and similar) are unsuitable for the same reasons. Maybe you get "in transit" confidentiality. But just that.
You'd better meet your correspondent in a crowded and noisy place, change position frequently and talk by whispers while covering your mouth. And maybe you'll get private communication.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
It's like retrograding from proper OS-integrated IMAPS to ... AOL mail.
Only people who can't tell their browser from the OS, act like that.
(Then again, neither can Google and Mozilla. And Microsoft insisted in front of court, that it was the same thing. So how is the average retard out there supposed to know better?)
Actually? The reason she "got away with it" (wasn't prosecuted) was because hundreds and in fact thousands of other similarly positioned officials also did, including Jeb Bush, Colin Powell, and... https://www.nytimes.com/2017/0...
Rules for using a personal email server are well-established, as are the rules for sending classified data.
She got away with it because she destroyed evidence of the latter, which should have been plenty to prosecute.
Also, let's be realistic. She got away with it because Bill "Tarmac" Clinton stepped in.
If you don't trust the recipient, don't send them the data in the first place.
I really don't understand the use case of this retarded thing.
... anything other than confidential.
Wether Googles "confidentiality mode" is sufficient or not is to a larger extent probably a very silly question to ask, IMHO.
We suffer more in our imagination than in reality. - Seneca
Ahhh i see google is getting ready for the next crop of democrat politicians!
Mostly wishing I had a mod point to give you [gweihir], but largely for your signature. So far most of the comments seem to be completely missing the point, make that ANY point, of the topic, but at least the confusion about email security is a real concern. I'm not sure I should confess to being the source of the quote at the top... That would make me largely liable for the misdirection of the discussion?
Let me try to clarify the distinction here. Private communication is fine. I don't think you can convince me that the entire world is entitled to know every communication between everyone (though that seems to be where email and smartphones are leading us because of legalized governmental intrusions). To secure those private communications, encryption is quite reasonable as one of the solutions.
This "confidential mode" thing is going farther. It is an attempt (which is already doomed to failure) to allow people to impose (fake) privacy on OTHER people. So far I am unable to imagine a legitimate purpose for this tool. The main goal is to support lies. "I never said that and the email that proves I said it no longer exists." That just led me to realize that spammers will probably be the most enthusiastic users of this mis-feature.
There is an obvious solution: I pledge to take an immediate screen shot of any confidential-mode email that I receive. If it's interesting enough, then I promise to publish that image in the most embarrassing and most public places I can find. If many people adopt similar pledges, then no one should EVER send me any confidential-mode email. Maybe it isn't too late to abort this sickness?
My initial reaction was I don't want it and I do not even want to receive it. I'm still reading this discussion to see if anyone can defend this feature. Hain't seen nothing yet.
I really think this is a big opportunity for one of the less evil players. If they offer me an email system where I can automatically reject all confidential-mode email, that might be a strong enough inducement to get me to abandon Gmail.
Now the larger question is about the dynamics of evil that have driven the google to ram this feature down our throats, but I'm going to reduce that part to "The google has become a corporate cancer dedicated to the worship of the false gawd profit." Your mileage may vary.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Your Google(TM) DRM compatible phone-camera would have a "do not record" subchannel which picks up a high frequency signal indicating that it should not record the scene.
The subchannel is inserted by the hardware similar to HDCP. Only signed, compliant software with a guarantee from the hardware would be able to read and render the content.
Well, that's the future anyway. Where nobody has analog cameras, and dedicated digital cameras are barely a thing anymore.
This is a good step in the right direction, but I wouldn't trust it 100%, it only prevents casual users from saving the message. The only real issue afaict, does it prevent the other person from downloading it via pop3/imap
You again? I think I've already addressed some of your points in the longer reply above, but here I want to rehash the problem with the private email thing...
Most people do not want to spend the time required to setup and maintain their own email server. It's actually a different kind of network effect. I've already addressed (though it was in a reply not addressed to you) the network effect of more users, which is why Gmail seems valuable to the google in the first place. However the private email server is a kind of dual of the small network effect having high overhead.
And unless you configure your private email server to reject all confidential-mode email (or unless you take my pledge), then you're still vulnerable to what I perceive as the main threat of this sick and unwanted confidential-mode feature. Strangers can use it to try to ram their secrets down your throat.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Thanks for all the neat new features, Google! but you missed one: How do I keep my email confidential from you? The only solution I see is to not use your service.
Thanks again!
As one of one of the instigators of this discussion, I'm kind of disappointed... So let me try to summarize.
There seems to be an extremely strong consensus that confidential mode is a bad idea badly implemented. I would go farther and count it as more evidence of the increasing badness and evil of the google, but there wasn't much discussion along such lines and assigning the blame doesn't matter too much anyway. This is a bad feature that keeps rising from the grave like any good zombie.
I was unable to detect (in this discussion or anywhere else) any good reasons for this feature. Absence of evidence is not proof of absence, but if anyone does have a good reason for confidential mode email, then I hope you will share it. I'll continue searching the discussion (until it expires in a day or two), but obviously I'd be more likely to find your "good reason" if you reply to this comment...
My first suggested solution was a way to reject incoming confidential-mode email. Some people seem to agree that would be good, but no one (whose comments I found here on Slashdot) actually pointed at a way to do it or at a way to persuade the google to give us that option. I would also count it as a solution if someone knew of and told me about a full-featured email system with the option (and I even consider this feature bad enough to justify the large effort of leaving Gmail).
My second proposed solution is a sabotage pledge to subvert the intended confidentiality of any such email I do receive. Again, no local support, but now I wonder if it matters. I've realized that this feature may be doomed to disaster. Some people are going to take those obvious pictures of the confidential-mode email, and at some point the google is going to get dragged into a hefty lawsuit that may help the google realize the error of its ways. Kind of a shame that #PresidentTweety doesn't use Gmail, but I hope this feature persuades him to start. (Since the orange topic came up, I can't resist a link to this hilarious new music video and tribute to Aretha Franklin: https://www.youtube.com/watch?...)
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Easy to use GUI:
By easy I mean totally automatic. They literally want an algorithm capable of reading their minds and knowing which should be secure and which do not need it. Clicking the encrypt this button is "too difficult to remember". It will need to be all encrypted all the time and that's a usability/compatibility issue.
Key management:
I have to what? Ain't nobody got time for that. Fuck that shit!
Compatibility:
After a decade, there are still issues with iPhones/(Macs?) unable to read TNEF(win.dat) attachments from Outlook/Exchange/O365 FFS. All the different secure email systems/protocols are a fucking mess and NO ONE is interested in dealing with them. Right now dead drops(email bodies and attachments on a secure web server) seem to offer the greatest compatibility.
Nobody Gives A Fuck: Literally, nobody gives a flying fuck. At least not until they lose actual money from their account. To this day people, lawyers, real estate professionals, large corporations, including Ingram Micro, send and request social security numbers, bank account and credit card numbers via email. They don;t even password protect it in a Word or PDF document, they put it right there in the HTML/TEXT body for all the world to see/scrape and nobody gives a fuck.
So long as nobody cares about encrypted email, nobody will inconvenience themselves to send/read it.
Actually in the case of public figures, I'm still advocating for "celebrity" email. I think of it as a kind of mailbot for the dual of the spammer problem. Spam is a horde of fake senders with fake messages, whereas a public figure may face a horde of real people with real messages.
As it might work in your case, the incoming email would be parsed searching for obvious topics and even the sender's sentiments about those topics. That analysis would be bounced back to the sender as a webform for confirmation of the analysis (and to foil the spammers). What happens next should mostly be under the control of the public figure. For example, one option would be to focus on collecting summary statistics, while another public figure might want to make it easy to escalate the email to human attention. Obvious topics might be routed to FAQs or even Wikipedia.
I think it would be especially interesting to allow options for website publishing of the email. The idea would be to encourage people to share their email with each other based on their shared interest in the public figure and the topic of their email. Essentially leverage their relatively abundant time against each other to conserve the limited time of the public figure... It would also be natural to focus on escalating active discussions to the attention of the public figure.
However these are NOT the features you are looking for (in Gmail). And no one even asked about the tickler feature...
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
By the way, I'm just finishing the book Phishing and Countermeasures by Jakobsson and Myers. About 30 pages left out of 700, and largely concerned with email and the security thereof. And pretty much obsolete before the ink dried, but I needed some light summer reading. Why mention it? Partly for the cred claim, but upon reflection I think it's mostly to ask for a more up-to-date reference... I think you're still at the leading edge of these things, so...
How do you keep up?
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
If it doesn't protect you from Google themselves, then no, no it does not.
Since when did CenturyLink change it's name to Google?
This could only be more ironic if it were Yayhoo doing it.
Warning: This signature may offend some viewers.
... or better put - doesn't even come close to the stuff that ensures privacy and anonymity, as opposed to, say, the many good suggestions in the great Intercept's tutorial for anonymous sources.
This makes you wonder if Google purposely created such a feature at the request of US authorities, in order to trick unsuspecting whistleblowers (and yes, criminals too) into a system that is already compromised and gagged by default. The OP does raise a relevant problem - we need a feature to prevent retieval, hell, even sending of such emails, because we might simply not want people to expose themselves trying to tell us something relevant. For now it seems that option is not using your gmail address at all as a public contact...
Maybe that is the point. Make this a GMail only feature. Only works to SEND to a known GMail account, perhaps with a bit of encryption and key held by Google.
Most Android users already use GMail. GMail is growing in corporates, together with Microsoft. Google could probably do a deal with Apple.
Email is the one that got away. Not controlled by any one centeralized authority, or maybe 3. Maybe this is one step in the move to rail that in. EMail should be single server based and controlled, just like Facebook Messenger.
"Gmail" and "confidential" are in the same sentence. LOL. That's funny.
I know you're being tongue in cheek and I might even give you the funny mod point if I ever got one to give, but you managed to hit another interesting note...
If I were a nosy and intrusive government agency with a FISA court to appeal to, I would go for a blanket warrant on this feature, starting with a less intrusive meta-information version. "We don't wont to look at their email yet, but we just want to know who is using this feature so we can check the names against our other lists to see if any of them merit special attention. By the way, we want the google to be required to keep copies of all of the confidential-mode email until we decide whether or not we need to see it. Think of the children and the terrorists!"
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
...it will be deleted without being read.
If you are trying to threaten me using this, I'll take a photo of the screen and give it to the police.
Stupid, ultra-retarded idea.
After 8 years of using Gmail for everything I'm finally sucking up the pain and moving to a new provider. It's got nothing to do with confidential mode but more to do with the fact that if I look at my Google account activity I can see pretty much everything I've been doing at home, work, and on my mobile.
Call me a luddite but I don't want to trust a single company, it's employees,and the people it sells data to with my whole life. Google has a company culture of "don't be evil" but twice within the last year the Googlers have revolted against shady decisions taken by upper management. Google started assisting the American government build weapons and also started to build a "pro-censorship anti-human-rights" search engine in China. I'm not convinced that the insanely rich people at the top of Google really care about my well-being.
Until Google offers Gmail as something where I'm not the product that they're selling on to the highest bidder (on Adwords or wherever) then I'm not prepared to use it. If they offered something in the same price range as Protonmail where Google didn't collect my personal information and add it to my profile that they then share with the American drone program and equally evil faceless corporates I'm going to suck up the pain and migrate.
Anyone sending me so called confidential mode email gets their mail dropped. If your server (mine is fastmail) supports sieve code - if exists "X-Gm-Locker" {reject "Google confidential mode emails are automatically rejected at this email address"; }