Hacker News Reader

2) Your employees are reasonable, and won't try to maliciously bypass security controls

Corollary: unless those controls impede their ability to do their jobs. This goes into a bit of UX design thinking, where you have structure your security controls to be minimally invasive or invisible, if not complementary to the business' operations.

>That's all this is. And for 95% of corporate applications, that's good enough. If you have high-level executive crime, or a scandal where you killed a few people, this won't help, of course. But if you'd like to keep an upcoming merger confidential, or maintain a trade secret, or anything vaguely normal, this is more than good enough.

Kind of. Partly you only get there by having a company culture where people value this sort of thing. Company cultures where everyone is out for themselves are likely to see worse compliance. But a company like Apple, which is famously secretive, are likely to do better. On the other hand, even Apple employees screw up in some pretty boneheaded ways, like that time a dude left a prototype iPhone in a bar that would up getting sold to Gizmodo.

No, these records will remain discoverable through Vault, unless I'm reading things wrong.

In fact, these records will be even more discoverable than the standard inbox dumps because they're pre-curated with messages that the senders thought were sensitive.

It appears the only point where there's an extra hoop to jump through is with an external sender. In cases where that sender is in another jurisdiction or the investigation is purely internal, the added cost will likely stop further inquiry.

I can see legal departments requesting filters to block acceptance of external messages as a result. Just takes the metadata from one confidential email a competitor sends you to make it look like you're a bad colluding boy.

Agreed, this almost seems geared towards enhancing spying in that sense.

I agree with your stance -- in a vast majority of corporate setting trying to enforce security with code tends to cause more problems than it solves. It alienates users and makes them skip sanity checks and use loopholes (whatever is allowed by the security must be OK to use). Informing users of the policy and providing tools for them to voluntarily check compliance when needed works much better.

> This also helps with email retention policies. Sometimes you want ephemeral communications you don't want a record of.

This IMO is a lost battle. Once "Sent" gets pressed you should assume the message is out in the wild (any retention policies only complicate experience and can be ignored/countered by clients). If you want ephemeral communication, pick up the phone or talk face to face. My 2c.

That only works for internal communications. Once it leaves Google's servers, you lose all control. I don't know the specifics here, but the only ways to guarantee that an email server somewhere isn't caching your emails (and I don't trust Google to not cache them either) is to either encrypt them (GPG) or require hitting your server to read the email (potentially what Google is doing), and that doesn't prevent the user from copying it (but at least you can know _who _ copied it or let it be copied).

I don't know how external access works, so maybe they're doing more than they say they are, but I don't trust my coworkers, I shouldn't trust Google either. Client-side encryption is the only acceptable solution IMO.

Pretty much anything that can be consumed (read, viewed, listened to) by a person can be recorded and retransmitted in some form. This has always been true to a certain degree of course. With everyone carrying around a recording device almost everywhere, it's even truer today.

Sneaking a photo of a screen used to at least require a certain premeditation that was spy movie stuff. Today, it's casually pulling a smartphone out of a pocket.

If anyone can see or hear somewhere, barring the seeing or hearing being confined to a secure environment it can be easily and casually recorded.

I think this is only for internal communications. They were talking about this feature being “enabled by your GSuite domain administrator.” Presumably it only works for email sent between members of the affected domain (though I’m not sure why they’d fail to mention that.)

Does that mean I then can't use a native mail client?

No. It does, definitely, work with external recipients.

Source: am googler, have used.

How? If you send an email with this on to me@protonmail.com and I download the message to my IMAP client how does google magically reach out and delete it from my hard drive? Is the email HTML only that only displays the text when the user is online and that text is fetched from the Google server? Let us say it is and I view the email, how does Google stop me from cutting and pasting that email using my thunderbird, et.al. IMAP client?

You view the message on a Google server through a browser. The message body is never actually sent to the recipient's address.

"When someone sends a confidential mode message, Gmail removes the message body and any attachments from the recipient's copy of the message. These are replaced with a link to the content. Gmail clients make the linked content appear as if it's part of the message. Third-party mail clients display a link in place of the content."

From https://support.google.com/a/answer/7684332

Thank you for explaining. Also I guess I will be able to write an auto reply message that say “Sorry, I refused to received messages of this nature.”

What happens if domains have conflicting policies set?

Camp #2 is naive and dangerous thinking if your company protects anything of value. Even if every employee is honest today, one of them can be extorted tomorrow. If you allow your employees easy access to substantial value without hard technical controls to enforce accountability then you are creating a situation where someone has reason to threaten or harm your employees.

Gas stations have "Never more than $200 in the drawer" for a reason. Criminals knowing that is the case deters most of them and if it doesn't you are out $200 at most.

As an information security analyst for an organization that deals with highly valuable info assets, I agree. The comment you replied to sounded like how employees argue for less security. They don't understand the scope or environment of information security.

95% isn't nearly secure enough. You're actually looking for the one malicious agent among thousands. If you conduct contracting bids, you have to realize that at any moment your employees can be offered incentive to leak, and their leaks will cost millions of dollars.

So when we apply our strict need to know policies and data transfer tracking, it's not about trusting individual employees. It's about finding a needle in a haystack.

>Sending an email which communicates something and disappears in a week is helpful.

There's nothing on the page that says google will purge all copies after the deletion date. I'd imagine that because google keeps backups, it'd still be available by subpoenaing google.

It explicitly said yes:

> Additionally, if your users send or receive messages in Gmail confidential mode, Vault will retain, preserve, search and export confidential mode messages. The message body of received messages will be accessible in Vault only if the sender of the message is from within your organization. Learn more about how Vault works for confidential mode messages here.

I would not read that to imply that the message is not available for discovery. Legal pressure is legal pressure, and data is very hard to delete.

I would read that as explicitly available.

Yep - It's a good and useful feature. But it's very poorly pitched. Calling it 'retention management' or something would have made it sound like the boring administrative management tool it is, rather than a magic self-destruct button.

Corporations and governments have shown remarkable fickleness when it comes to definitions of words like "reasonable" or "malicious". Everyone thinks they themselves are reasonable.

If the government comes knocking with a secret subpoena, what is "reasonable"? If someone malicious breaks in to your system, does it matter that this person isn't an employee?

For "95% of corporate applications", even plain email is good enough.

> There are two schools of thought: 1) Security has to be enforced by code

2) Your employees are reasonable, and won't try to maliciously bypass security controls

Huh? These aren't competing ideas. They're orthogonal, and should be covered by separate, complementary forms of security assurance.

Exactly. You might just forward an e-mail to someone with an action without thinking of the e-mail chain below.

But if you're taking screenshots or photos of a secure e-mail because it doesn't allow you to copy the text, you know you're doing wrong.

I’m not so sure.

I can easily imagine this system “training” users to take screenshots, especially if their correspondents are a little to eager to use this feature. It would only take a few rounds of “I sent you this”/“No you didn’t” with the boss, or the computer “eating” important documents.

Now you’ve normalized this deviance and emails are now spread all over creation (including personal devices) and in a much less searchable format....

> But if you're taking screenshots or photos of a secure e-mail because it doesn't allow you to copy the text, you know you're doing wrong.

Plenty of office workers use screenshots to copy and paste text into emails, etc., just because, so unless you first break them of this habit, using screenshots to copy secure email isn't really much of a signal of awareness of wrongness.