If you click the "learn more" in gmail it says that ^. Gmail seems pretty upfront about what "confidentiality mode" does.
Even this is really poorly worded. You don't need a "malicious" program on your computer, you just need to go to your browser menu and hit the print button.
This still makes it sound like the average user won't be able to save your email unless they're doing some kind of tech mumbo-jumbo -- that your real risk is if an IT person gets a hold of it. But printing or saving a web page are basically the first thing I would teach anyone to do if I were mentoring them on how to use a computer.
Probably every secretary in your office already knows how to get around this restriction.
Doesn't seem to be that easy. You're probably not going to get a copy without taking a screenshot, opening up developer tools or digging into your browser's cache.
Assuming you don't want to save the HTML page, you still might not even need to download a separate program to screenshot it. New installs of Firefox just have a button on the toolbar labeled, "Take a Screenshot". It'll grab the entire page without forcing you to do any scrolling, and doesn't require you to know anything about HTML. I tested, and it bypasses all of the security features on confidential emails.
People are arguing that this is designed to prevent accidental sharing, which is a really good point that I think I agree with overall. However, HN is a tech site and I'm seeing comments that say the only way you could beat this is to dig into your developer tools.
If a nontrivial portion of HN users think this service is more secure than it actually is, how much more uninformed are ordinary users? Saving a web page is not going to be a difficult problem for most people in your office to solve. So my objection here would be, Google isn't doing a good enough job of informing even tech-literate people of just how easy this is to circumvent.
A CEO is going to look at this and think, "well, I guess they're doing voodoo magic so most people in my office won't be able to share." The reality is, pretty much anyone in your office who wants to be able to beat this will be able to figure out how to do so.
Saving the webpage itself works fine though -- which again, is a browser feature your secretary probably knows about and is comfortable using.
I guess my objection to the idea that this is just removing deniability is that it really doesn't feel to me like it's being marketed that way. I wouldn't call a service like this "confidential mode", I would call it something like "auto-delete mode". Maybe I'm just arguing over semantics though.
Also, I can think of a lot of ways to bypass the “confidentiality” settings that require no malware whatsoever. Not only is their giant asterisk hidden, it’s wildly inaccurate and misleading.
I guess me exercising my right to do whatever I want with my bits on my computer is me having "malicious programs". What in the actual fsck.
Recipients who do not have malicious programs on their computer also may still be able to copy or download your messages or attachments.
Although on further consideration, my previous comment may actually be wrong: "malicious programs" includes ones that attempt to violate the user's right to copy, and recipients who do not have the malicious program Gmail on their computer might not be able to copy or download your messages or attachments.