Gmail's confidential mode is not confidential
tutanota.com
tutanota.com
> Gmail's confidential emails are just standard emails with some extra features like unprintable, unforwardable, uncopyable, and so on. However, this will not stop anyone from taking a screenshot from the unprintable email, just to print off the screenshot.
In fact, this is literally the second paragraph in their help article on the topic[0].
The rest of the blog post is FUD and an advertisement for their E2E email product (which also doesn't protect against someone taking a screenshot or taking pictures with their phone).
Yes, Gmail does have access to the email before and after it's encrypted, and "Google has access to its users emails" is obvious; you'll have to choose who to trust, and gmail users trust Gmail to not personally go snooping through their emails. Google says very few employees have production access to data[1].
0: https://support.google.com/mail/answer/7674059
1: https://gsuite.google.com/learn-more/security/security-white...
You are just trying very hard to trivialize and cast aspersions on the very legitimate concerns raised in the article by very selectively quoting from the article.
In fact, the actual point of the article is the very real and obvious issues of privacy concerns raised and described in the beginning of the article itself:
> Though pretending to offer privacy, Gmail's confidential mode comes with three major problems:
> 1. The emails are not end-to-end encrypted.
> 2. Google retains full access to the email even when you set a self-destruct timer.
> 3. If you password-protect an email, Google can link your recipient's phone number with their email address.
Privacy aware and concerned netizens like me avoid GYM (Google, Yahoo and Microsoft) email services precisely because we do NOT want to be profiled by these corporate so that our personal data is not used by them against us.
In fact, I have made it a policy to always send password protected emails (from services like Tutanota, Protonmail, Mailfence etc.) to users of GYM email services. I do this to ensure that these services have no access to my emails and hence cannot collect data on me through it.
When some users of these services complain to me I explain to them while I have no issues with them using the service or willingly sharing their personal data with them, I refuse to consent to be profiled when I actively AVOID these companies.
I highlight this in particular so that more can be aware that "shadow profiling" of users by GYM and Facebook, all for-profit mega multi-national monopolist corporates is a genuine privacy concern and should not be lightly dismissed, and we need to raise more awareness and demand better laws to be protected against it. Till then, unfortunately, we will have to depend on valuable services like these.
-----
More on the extent Google (and others) will go to "shadow profile" someone: https://www.forbes.com/sites/joetoscano1/2019/09/03/google-h...
-----
The actual context that the quote you highlighted was said to point out something different:
> Information classified as confidential relates by definition to something very personal or top secret. It must be kept from any and every third party by all means.
> This form of secrecy can only be achieved with end-to-end encryption. Encryption guarantees that only the people holding the key to decrypt the information can gain access to it.
> This is why end-to-end encryption is an absolute necessity when communicating confidentially.
> When sending an email with Tutanota, you have the option to send a 'confidential' email - which refers to an end-to-end encrypted email, or a 'not confidential' email - which refers to a standard email.
> With this definition in mind, Gmail's confidential emails are just standard emails with some extra features like unprintable, unforwardable, uncopyable, and so on. However, this will not stop anyone from taking a screenshot from the unprintable email, just to print off the screenshot.
And I addressed the point the blog post made.
Privacy is a different concern compared to confidentiality. The HN title is "Gmail's confidential mode is not confidential", while the blog post only lightly focuses on actual confidentiality (something other email encryption services don't fix either since there are screenshots) and is largely about privacy. Sorry for mistaking what the blog post was going to primarily address based on the HN title.
But, there is a problem with the actual article in terms of what it's saying:
> Gmail as one of the major email services worldwide has realized that privacy concerns are rising constantly - and this is happening at a global scale. To meet this new demand for private and secure emails, Gmail has introduced a new feature: Confidential mode.
Um... no, it was neither created for the purpose of privacy nor security. Nowhere on the support article does it mention the words "private" or "secure", save the actual Privacy Policy footer. Privacy (in terms of Google knowing x and y about me or what's in this email) is not the same as confidentiality (preventing someone from quickly and easily forwarding the email to their friend).
Your privacy concerns are valid in every sense, but attacking confidential mode is effectively clickbait intended to get readers to buy into the encrypted email product and drop Gmail.
If wanted to send an encrypted email, I'd do my encryption and decryption client side in my own terminal. Don't ever let the service's email client get access to the plaintext.
This is like a company advertising "our product will make your car use less fuel", and all they give you is a sticker that says "less fuel!" to attach to your car. But that's OK because they didn't say "our product uses 'technology'"?
Edit: Is there a reason for the down votes? Lack of portability/ownership allows Google to change policies with less repercussions. It is because my account is new?
Yes, that's how databases work.
If we use this same logic, is Apple not being private with your data?
2. Google retains full access to the email even when you set a self-destruct timer.
3. If you password-protect an email, Google can link your recipient's phone number with their email address.
I think those are valid concerns. Don't you?
They even give those keys to Chinese government for Chinese citizens: https://www.theverge.com/2018/7/18/17587304/apple-icloud-chi...
(There is the matter of Apple's software being closed source and maybe they could push a compromising update that pushes your data to their servers without encrypting it, but that's probably a matter for another discussion.)
The reason for this is convenience: In order to encrypt something you need a key. If you derive the key from e.g. the account password, then some people will promptly forget the password. If you derive it from the device key, then people will lose or break their device. Either way, they will get mad at you when you tell them that yes, you can reset their password/key and restore access to their account, but all their backed up data will stay inaccessible. So Apple allows you to reset a password (e.g. by answering "security questions") and then you have access to some of your data again, which means Apple has to have access somehow to that data.
Apple divides the data they store into two categories: encrypted (to which Apple still has access if they want or need to) and end-to-end encrypted (to which they do not have access, so it will be gone if you lose the key): https://support.apple.com/en-us/HT202303
So e.g. your photos and videos and files in general are recoverable by you, Apple, or somebody who got a hold of your password, or managed to reset your password. While e.g. your keychain is "End-To-End" and meant to unrecoverable in the case of a lost key (well, unless your lost key was easily guessable and thus bruteforcable).
It was also my impression that Apple claims that if you lose or damage your device, your shit is gone forever and they can't get it back (and that independent repair services can get around this by simply fixing the damaged device.)
A database is, at its core, just a bunch of bytes structured in some way. There's nothing stopping you from storing an encrypted value in someone else's DB, and as long as you keep your secret private your plaintext is as safe as your encryption scheme.
> Yes, that's how databases work.
The article is arguing for end-to-end-encryption, which is perfectly do-able for google. It's not a matter of "how databases work" at all, like literally not even a bit. It's a matter of what features the company has chosen to implement.
> If we use this same logic, is Apple not being private with your data?
Has Apple launched a "confidential" email mode that does not protect the ostensibly-confidential emails? Google is making privacy claims and not backing them up by actually making them private. But... No, Apple is not being that private with your data! I'd love it if Apple worked to make E2E encryption easier in iCloud mail, and they should do so.
On one hand, we have the tools to build cryptographically secure information systems, and on the other hand there's features that simply make most users more secure.
For example, as mentioned in the article, Gmail will allow you to send an email where the recipient can't forward it. Practically this may help protect against careless adversaries, but a motivated user can obviously copy and paste somehow.
Cryptography tends to rely on computationally hard problems, meanwhile this kind of security seems to rely on problems that are seen as cumbersome or impractical from a UX perspective.
The problem I have is masquerading "UX security" (for lack of a better term) as cryptographic security.