<story><title>More Encryption, More Notifications, More Email Security</title><url>https://security.googleblog.com/2016/03/more-encryption-more-notifications-more.html</url></story><parent_chain><item><author>codelitt</author><text>This seems like much ado about nothing.&lt;p&gt;I certainly appreciate the effort is better than nothing, however, how often are those notices served to US&amp;#x2F;European citizens? It&amp;#x27;s one thing to stand up to government overreach in foreign countries, but how about the country where you (and a large percentage of your users) reside? They specify attackers, but I&amp;#x27;m assuming this notice to the end user does not apply to the US&amp;#x2F;EU governments requesting your data and them complying?&lt;p&gt;Another gripe I have is that TLS has probably been broken by the NSA^1. It&amp;#x27;s better than nothing to alert us about the other party not using it, but really provides limited protection. PGP&amp;#x2F;GPG is really the only assurance you have and the plugins for different desktop apps are nearly always buggy. I end up just manually encrypting&amp;#x2F;decrypting with GPG because a buggy encryption integration is not a comforting thought. If they really cared about keeping your privacy safe, they&amp;#x27;d have an end-to-end encryption tool&amp;#x2F;integration.&lt;p&gt;[1]: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2013&amp;#x2F;12&amp;#x2F;how-does-nsa-break-ssl.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2013&amp;#x2F;12&amp;#x2F;how-does-nsa...&lt;/a&gt;</text></item></parent_chain><comment><author>felipeerias</author><text>If you really need secure communications, email+GPG is still a very poor solution. The body of the message is encrypted but a staggering amount of metadata will be transmitted in the open: sender, receiver, crypto used, date, subject, approximate size, etc. Furthermore, it doesn&amp;#x27;t provide forward secrecy: if somebody gets access to your key, they will be able to open everything you&amp;#x27;ve ever sent.</text></comment>
<story><title>More Encryption, More Notifications, More Email Security</title><url>https://security.googleblog.com/2016/03/more-encryption-more-notifications-more.html</url></story><parent_chain><item><author>codelitt</author><text>This seems like much ado about nothing.&lt;p&gt;I certainly appreciate the effort is better than nothing, however, how often are those notices served to US&amp;#x2F;European citizens? It&amp;#x27;s one thing to stand up to government overreach in foreign countries, but how about the country where you (and a large percentage of your users) reside? They specify attackers, but I&amp;#x27;m assuming this notice to the end user does not apply to the US&amp;#x2F;EU governments requesting your data and them complying?&lt;p&gt;Another gripe I have is that TLS has probably been broken by the NSA^1. It&amp;#x27;s better than nothing to alert us about the other party not using it, but really provides limited protection. PGP&amp;#x2F;GPG is really the only assurance you have and the plugins for different desktop apps are nearly always buggy. I end up just manually encrypting&amp;#x2F;decrypting with GPG because a buggy encryption integration is not a comforting thought. If they really cared about keeping your privacy safe, they&amp;#x27;d have an end-to-end encryption tool&amp;#x2F;integration.&lt;p&gt;[1]: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2013&amp;#x2F;12&amp;#x2F;how-does-nsa-break-ssl.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2013&amp;#x2F;12&amp;#x2F;how-does-nsa...&lt;/a&gt;</text></item></parent_chain><comment><author>nxzero</author><text>If they had end-to-end encryption, then Google wouldn&amp;#x27;t be able to read the emails; meaning to gain value, Google would have to charge for the service.</text></comment>