Gmail encryption: Everything you need to know
Credit to Author: JR Raphael| Date: Thu, 22 Nov 2018 04:00:00 -0800
Encryption may sound like a subject best left to hackers and tinfoil hat wearers, but don’t be fooled: It’s a critical part of contemporary life and something that’s important for everyone, especially business users, to understand. And one of the places where encryption is most relevant and misunderstood is in the realm of email.
If you’re using Gmail for electronic communication — be it for business, for personal use, or a combination of the two — it’s well worth your while to know how the service does and doesn’t secure your information and what steps you can take to make sure you’re getting the level of privacy you need.
Ready to dive in?
Google’s standard method of Gmail encryption is something called TLS, or Transport Layer Security. As long as the person with whom you’re emailing is also using a mail service that also supports TLS — which most major mail providers do — all messages you send through Gmail will be encrypted in this manner.
What that basically means is that it’ll be incredibly difficult for anyone to look at a message while it’s en route from point A to point B. It doesn’t, however, guarantee that the message will remain private or available only to the intended recipient once it reaches the destination mail server. Google itself, for instance, has the ability to see messages associated with your account, which is what allows the company to scan your email for potential spam and phishing attacks — and also to offer advanced features like Smart Reply, which suggests responses based on an email’s contents. (Google used to scan messages for ad targeting, too, but it stopped doing that last year.)
If the person with whom you’re corresponding is using a mail server that doesn’t support TLS, meanwhile, messages won’t be encrypted at all. (With paid G Suite accounts, administrators can opt to allow only messages with TLS encryption to be sent or received — though that’d obviously have its own set of likely undesirable consequences.)
Beyond that basic form of encryption, Gmail supports an enhanced standard known as S/MIME — or Secure/Multipurpose Internet Mail Extensions. It’s available only for paid G Suite Enterprise and G Suite Education accounts, so if you’re using a regular free Gmail account, it doesn’t apply to you.
For folks with G Suite setups, though, S/MIME (which may or may not have been invented by a mime) allows emails to be encrypted with user-specific keys so that they remain protected during delivery and can be decrypted only by the intended recipient.
Like TLS, S/MIME works only if both the sender and recipient are using a service that supports it — and, in an extra layer of complication, only if both parties have exchanged keys in advance so that the encryption can be properly configured. Like TLS, it also doesn’t do anything to keep a message secured once it’s reached its actual destination server (and so again, within Gmail, Google itself will be able to scan messages in its usual automated way).
Last but not least, S/MIME has to be enabled by a G Suite admin before it’ll work.
Google’s been talking about adding end-to-end encryption into Gmail since 2014, but all of that talk hasn’t amounted to much so far (and may not ever, according to some analyses). The only way to get that level of protection in Gmail right now is to rely on a third-party service such as FlowCrypt, which is available as a Chrome or Firefox extension on the desktop. (An Android app is also available in a pre-release beta form.)
FlowCrypt adds a “Secure Compose” button into your regular Gmail interface, which allows you to send encrypted messages using the PGP (Pretty Good Privacy — yes, that’s actually what it’s called) standard. Your recipient will need to have FlowCrypt or another PGP system set up and will also need to have your personal PGP key in order to decrypt and view your messages. Alternatively, you can use the extension to encrypt a message with a password, which you’d then have to provide to the recipient in some way.
So, yeah: It isn’t exactly simple, and the third-party add-on implementation certainly isn’t ideal. But it can get the job done. And it’s free — to a degree: If you want to unlock the service’s full set of features and remove all of its restrictions, you’ll have to pony up $5 a month for a premium subscription.
Yeah, don’t put much stock into that. Confidential Mode is a feature launched as part of the Gmail revamp earlier this year. The idea is that it lets you prevent someone from forwarding, copying, printing, and downloading anything you send them — and, if you want, lets you set an expiration date after which your message will no longer be accessible. You can also create a passcode, delivered via email or text message, that’s required in order to open the message.
That all sounds nice enough on the surface, but the problem is that it doesn’t really do a heck of a lot when it comes to actual security. Messages still aren’t encrypted in any end-to-end manner, meaning Google (and other mail services) are still able to view and store them. The “no forwarding, copying, printing, and downloading” bit doesn’t mean much, either, since anyone can still take a screenshot of a message if they’re so inclined. (Google has said the feature is less about that level of security and more about simply discouraging people from accidentally sharing sensitive info where they shouldn’t.)
The same applies to the message expiration dates — as does the fact that an “expired” message continues to exist in your own Gmail Sent folder. All in all, Confidential Mode has the potential to be useful for what it is, but it doesn’t involve encryption or any sort of meaningful, higher-level privacy. In fact, the Electronic Frontier Foundation has gone as far as to say the mode could create a false sense of security and discourage users from finding more serious solutions.
If native end-to-end encryption and the highest possible level of privacy is what you’re after, your best bet is to look outside of Gmail and toward a standalone email app called ProtonMail. ProtonMail is among the best privacy and security apps on Android — and for good reason: It makes privacy a top priority in ways no form of standard Gmail encryption can match.
First, ProtonMail uses an open-source method of end-to-end encryption that ensures no one beyond your intended recipient — not even the folks at ProtonMail — can ever see your messages. Beyond that, the app doesn’t require you to provide any personal information to use it, and the company maintains no records of IP addresses or anything else that could associate your identity with your account. Its servers are also hosted in Switzerland — in a “bunker 1000 meters under the Swiss alps,” no less — which has its own apparent set of security benefits.
So here’s how it works: When you sign up, ProtonMail gives you a custom email address at its domain. You can then use that address to send secure messages within the ProtonMail Android app, iOS app, or web interface. Anytime you email someone else with a ProtonMail address, encryption is automatic. If you email someone who isn’t using ProtonMail, you can choose to send the message unencrypted — just like any regular ol’ email — or you can click a button to create a password and hint that the recipient will need in order to decrypt and read your message.
ProtonMail is free at its most basic level, which gives you a single ProtonMail address, 500MB of storage, and up to 150 messages per day. You can get more storage, more messages per day, and access to advanced features — like email filters, an auto-responder system, and support for custom domains — starting at $59 a year.
It isn’t technically Gmail encryption, of course, but you can import your Gmail messages or set up Gmail to forward to ProtonMail — or just use ProtonMail as a supplement to Gmail for the times when you need the strongest possible level of protection. When privacy is a priority and you don’t want to take any chances, it’s an excellent option to have.
Sign up for my weekly newsletter to get more practical tips, personal recommendations, and plain-English perspective on the news that matters.