An Update to End-To-End

http://googleonlinesecurity.blogspot.com/2014/12/an-update-to-end-to-end.html

by aarkay • 12 years ago

142 38 12 years ago

googleonlinesecurity.blogspot.com

jMyles• 12 years ago

I mean, this seems just straight amazing, right? Am I missing something?

Obviously Google is pivoting on a number of fronts; if this enjoys wide adoption (unlikely as that may seem at the moment), they'll have to basically retreat from email content analytics, right?

lallysingh4• 12 years ago

Perhaps the additional user trust is worth it?

But the other cost is searchability, which is a pain for a search-based email system. I don't think many people use labels very much.

avz• 12 years ago

Considerable value of the search functionality can be retained by restricting it to metadata like originator which needs to be accessible for delivery to work anyway.

quonn• 12 years ago

Probably.

They make most of their money on Google search anyway - and with just the queries, no personal context as far as I know. No privacy issues arise here, in fact, it would probably work in incognito mode just as well.

Are there any numbers on how much profit they actually make on Google Mail?

cromwellian• 12 years ago

Not just searchability, auto-categorization, and anti-spam as well. I would view it through the lens of putting the power of choice in the hands of the user.

It allows people to make the choice of whether they value privacy more than usability, or, it allows fine-grained control -- end-to-end for messages you care to keep private, but no encryption for the mails you don't care about, but want searchability (mailing lists, notification emails, package tracking, etc)

notatoad3• 12 years ago

The emails that it is useful to do analytics on and the emails that it is useful to encrypt aren't the same emails. The valuable emails to analyze for a company who sells targeted advertising are the transactional emails - booking confirmations, purchase receipts, etc so they can build up a profile of what your habits are, and it is incredibly unlikely that anybody is going to start encrypting those. The email you send your boss updating him on the latest project status, or a personal email to your parents don't have a lot of marketing value.

keville• 12 years ago

booking confirmations, purchase receipts, etc

But these are _exactly_ the things I, the user, want encrypted. I would probably even stop doing business with vendors that did not encrypt their transactional communications with me.

josho• 12 years ago

I felt the same as you, until I read that Google is going to manage your keys or handle the cert. authority part (however that ends up). Then I realized their end game, which is to control end to end encryption adoption to keep another vendor from controlling it.

It's the same strategy google did with the browser and mobile. They don't want to be locked out of this play, because if they don't have influence then they may potentially loose all sorts of profiling data on you. So, with Google controlling the adoption they can ensure mechanisms to provide services around your encrypted data to benefit you (while also serving google by letting them into your encrypted life).

timothya• 12 years ago

Unless I'm reading this wrong, according to the End-to-End docs, it looks like keys are kept in a "Key Directory", and that Google will run one Key Directory, but you can use whatever Key Directory you want. I haven't seen evidence that Google will have any access to your unencrypted data.

DrJosiah• 12 years ago

You don't need to analyze content on the Gmail server to get content analysis to the Gmail server (if that is necessary at all).

If Google's primary intent is to make sure that users keep their email encrypted completely, smart clients (like browsers and mobile apps) can do what Gmail servers can't.

Look at what the Google-provided Gmail Offline extension does. Now remember that End-to-End is just an extension, like Gmail Offline, except that this one also decrypts email on the client. Once email is decrypted on the client, analysis can be performed (like indexing the email for search), and that analysis can be sent to the Gmail servers or used to perform ad calls directly (I'm not saying that Google is doing this, but technologically all of this is pretty easy given everything else already done).

rakoo2• 12 years ago

My bet: End-to-End encryption, not even automatic but through the use of a plugin, will only appeal to the niche of people who are concerned about that and may not be using GMail. For the most part of its user base, nothing will change.

Things will start to move for the majority when end-to-end encryption can be done directly in the protocol, by default, i.e anything but email.

higherpurpose2• 12 years ago

I hope they don't work too hard to making it compatible with PGP (and probably shouldn't at all). Just through Gmail and Yahoo alone adopting it, the end-to-end encrypted e-mail user base could increase by 100x. So it makes little sense to make it backwards compatible, especially if that creates potential security issues.

lallysingh4• 12 years ago

One of the benefits of PGP is that it's stood up pretty well to the test of time. Incompatible changes would be a little suspect, from a security perspective.

higherpurpose2• 12 years ago

PGP's lack of forward secrecy seems like a major flaw, unless they can somehow make it easier to have the benefits of PFS while keeping the current design. But didn't they already say they intend to use elliptic curve keys instead of RSA for much better performance? Wouldn't that already break compatibility with PGP?

The only real downside I see from breaking PGP compatibility is that then the new system will need a few years before it can really be "trusted".

However:

1) it already won't be very trusted since it happens in the browser, and it will be quite hard for Google to absolutely guarantee without a shadow of a doubt that they can't change any settings themselves (even though they own the Chrome browser and the Chrome store, on which the extension will live).

2) being new doesn't mean it can't be better. We already have better secure messaging crypto protocols such as Axolotl, so it is possible to make one that's both new and better. (I actually wonder why we can't just use Axolotl for an email interface, and call it a day?!).

mrsteveman1• 12 years ago

Given that they've already decided to include support in Chrome itself for accessing USB hardware security tokens for U2F, I see no reason why they couldn't do the same with End to End + OpenPGPCards like the Yubikey NEO, which happens to also be a U2F device.

It would provide a solution to some of the issues they document on their own Wiki regarding secret keys being stolen by an attacker through another Chrome extension, another application on the system, etc.

EDIT: YES! I missed this part[1] in the Wiki earlier:

"Additionally, we plan to add remote private key support in the future. When support for that is ready, high-risk users could protect their secret keys (stored, e.g., in a hardware USB device) from compromise even when an adversary introduces a backdoor in the source code."

[1] https://github.com/google/end-to-end/wiki/Threat-model#backd...

sft2• 12 years ago

I wish they would stop calling it End-to-End, it's misleading, they don't talk about DNS at all. One weak link in the chain means the entire chain is weak.

notatoad3• 12 years ago

DNS is not relevant at all here. Your email is encrypted client-side at one end, and decrypted client-side at the other end. At no point in between does it exist in cleartext. If there is some DNS vulnerability that causes your email to get intercepted, that in no way compromises the encryption.

sft2• 12 years ago

Here? Where is here? The blog mentions nothing about email specifically.

driverdan• 12 years ago

Can anyone who has been using End to End provide some feedback and additional info about it? The docs (and blog posts) don't really say much other than it encrypts text.

jmnicolas2• 12 years ago

We’re migrating End-To-End to GitHub

A bit off-topic but it seems to me that Github is fast becoming a "too big to fail" actor.

nullspace• 12 years ago

The switching costs away from Github is trivially low actually. You may lose out on some of the niceness related to github - but there are plenty of good git based source code hosting software out there.

k-mcgrady• 12 years ago

The only pain point in switching I can think of is issues/wiki. Are they exportable from GitHub and importable into something like BitBucket?

jmnicolas2• 12 years ago

I should have been more clear about what I meant : I was thinking of failing as in downtime not the company being bankrupt.

Imagine a cyber-attack that would paralyze Github for one month ...

Fastidious• 12 years ago

How could a regular user start using this (unless it is not ready at all for the "fearless ones")?

An Update to End-To-End

Related Stories