Tea Leaves

Gmail

On the confusingly named Google Blog -- the one not run by Google -- Aaron Schwartz opines that gmail's security isn't strong enough:

...[Gmail] should use public-key encryption. (This part will be a bit technical.) When you create a Gmail account, your computer creates a keypair. The public key is sent to Google. The private key is encrypted with a password you choose, and the encrypted version is sent to Google. (Important: Google never gets your password.) When an email is received for your account, the server encrypts it with your public key before saving it. When you log into read it, you download your encrypted key, decrypt it with your password, and then your computer decrypts your mail with the resulting key as it's downloaded. (Already, all your mail goes through Gmail's JavaScript client to get processed and turned into HTML, so this won't be too hard to add on the client-side.) In this way, your mail is never stored in a way Google has access to.

This is a really bad idea. SSL -- which gmail provides -- is a no-brainer, but this is a bad idea.

Really, you're saying "You will need your private key on your computer in order to read mail," (since you can't public-key authenticate without your private key) which is a shorter way of saying "you'll need to carry your private key around with you, either on a disk or a smartcard or some similar device," which is a shorter way of saying "since no one wants to do this, really, I want an implementation of gmail that makes it a pain in the ass to access my account from more than one computer" which is a longer way of saying "I want a version of gmail that no one will want to use."

Second, the whole point of gmail is that Google has access to your mail. I say this not as an ominous "I hate Google" statement -- I actually have a gmail account -- but as a statement of fact. Apart from Google's desire to sell you ads, one of the things that makes gmail useful is that you get to have Google index your mail to make things easily searchable. If what you're storing on gmail is encrypted, it's not searchable anymore. So encrypting the mail on Google would destroy another aspect of the product.

Thirdly, I think you're missing the bigger issue, which is that even if we did everything you suggested -- PKI, SSL, super-hyper-secret encryption from the NSA -- random people on the internet would still be able to read your mail, because eventually it would have to be transferred to or from the recipient on the other end, which would be going over SMTP in the clear. Of course, you can talk about using public key encryption end-to-end, a la PGP, but basically the market has spoken: normal people hate the public key encryption alternatives they've been given, because they make email effectively unusable.So in summary, I think Google did exactly the right thing by punting on this problem for now. In today's internet, email between two untrusted parties who aren't both willing to use the same pain in the ass public key software ain't secure. That's the reality.

The real solution, in my opinion, is for PKI to be deployed in the core (pretend for a moment that (a) there is a such a thing as "the core" and (b) that changing SMTP to support PKI and then getting it deployed there was actually reasonably possible, which it isn't) and then for mail clients (web mail, IMAP, or others) to use SSL to access their mail stores. This would reduce the window of vulnerability from "anyone with access to a machine on any network my packets go through" to "untrustworthy administrators and/or compromised machines that my mail is actually stored on." That's a pretty significant reduction in threat. Since I now work on filesystems and don't go to IETF anymore, for all I know there's a working group on this topic that has already decided that my strawman idea is unworkable and stupid. I'll look into this and try to circle back to the topic soon.

Additional Resources

• Aaron's original article
• There's an official Google weblog, also