Warning: Gmail confidential mode is not secure or private

[Baofeng]

Thanks to bitmover's topic here, Overview on browsers. Which one should we use? Support free web while browsing., I took some time to look at Gmail's supposedly confidential mode.

Gmail’s confidential mode will be on by default for G Suite users starting June 25th

Google is rolling out its confidential mode to G Suite users by default starting on June 25th. If you use Gmail at work, you’ll be able to use the tool to write a confidential email, as personal account holders have been able to do since Gmail’s mid-2018 redesign.

Confidential mode is a powerful tool that will come in handy at work if you send messages containing sensitive details. It lets you set an expiration date for your message, which cuts off access when that day arrives. While the message is available, recipients won’t be able to forward your message to others, copy its contents, or download it, and the sender can revoke access at any point. To add another layer of security, you can set the message to only unlock after the recipient types in an SMS verification code that’s sent to their phone number.

https://www.theverge.com/2019/5/29/18644525/gmail-confidential-mode-on-default-g-suite-june


However, this is quite misleading, as protonmail say's that "Gmail confidential mode is not secure or private",

Without end-to-end encryption, Gmail confidential mode is little more than a marketing strategy. Learn why privacy experts call Google’s privacy features “misleading.”
When we launched ProtonMail nearly five years ago, we pioneered a new kind of email service: one that gives you control of your own data. All emails are end-to-end encrypted and zero-access encrypted, meaning not even we can read them. We also offer the ability to set expiring emails, which self-destruct after a period of time chosen by the sender.

Several years later, Google tried to integrate some of these same features into Gmail with “confidential mode.” Even though Google launched confidential mode over a year ago, people are still confused about what it does. Is it actually secure or private? Is it encrypted? When you turn it on, does it prevent Google from reading your messages? The answer to these questions is ‘no.’ In fact, the decision to call it “confidential” suggests a level of security and privacy that doesn’t exist in Gmail confidential mode.

Gmail’s confidential mode does not mean your messages are end-to-end encrypted. Google can still read them. Expiring messages aren’t erased for good, and the recipient can always take a screenshot of your message. Let’s take a closer look at how confidential mode works and why it isn’t so confidential after all.

Gmail’s confidential mode does not make emails private because Google can always read them. When you send an email with confidential mode turned on, Google keeps the email contents on its servers. Other Gmail users can read the email in their inbox, but outside users only receive an email notifying them that a sender “has sent you an email via Gmail confidential mode” along with a link to a page on google.com. (This is similar to ProtonMail’s encrypt to outside feature.)

https://protonmail.com/blog/gmail-confidential-mode-security-privacy/

I know someone will says that it's a competitor, but I'm sure more high level accounts in this community have been using protonmail for years and I haven't heard any complains from them. So for those who have been inching their hands to get on this supposedly Gmail confidential mode, then think again, Big G is always one step ahead of us, and don't sacrifice all your data to them. Think smart!!!

[1713866862]

1713866862

[1713866862]

1713866862

[1713866862]

1713866862

[1713866862]

1713866862

[bitmover]

Thanks for mentioning my topic.

As I said in some other topic about privacy, Let´s Talk About Privacy, you should always avoid any Google service or software, as they are always collecting your data. This include reading your e-mails.

This may not be a problem for personal use, depending on the person.
But for cryptocurrencies or any other financial use, I believe it´s better to use some more secure e-mail, such as ProtonMail, as you mentioned. ProtonMail is by far the best out there, IMO.

ProtonMail is not a real competitor, as it has a difference niche (more privacy and security focused users, not for general public. Its free version is somewhat limited to be your only email also).

[bernardos]

Googles business model revolves around buying and selling data so I wouldnt think it would be any different when using confidential mode or whatever else they come up with. We, the users, are their patients and they want to keep their patients.

[BitBustah]

Wow, shocker!!!.......

Don't believe anything these big companies tell you, they are all playing ball with the government and you better believe anything you ever send, type, or do on anything google related will be stored permanently.

[mersal]

Proton mail actually good than any other mail services and I saw many ethical hackers were advicing all over the world to use ptotonmail over gmail to secure our privacy and also annoying ads from useless shit companies.

[dothebeats]

As I said in some other topic about privacy, Let´s Talk About Privacy, you should always avoid any Google service or software, as they are always collecting your data. This include reading your e-mails.

This may not be a problem for personal use, depending on the person.
But for cryptocurrencies or any other financial use, I believe it´s better to use some more secure e-mail, such as ProtonMail, as you mentioned. ProtonMail is by far the best out there, IMO.

ProtonMail is not a real competitor, as it has a difference niche (more privacy and security focused users, not for general public. Its free version is somewhat limited to be your only email also).

I have since moved my bank-related and work-related stuff from my Gmail and have since used an iPhone due to the amount of scandals Google finds itself along the way. Not that my stuff are super important or could spark the difference between a peaceful world and a nuclear wasteland but my data is my data, and only I should read it, together with those who sent it to me of course. There's nothing wrong about being privy about important matters, be it email or something else.

Would definitely take a look at protonmail. A lot of friends have already recommended it as well so this time I might take it.

[bitmover]

Would definitely take a look at protonmail. A lot of friends have already recommended it as well so this time I might take it.

I don't know if Apple is any better, as they probably read your emails as well. We are fuked up.. let's do what we can to preserve our privacy..

About proton mail, as least you should create an account there with a cool account name while it's still a small company. I have a few emails there

[TryNinja]

I don't know if Apple is any better, as they probably read your emails as well. We are fuked up.. let's do what we can to preserve our privacy..

About proton mail, as least you should create an account there with a cool account name while it's still a small company. I have a few emails there

See this list for good privacy-oriented email providers: https://www.privacytools.io/providers/email/

ProtonMail seems to be one of the "bests" of the list. I use them as well.

[joniboini]

I also use Tutanota. It has 2FA but the loading is slow sometimes. ProtonMail and Tutanota is my choice if you're talking about privacy. Sadly I can't be free 100% from Google as some of my works require a verifiable Gmail address.

[pooya87]

Protonmail is 10 times better than Gmail, not to mention that we are comparing a company located in Geneva, Switzerland with a company in US! by default Google will betray your privacy

but in the end if you want true privacy then you shouldn't rely on any of them. simply encrypt whatever sensitive information you have OUTSIDE of the email provider webpage with whatever strong encryption technique you know of and then only use their service to transfer the encrypted data.

i am finally out of merits to give...

[o_e_l_e_o]

+1 for Protonmail. Also been hearing a lot of good things about ProtonVPN, although I haven't tried it yet myself.

Talking about "Confidential Mode", it's obviously complete nonsense, but many people will use it and have a false sense of security from it. It still amazes me just how many people think "private browsing" or "incognito mode" offers them some level of protection against tracking and spying, which it obviously doesn't. The same will be true of this, with people thinking it provides protection which it doesn't.

The "others can't copy or download it" is particularly disingenuous. This can literally be bypassed with a single key press - print screen.

[bitmover]

+1 for Protonmail. Also been hearing a lot of good things about ProtonVPN, although I haven't tried it yet myself.

They have a free Version, it is worth checking out.
I had to wait a few months to get access to their VPN for free, I don`t know if it is open to everyone now or not. I use it sometimes, it is safe and I trust them with my data.

Certainly a good company which it is worth supporting also.

[practical_edge]

+1 for Protonmail. Also been hearing a lot of good things about ProtonVPN, although I haven't tried it yet myself.

They have a free Version, it is worth checking out.
I had to wait a few months to get access to their VPN for free, I don`t know if it is open to everyone now or not. I use it sometimes, it is safe and I trust them with my data.

Certainly a good company which it is worth supporting also.

Are you saying they have a free version of their VPN or just of the email?

[ManoPrimitiva]

Protonmail is definitely the best option as of now, I mean it was created by people working at CERN, that automatically means big brains; also has a really good option for business, allows you to keep your business email address (you@yourcompany.com) and its not an expensive service.

[DaCryptoRaccoon]

***  A word of WARNING ***

https://www.theregister.co.uk/2019/05/29/protonmail_dismisses_spying/

This is still playing out in the protonmail world right now.
Email needs a re-vamp anyway it's become nothing more than advertising anyway.

[o_e_l_e_o]

Are you saying they have a free version of their VPN or just of the email?

They have a free version of their VPN, which you can see here: https://account.protonvpn.com/signup and https://protonvpn.com/free-vpn

It is subsidized by their paid plans, and it has quite a few limitations as you may expect. You are limited to only using it on one device, you can only uses servers based in 3 countries (Japan, Netherlands, USA), the speed isn't as good, and you can't use it for P2P, torrenting, streaming, etc. However, it is likely far better than the vast majority of free VPNs out there, which generally just collect and sell your data while offering the user minimal, if any, benefit. Given the number of good VPNs you can buy in the region of $5/month, buying a subscription remains the best option.

[nakamura12]

+1 for Protonmail. Also been hearing a lot of good things about ProtonVPN, although I haven't tried it yet myself.

They have a free Version, it is worth checking out.
I had to wait a few months to get access to their VPN for free, I don`t know if it is open to everyone now or not. I use it sometimes, it is safe and I trust them with my data.

Certainly a good company which it is worth supporting also.

Even though not all VPNs take data seriously for keeping it secured or safe for the users but I only use VPN myself when i'm trying to access a site that I can't access or open the site without using a VPN like ProtonVPN which they also have ProtonMail for emails. We can set a two factor in ProtonMail right?

[o_e_l_e_o]

We can set a two factor in ProtonMail right?

Yes, you can use Authy or Google Authenticator. Just click on settings inside your account, click on "enable two factor authentication", and scan the QR code. It will also provide you with 16 "recovery codes" which can be used once each in the event you lose your phone or other 2FA device. Much like your mnemonic seed, you should write these down on paper and store them somewhere safe (not electronically).

[bitmover]

It will also provide you with 16 "recovery codes" which can be used once each in the event you lose your phone or other 2FA device. Much like your mnemonic seed, you should write these down on paper and store them somewhere safe (not electronically).

One additional and confortable way to back up your 2fa is to use Authy. Authy allows you to save your 2fa codes in your account, so you can multiple devices as a back up. It is not as safe as writing in a piece of paper... But after adding the devices you can disable "add new devices" function, so at least in theory nobody would have access to your account in a new device.

I made a small topic about it here
https://bitcointalk.org/index.php?topic=3178131.20