Google introduces end-to-end encryption for Gmail on the web for Businesses

[enaph]

Content source

https://www.bleepingcomputer.com/news/security/google-introduces-end-to-end-encryption-for-gmail-on-the-web/

Google announced on Friday that it's adding end-to-end encryption (E2EE) to Gmail on the web, allowing enrolled Google Workspace users to send and receive encrypted emails within and outside their domain.

Client-side encryption (as Google calls E2EE) was already available for users of Google Drive, Google Docs, Sheets, Slides, Google Meet, and Google Calendar (beta).

Once enabled, Gmail client-side encryption will ensure that any sensitive data delivered as part of the email's body and attachments (including inline images) can not be decrypted by Google servers — the email header (including subject, timestamps, and recipients lists) will not be encrypted.

Google introduces end-to-end encryption for Gmail on the web

Google announced on Friday that it's adding end-to-end encryption to Gmail on the web, allowing enrolled Google Workspace users to send and receive encrypted emails within their domain and outside their domain.

www.bleepingcomputer.com

 

[Andrezj]

google says "[at this time] is currently available for Google Workspace Enterprise Plus, Education Plus, and Education Standard customers. [which means not available for home users, even if using paid plan]."

 

[Zero Knowledge]

More and more we are seeing companies move to E2EE. The less data you hold the better, it's a liability holding vast troves of data. It doesn't stop people complaining about 'going dark', but that argument is wrong as there are plenty of other ways to collect data and track users.

 

[upnorth]

On Tuesday, Google made client-side encryption available to a limited set of Gmail and Calendar users in a move designed to give them more control over who sees sensitive communications and schedules.

Client-side encryption is a generic term for any sort of encryption that’s applied to data before it’s sent from a user device to a server. With server-side encryption, by contrast, the client device sends the data to a central server, which then uses keys in its possession to encrypt it while it’s stored. This is what Google does today. (To be clear, the data is sent encrypted through HTTPS, but it's decrypted as soon as Google receives it.) Google’s client-side encryption occupies a middle ground between the two. Data is encrypted on the client device before being sent (by HTTPS) to Google. The data can only be decrypted on an endpoint machine with the same key used by the sender. This provides an incremental benefit since the data will remain unreadable to any malicious Google insiders or hackers who manage to compromise Google servers.

Abbreviated as CSE, client-side encryption was already available for Google Drive, Docs, Slides, Sheets, and Meet for users of Google Workspace, which the company sells to businesses. Starting on Tuesday, Google is rolling it out to customers of Gmail and Calendar Workspace.

Google adds client-side encryption to Gmail and Calendar. Should you care?

New service occupies a middle ground between E2EE and mere server-side encryption

arstechnica.com