Gmail - end to end message encryption?

[timbo343]

I was wondering if GMail supports or has the ability to do end to end encryption? The reason i ask,i have heard on the grape vine that our LEA are looking to move away from Egress and want to use Office365 to send and receive encrypted emails.

 

I know that end to end email encryption is easy to do in Office365 and when we were using it, I implemented the rule so that if the user inputted "#encrypt" or other variants of Encrypt, the message would be encrypted and the recipient would have to use a One Time Passcode to read the message and obtain the attachments.

 

I always had quarms with this though, although it was a good idea in principle, there was always the error of the user sending to the wrong recipient and because there was not an additional check to make sure the recipient was who they said they were, which is why i still prefer attaching documents that are password protected and then the recipient has to contact the sender for the password, however the feature was there to use.

 

This encryption feature doesn't seem to be a thing in Google so how would we set this up? Would we still have to use the attach password protected files and the recipient to ask for the password? How would a Google School send emails that were encrypted to other Google Schools or a School using Office365.

 

Update: Looking into this further, Confidential mode offers the option to use SMS Passcodes which require the recipient to enter their mobile number to obtain the email. Also under confidential mode, i thnk Google need to give the option for a custom date and time expiration as well as the preset options.

 

Before sending the confidential email, the sender needs to know the recipients mobile number - not everyone wants to give out their mobile number however messages that are set with the option to use a SMS message, users must request a SMS code when ever they want access to the email.

 

Would those who are using Gmail, suggest using Confidential mode as an alternative to the Office365 option and would it be classed as safe?

Edited May 3, 2020 by timbo343

[rogerdnixon]

G Suite uses email encryption by default. What you can do is enable high levels of security:

https://support.google.com/a/answer/2520500?hl=en - we do this (the default now: https://gsuiteupdates.googleblog.com/2020/04/improve-email-security-in-gmail-with-TLS.html)

https://support.google.com/a/answer/9261504?hl=en&ref_topic=9261406&visit_id=637240931547676880-58329043&rd=1 - and this,

and

https://support.google.com/a/answer/7280976?hl=en - but S/MIME required paid for certificates so we don't do this -and really needs the other end to use it for full functionality + a pain to setup.

 

What it sounds like you are asking for is an additional layer of authentication - in case someone hacks the recipient's mailbox or you just don't trust their security. In that case, we use confidential mode - so either has self-destructing emails (time-driven) or require authentication delivered via a phone message (so hopefully the person who has nicked your laptop has not also nicked your phone or sitting at your desk). But in most cases, these things are remotely compromised - not people sitting at your desk.

 

Never quite saw the point of "encrypted" emails in O365 as when ever I got them I just clicked on the link and they opened - not additional authentication needed at all.

[mavhc]

OME is completely pointless, same with any of these other "encrypted" email solutions. If someone can get the original email that's encrypted they can also read it, as there's no second channel for the password to be sent.

 

Unless you phone the person to tell them the password, or send it via some other method that's more secure (ie not SMS), it's not worth the bits it's encrypted with.

 

Just enforce TLS SMTP and you're done, anything else less than S/MIME, which as Roger pointed out no one uses because it costs too much, is a waste of everyone's time and money.