I mostly understand the relationship between two servers transmitting unencrypted email, and how those emails can be read by a third party. What I am getting confused about though, is in relation to a HTTPS web client like Gmail. In the following scenario, at what point could a third party be able to read the email?
Bank sends unencrypted email to Gmail account
As Gmail is HTTPS, would the only vulnerability be between the bank's server and the Gmail server?
The basic answer is SMTP.
HTTPS is only a consideration on the 'last mile', if you will - between the end user and the mail client (in this case). In the case of IMAPS or POP3S, the same would be true - that encryption protects the communication between the mail client and the IMAP or POP3 server.
In order for these to 'see' the mail, it first needs to be sent between hosts via SMTP.
When your bank sends an unencrypted email to your Gmail address, anyone able to see traffic on the network between your bank's email server and their next relay/hop in the mail path can see the full contents (i.e. Google's server).
There is a long list of who that could be.
It could include local staff at the bank, third parties providing e.g. security monitoring to the bank's network, and so on. The same would be true of all network providers between the bank and Google, and the same would be true of anyone at Google able to sniff the relevant traffic.
Basically, if you run a traceroute from you to google's server, everyone on that can see your email.
Plus any state-level actor, it seems, with a passing interest.
The 'last-mile' between you and your inbox, though, should be safe(r) if properly encrypted (and assuming your machine isn't compromised).
