3

Is there a way for a person to remotely and irrefutably demonstrate ownership of a Gmail email address? I've considered using DKIM signatures, but this has problems:

PGP Key Signing Robot DKIM Verified Emails

I've also considered using Google's OpenID or OAuth APIs, but I believe you can list other emails as your primary address in your Google account. Notably, the Google docs state: "The user's email address. This may not be unique and is not suitable for use as a primary key." While the API does report if the email is verified, it is not clear to me if verification is any more substantial than a simple email loop. https://developers.google.com/identity/protocols/OpenIDConnect

I understand that there are very good reasons for Google to make it difficult to link emails to user accounts. However, it would be nice if a user could opt-into demonstrating this association.

Edit for clarification: The context here is one of signing PGP keys or granting S/MIME certificates linked to the email. You want to be sure that the certificate you are signing was sent from someone with bonafide send/recv privileges, and not someone who forges a "from:" field, or who sits in the path between the signer's email provider and Google (the signee's email provider). Here, real-life identity doesn't matter. I don't care who someone is. I only care that the person making the request is also the person who has the username/password of the the claimed email account (or, I suppose, works for Google...). The purpose here is to bootstrap more secure forms of communication.

The argument here is that the standard email loop is insufficient. Email is prone to forgery and interception. But, there may be secure out of channel methods (E.g. OAuth or posting a public key to Google+). If nothing else, such an approach would provide additional evidence beyond the already ubiquitous email loop. Unfortunately, neither OAuth, nor Google+, nor YouTube comments, etc. can be reliably linked to an email address.

  • 1
    Why not send an email to the user who claims to own the mail account. If the user has really access to it then it can read the mail and extract some secret token, URL ... and provide it as the proof. Of course this only proves that the user has access, i.e. the account might be legally or illegally owned by the user. – Steffen Ullrich Dec 7 '15 at 20:41
  • 2
    Good point @SteffenUllrich; the difference between "own" and "have access to" is pretty blurry. Maybe the OP could clarify that in the question? – Mike Ounsworth Dec 7 '15 at 20:48
  • 1
    The email to GMail needn't be sent in the clear: GMail supports SSL. Is sending plaintext a requirement? – LSerni Dec 7 '15 at 23:46
  • 1
    @lserni - Unless you're going Gmail->Gmail, I don't think you can guarantee on-the-wire encryption. And SSl doesn't prevent attacks against mail servers. – Neil Smithline Dec 7 '15 at 23:48
  • 1
    @lserni - if you are sending the email, you can guarantee on-the-wire encryption – Johnny Dec 8 '15 at 0:48
3

Following the ideas listed in comments above (thanks to Neil et al.) I found the Google Email transparency report:

http://www.google.com/transparencyreport/saferemail/?hl=en

This makes it very clear that Gmail>Gmail messaging is encrypted:

Is email from Google users to other Google users encrypted in transit?

Yes. This includes Gmail, Google Apps and notifications from Google+. That's why this report is focused on email deliveries where Google is only one of two providers involved.

So I think this solves the problem.

When receiving inbound email to a gmail account, one can check the DKIM signature to verify the email originated from a Google SMTP server (and thus was encrypted all the way to your gmail inbox)

In the outbound direction, you know your email originated from Google services, and thus will be encrypted all the way to the recipient's gmail inbox.

If someone can both send email and respond to a challenge sent via email (all within gmail), then I think this would be very compelling evidence of account ownership. Of course, a Google engineer could still inspect the messages at rest, but I'm willing to accept such individuals as being in the class of "authorized to send/recv email from that email account."

  • I flagged this as a community wiki because I'm always a little apprehensive of gaining rep when answering my own questions. – afourney Dec 8 '15 at 5:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.