0

For example, if I use Gmail, and use my Gmail account to send personal information, which I don't want others to see except the intended recipient, to a Hotmail account, both in the body as well as an attachment (PDF format), then who can intercept and read this information? Is it encrypted? I know the body and attachment are encrypted by TLS between my laptop and Google's servers, but what about when it is stored on Google's servers in my Gmail account? What about in transit between Gmail and Hotmail server? And all the routers and computers in between the two servers that form part of the many nodes of the Internet? What about once it is actually on the Hotmail server? What are Google and Microsoft's policies? What is standard industry policy?

Thank you!

  • in a nutshell, the government can see what you do on those, https or not, other companies usually cannot these days as most rack-to-rack communication by major firms is encrypted. – dandavis Jun 9 '17 at 8:59
2

Mail servers generally encrypt traffic between themselves. Gmail will actually warn you (albeit quietly) when you are sending mail to a server that doesn't support in-transit encryption. Here's what that looks like: little red lock Note the little red lock icon on the right. If you mouse over it, you will be offered a link to this Google Support page, where you can learn more.

To answer your questions individually:

  1. Google and Microsoft (and thus anyone who has a bug on their servers) can read your email. Their policies prevent any human actor from actually doing so, though their advertising bots will automatically read it. They could also be instructed to turn it over to law enforcement.
  2. Yes, email data is encrypted when at rest, at least on Gmail and Hotmail servers.
  3. It will be encrypted in transit between Gmail and Hotmail servers. So any snooping network switches between them will only see encrypted data.
  4. Google's Policy. Microsoft Policy. There are many industry standards; I recommend starting by looking at the ISO 27000 series. The ISO 27017 and 27018 are specifically about cloud security and privacy (respectively).
  • Do yo have a source for #2? Email is typically not encrypted at rest, and ad-monetized emails need to be unencrypted for at least part of their lifetime at Google or Microsoft to allow data mining. I may have missed it, but I read through the main Google security and privacy pages and didn't se any claims about data being encrypted at rest. – pseudon Jun 9 '17 at 13:05
  • Email is encrypted at rest. You're correct that it gets unencrypted for data mining: this doesn't count as "at rest", since it's being used. Do a Ctrl-F for "at rest" on the Google page "Cloud Platform services always encrypt customer content stored at rest." You can read more in this white paper: cloud.google.com/security/encryption-at-rest/default-encryption . I did have a harder time finding explicit confirmation from MS that Hotmail is specifically encrypted at rest, but I'm sure it's there somewhere. I'll keep looking. – Eric Dand Jun 10 '17 at 22:51
  • Thanks for the link but Google Cloud Platform isn't Gmail. I searched within that page for "email" and Gmail" and there were no hits. I wouldn't be surprised if Gmail encrypts email at rest in some way (the devil's in the details), but I've seen no authoritative sources to verify that. I'd be careful generalizing that email is encrypted at rest since many email providers do not do it. It is not a requirement of any public email standard that I'm aware of. I could be wrong, and hope to be proven wrong. – pseudon Jun 11 '17 at 14:40
0

In addition to previous answer, also see this transparency report from Google on which domains encrypt mail in transit when sending to Gmail:

https://www.google.com/transparencyreport/saferemail/

It tells you which domains support encryption in transit. I checked a few domains and so far 100% of either outbound or inbound communications are encrypted between Gmail and:

yandex.com outlook.com icloud.com (for outbound).

But for inbound, only 99% of communications are encrypted between icloud.com and Gmail (i.e. messages sent from an iCloud email to Gmail).

You can check tons of other domains as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.