Gmail encryption

Question

Is sending emails between Gmail accounts encrypted, can ISP read gmail content in transit??

Answer 1

The encyption in transit in the context of email communication refers to TLS between message transfer agents (MTA).

Whether encryption in transit was used or not does not matter much if you are concerned whether the [sender's or the recipient's] ISP can read the mail, because the connections used both for sending and reading the mail are encrypted:

• If the web mail was used for writing and/or reading the message, it was protected by TLS in the HTTPS connections.
• If external mail user agents (MUA) were used, the submission on the sender's side was protected by the submissions protocol and the reading by the TLS in the IMAPS protocol.

Therefore, it does not really matter how the things are handled inside the cloud service. Google's own documentation promises that Gmail is handling your mail appropriately:

When you send an email or text message, send attachments, or record video meetings, it is stored securely in our world-class data centers. Data is encrypted in transit and at rest. If you choose to access this data offline, we store this info on your device.

You can judge for yourself how much you want to trust this promise after reading the sources cited in Adam Katz's answer.

The encryption in transit matters more in delivery scenarios between two service providers. Here it provides additional protection for the communication between their cloud infrastructures:

Examining encryption in transit from a technical perspective

In general, you could examine the email headers to see what has happened during its delivery. The details about encryption in transit could be logged in the Received headers, e.g., the TLS 1.3 encryption in:

Received: from mail.example.org (mail.example.org [192.0.2.1])
        (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
         key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)
        (No client certificate requested)
        by example.com (Postfix) with ESMTPS id 123456789A
        for <[email protected]>; Mon, 02 Oct 2023 16:12:51 +0000

A message from Gmail to Gmail shows these headers (examine using Show original from the ⋮ menu):

Received: by 2002:a05:7010:a11:b0:385:df3f:9b20 with SMTP id xxx;
        Sun, 1 Oct 2023 23:15:34 -0700 (PDT)
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
        by mx.google.com with SMTPS id x.x.x.x.x.x.x.x
        for <[email protected]>
        (Google Transport Security);
        Sun, 01 Oct 2023 23:15:34 -0700 (PDT)

The first (more recent) header does not explicitly mention encryption whereas the second refers to an abstract "Google Transport Security". This means there is some kind of encryption when Google delivers the mail via SMTP in their own infrastructure, but that they are not disclosing the details.

When Gmail sends messages to an external MTA it is capable of using TLS 1.3:

Received: from xxx.google.com (xxx.google.com [IPv6:x:x:x:x::x])
        (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

Likewise, it supports TLS 1.3 for inbound mail:

Received: from example.net (example.net. [198.51.100.1])
        by mx.google.com with UTF8SMTPS id x.x.x.x.x.x.x.x
        for <[email protected]>
        (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Answer 2

Because Gmail is served with TLS (the https:// prefix), your ISP or any other manipulator in the middle (MitM) should not be able to see your content, only that you're conversing with mail.google.com (which is only discoverable through monitoring your DNS—they otherwise only have that server's IP) and the amount of encrypted bits flowing back and forth.

Google, on the other hand, definitely has access to your content, though it is encrypted at rest.

For a few years, the NSA's PRISM program took advantage of an implementation flaw: data transferred between Google's data centers was unencrypted and the US government was recording it. This was changed about ten years ago in response to a leak that revealed details on this spying program.

Since we're talking about email, it's also important to note that even though most email nowadays is encrypted with TLS, downgrade attacks are possible and can result in another entity reading your mail in transit, though there are several efforts to reduce this (see comments below). Unless Google repeated the sort of flaw that enabled PRISM, this should not be a concern in Gmail-to-Gmail conversations.

Answer 3

Sending emails between Gmail accounts benefits from default encryption measures, as Gmail employs Transport Layer Security to secure emails during transit. TLS encryption ensures that your email content remains protected while in transit, both from your computer to Gmail's servers and from there to the recipient's computer. This encryption applies to the email's actual content, safeguarding its confidentiality and integrity.

However, it's important to note that while the email content is encrypted, certain metadata, such as the sender's and recipient's email addresses and the subject line, may still be visible to your Internet Service Provider. Additionally, your ISP could potentially access information about the sender and recipient's IP addresses.

To enhance privacy further and mitigate the exposure of metadata, you have the option of utilizing a Virtual Private Network. A VPN establishes a secure tunnel between your computer and a VPN server, encrypting all your internet traffic as it traverses this tunnel. This added layer of security ensures that even metadata remains confidential.

In addition to encryption measures, you can implement practices that promote email security and privacy, such as using strong passwords and enabling two-factor authentication for your Gmail account. Furthermore, exercising caution regarding the information you share in your emails and avoiding clicking on links from unknown senders are additional steps that help safeguard your digital communication. These practices collectively contribute to a safer and more private email experience.