Google Open Sources End-To-End Email Encryption

Google wants other email providers to provide end-to-end email encryption and has released open source code to help them do just that.

The tech titan, which has been keen to show it’s working hard to protect customer data following the Edward Snowden leaks on mass surveillance by US and UK snoops, said end-to-end encryption had been hard to use in the past.

Google said it wants to help ease the pain of properly securing email, which has traditionally been done using the Pretty Good Privacy (PGP) protocol. Whilst PGP works effectively at keeping prying eyes out, it’s not as simple as using standard email services, as it involves effective key management.

Google being good

“Today we’re making available the source code for End-to-End, a Chrome extension. It’s currently in testing, and once it’s ready for general use it will make this technology easier for those who choose to use it,” said Brandon Long, tech lead for the Gmail Delivery Team, in a blog post.

Google believes 40 to 50 percent of emails sent between Gmail and other email providers aren’t encrypted.

Gmail has traditionally used the Transport Layer Security (TLS) protocol to protect emails in transit. Long noted the “important thing is that both sides of an email exchange need to support encryption for it to work; Gmail can’t do it alone”.

More problems with web encryption

TLS itself has been proven vulnerable in the past, however. One version, known as GnuTLS, was shown to be flawed this week, although that does not affect Gmail. A patch has been released, but anyone who hasn’t downloaded it and is using GnuTLS will still be open to nasty attacks.

The problem lay in how GnuTLS handled session identifiers of user connections. It meant that a malicious server could use the flaw “to send an excessively long session id value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS”, an advisory from open source vendor Red Hat read. Buffer overflow can be used to write code, such as malware, to a connecting machine.

The problem affected various versions of the Linux operating system, including Red Hat Enterprise 5 and 6.

In April, the Heartbleed bug emerged, showing up a serious problem in the OpenSSL form of web encryption. Google researchers helped uncover that vulnerability, which could have leaked cryptographic keys and opened up web servers to criminal surveillance.

What do you know about Internet security? Find out with our quiz!