As part of its attempts to safeguard emails sent via the online version of the platform, Google on Friday revealed that client-side encryption for Gmail is in beta for Workspace and school clients.
The adjustment is a positive one for users who appreciate the security of their personal data because it comes at a time when worries about internet privacy and data security are at an all-time high.
In order to participate in the beta programme, customers of Google Workspace Enterprise Plus, Education Plus, and Education Standard may apply until January 20, 2023. Personal Google Accounts cannot access it.
“Using client-side encryption in Gmail ensures sensitive data in the email body and attachments are indecipherable to Google servers,” the company said in a post. “Customers retain control over encryption keys and the identity service to access those keys.”
It is important to know that the latest safeguards offered by Gmail is different from end-to-end encryption.
Client-side encryption, as the name implies, is a way to protect data at rest. It allows organizations to encrypt data on Google services with their own cryptographic keys. The data is decrypted on the client-side using keys that are generated and managed by a key management service, which is hosted in the cloud.
Google’s opt-in feature requires administrators to set up an encryption key service through one of the company’s partners — which are offered by Flowcrypt, Fortanix, Futurex, Stormshield, Thales, or Virtru — or alternatively, build their own service using its client-side encryption API.
This means the data is protected from unauthorized access, even from the server or the service provider. However, the organization or administrator has control over the keys and can monitor users’ encrypted files or revoke a user’s access to the keys, even if they were generated by the user themselves.
On the other hand, end-to-end encryption (E2EE) is a method of communication in which information is encrypted on the sender’s device and can be decrypted only on the recipient’s device with a key known only to the sender and the recipient.
With that said, the new option – limited to the web browser for now – permits users to send and receive encrypted emails both within and outside of their domains. The encryption covers email body and attachments, including inline images, but not the subject and recipient lists.
Gmail is not the only Google product with client-side encryption turned on. The tech giant enabled the same functionality for Google Drive last year and Google Meet earlier this August. A similar test for Google Calendar ended on November 11, 2022.
It’s worth noting that Google Drive apps for desktop as well as Android and iOS support client-side encryption. Google said that the feature will be integrated into mobile apps for Meet and Calendar in an upcoming release.
“Client-side encryption helps strengthen the confidentiality of your data while helping to address a broad range of data sovereignty and compliance needs,” the company further added.
Suggest an edit to this article
Check out our new Discord Cyber Awareness Server. Stay informed with CVE Alerts, Cybersecurity News & More!
Remember, CyberSecurity Starts With You!
- Globally, 30,000 websites are hacked daily.
- 64% of companies worldwide have experienced at least one form of a cyber attack.
- There were 20M breached records in March 2021.
- In 2020, ransomware cases grew by 150%.
- Email is responsible for around 94% of all malware.
- Every 39 seconds, there is a new attack somewhere on the web.
- An average of around 24,000 malicious mobile apps are blocked daily on the internet.
