Hacker News Reader

Comment by simplicio | Hacker News Reader

Seems annoying. No one would rely on this to keep actual sensitive info private, since you can just screen shot it.

On the other hand, part of the point of Gmail is that it makes your emails easily searchable, so you can quickly dig up info from old mail rather than have to make a note of said info in some sepearate program/notebook/whatever. But if emails are going to randomly be disappearing, it could really cripple that utility.

View on HN

> No one would rely on this to keep actual sensitive info private, since you can just screen shot it.

It's more of a "please don't forward this" feature than a "you can't forward this" feature. It's the same with DRM features in Outlook. It stops people from accidentally leaking information, but it doesn't stop people who intentionally want to leak information.

In an ideal world telling the recipient not to spread this information (either by just asking or some kind of work policy) should be enough but sometimes having a small technical barrier is needed.

Also when information is leaked at a later time it can show intent on the leaker (vs saying something like "oops I fat-fingered the recipients when I forwarded that email to my personal account")

Why do people keep bringing up screenshots as some kind of evidence of something that was said? I can easily go into an email, bring up the source code, edit the email body to have some racist tirade, then screenshot the edited email and use that as “evidence” against a person.

Nobody is actually doing that. You are confusing evidence against someone versus "I better make a copy of this for myself before it stops working".

Then why not just copy and paste the text....

You'd have to go to some special measure to copy and paste the text because they disable the standard, easy copy/paste functionality.

But taking a photo is always doable. This is a standard argument. If you can't trust the recipient to preserve privacy then there isn't a technological way to defeat this kind of information leak.

You should be able to copy by disabling JavaScript

The typical way to avoid this particular problem is only to load the content via JavaScript while copy/paste are presumed disabled.

You can just use a browser dev tool like the chrome inspector to copy the text. I don't know what the big deal is.

What's to stop you from removing the event listeners disabling copy and paste through the console/dev tools?

You could use that CSS rendered font someone made a while ago to make it into an uncopyable text.

Screenshot to an OCR reader defeats that really quickly.

This whole argument about copying is rather silly, at some point the text must be transmitted in a human readable form. At which point it can be recorded either electronically, or in the most difficult case by writing down manually what must be copied. Everything else is a question of degrees.

If you happen to be on corporate computer, access to developer tools can be disabled via group policies.

email often has DKIM headers, which are fantastic for non-repudiation

Why? You can rotate your DKIM keys daily and there is nothing that'd prove that you used any particular key at a given time.

To some extend, the fact that gmail accepted a message indicates the email passed DKIM inspection.

Only if it had strict DMARC policy (reject) at the time of sending. But it's not possible to reliably check old values from the past. No policy or quarantine policy makes the email go to spam, that's all.

Gmail stores the DKIM check result in the header of the email.

For a more exhaustive system, one might store a DNSSEC result proving the key was valid. Though from my limited search, it seems DNSSEC does not sign a time-stamp.

> Gmail stores the DKIM check result in the header of the email.

That's an interesting idea. Unfortunately it makes Google a trusted third party. And a printout of that email would be easy to fake.

It would be nice if the report was signed by Google and timestamped (e.g. RFC 3161).

The same holds for forwarding or storing email. Both can be forged, but both give some form of preserving email.

Actual authentication is really difficult for anything.

> On the other hand, part of the point of Gmail is that it makes your emails easily searchable, so you can quickly dig up info from old mail rather than have to make a note of said info in some sepearate program/notebook/whatever.

It's slightly off-topic, but I've found since I switched to notmuch that offline search is much faster than online search. I can dig through my trove of gigabytes of email in fractions of a second: queries feel as though they're instantaneous.

This is a case where free software has caught up to & exceeded Google. It's pretty wonderful!

Many companies keep copies of emails received. If the email has sensitive info, it's going to be kept around even if you "delete" it from your inbox. That's what this works around. Now the archived copy will be worthless because it only contains a link to the real content.

I seriously doubt this is true if either party is using an enterprise gmail account (you know, the ones that render the bcc list on the recipient side without prompting the sender?)

>since you can just screen shot it.

The benefit with automated rention policies embeded in content is that it's less easy for the information to be weaponized ex post. I.e. Now that a couple has broken up, a vindictive partner doesn't have a full log of their communications that they can use to blackmail their partner. Basically it tips the balance back towards conversation and less dystopian log by making people who are attempting to log everything incur a cost rather than have them freeride on the logging system.

How does this stop google from indexing the emails?

I think we have different distopias in mind. :-)

Reply on news.ycombinator.com