I do not understand why for over a decade Google resists implementing end-to-end encryption in Gmail.
For example, it would help with "man-in-the-middle" attacks they are citing as motivation from MTA-STS.
For example, it would help with "man-in-the-middle" attacks they are citing as motivation from MTA-STS.
Google is not resisting, they would implement end-to-end if they could, but they can't.
FWIW: As long as the email does not leave Google (i.e. an email between 2 gmail inboxes) it is actually already encrypted end-to-end (AFIAK).
> FWIW: As long as the email does not leave Google (i.e. an email between 2 gmail inboxes) it is actually already encrypted end-to-end (AFIAK).
no, end-to-end means from user1-to-user2, not from user1-to-gmail and then from gmail-to-user2 (ie: gmail should never be able to see the content of your communications if it was truly end-to-end)
Long story short, to control spam, you basically have 2 options:
1. Control who can send messages 2. Inspect message content 3. Impose costs
Signal and WhatsApp chose (1). E-mail (and probably any federated protocol) requires (2) or (3), and there is no universally-adopted (3) for e-mail.