Google's 'End-to-End' Tool For Email Encryption Edging Closer To Release

Earlier this year, Google announced that it was working on a Chrome extension that would bring PGP-like end-to-end security for Gmail, ensuring the emails used with such a tool can't even be read by Google itself, nor anyone else other than the users exchanging information. The tool is still in the works, but the company has released an update about its progress and stated that the extension could be released as "alpha" sometime next year.

The descriptively named "End-to-End" extension was initially supposed to be only for Gmail, although since then Yahoo and a startup called MailPile (which has been working on adding easier-to-use PGP to its email clients) have also joined the effort. When the tool is finally released, we may be seeing other email providers adopting it as well.

End-to-end encryption for email hasn't seen mass adoption so far mainly because PGP is the only real way to do it, and PGP's key management is something the vast majority of users find very difficult to use. Glenn Greenwald famously almost missed nabbing the whole Snowden report because he couldn't figure out how to use PGP to talk to Snowden.

Google is trying to solve this in a way that has been usually frowned upon so far by PGP users: the company wants to keep its own Key Directory but also automatically assign public keys to users. This would mean that users would not have to deal with keys at all, and from their point of view they would just be using email the normal way. The whole end-to-end encryption process would happen in the background, although there should be some UI elements notifying the users that they are talking through an "extra-security" layer, or to another End-to-End user.

For the vast majority of email users, this is exactly how it should happen, because most people want something that "just works;" otherwise they won't use it. However, from an end-to-end security point of view, this could potentially be disastrous. In theory, either Google could be changing the keys itself, perhaps as a response to a secret government order, or some malicious hackers could break into Google's servers and change the keys. Then, a hacker could assign those keys to someone else, pretending to be the target's known friend.

Fortunately, Google has thought of a few ways to deal with this. One of them is the use of "Monitors," which would be independent third parties that would verify if the keys in the Key Directory are valid or whether the Key Directory has been compromised. The other is that the directory "can never be modified." Keys can only be added to the directory, but not changed.

The team behind End-to-End has also come up with a number of potential threats against the system and how to prevent them. All of that, along with more details about how the extension will work, can be found on the project's new Github page.

Follow us @tomshardware, on Facebook and on Google+.