New feature of coded Gmail messages opens up a door for fraud

Google announced in early April that it is starting a simplified tool that will allow business users to send easily E-mail “coded from bottom to bottom”An attempt to address the long challenge of adding additional security protections to e -mail messages. The feature is currently in beta for enterprise users to try within their organization. Will then expand to allow Google’s work space users to send emails coded from bottom to bottom cheer user. By the end of the year, the feature will allow users of the workspace to send the safest emails to each box. Email and digital spam scholars warn, however, that while the feature will provide a new opportunity for the intimacy and security of emails, it will also inevitably create new Phishing attacks.

End to the bottom is a protection that keeps the scrambled data at any time, except on the sender and recipient equipment, and it is difficult to add to the historic email protocol. The mechanisms to make it are usually very complicated and costly to be implemented and only make sense to large organizations that try to meet the specific compliance requirements. In contrast, the emails coded from the bottom to the end of the Google is simple to use and does not require the important one. The scenario for which digital fraud researchers are more concerned, however, relates to the case where a workspace user sends an email encoded from bottom to bottom for a non-gmail user.

“When the recipient is not a Gmail user, Gmail sends them an invitation to see E2EE email in a limited version of Gmail,” Google wrote in a blog post. “The receiver can then use a Google Workpace guest account to see and respond to email.”

The fear is that fraudsters will benefit from this new and safer communication mechanism by creating false copies of these invitations containing malicious links, and quick objectives to access their credentials for their email, single entry services or other accounts.

“Looking at Google implementation, we can see that it introduces a new workflow for non-Gmail users-getting a link to see an email,” says Jérôme Segra, senior director of the intelligence of threat to malwarebytes. “Users still cannot be known exactly what a legitimate invitation looks like, making them more sensitive to clicking on a fake.”

Given the technical restrictions of the email, Google created a way for an organization’s work space to automatically manage keys – used to descramble coded messages. The main management is what makes the coding email from bottom to bottom, so providing a solution that is easy for customers is a departure from what is currently available. The fact that the workspace of the organization controls the keys instead of storing them in place on the equipment of a sender and recipient means that the feature does not qualify enough as encryption from bottom to bottom in the most strict sense of the term. But researchers say that for the use of cases such as business compliance, the tool can still be extremely useful. And individuals who want coded communications from the bottom to the end should simply use An application built with goals as a signal.

When Gmail users receive one of the new e -mail coded by a Google WorkSpace user, a wide set of spam’s dynamic filters and fraud detection mechanisms will be in the game to protect against spam, phishing and deceitful imposes. But email users outside the Google ecosystem will be able to receive email coded invitations, which makes the service available to anyone but will also leave non-google users on their equipment.