Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When you send an email from GMail to someone what measures do they have in place to make sure that my email is not read by man in the middle attacks, or other servers that the email is routed through. If spam filters can read whats in the message then surely email is super dodge and we really should not be using email to send important information?

share|improve this question

migrated from superuser.com Dec 9 '10 at 4:14

This question came from our site for computer enthusiasts and power users.

If you're using GMail with a desktop/mobile client, all their SMTP and IMAP servers use TLS and SSL. Their web client now has HTTPS by default. These prevent simple packet sniffing between you and GMail. However, once it leaves GMail, it's just as vulnerable as any other e-mail traffic traveling the internets. – Belmin Fernandez Dec 8 '10 at 16:13
Email can and must be read by all the servers it is routed through. Usually it is not saved any longer than required. These days email generally goes from one organization to another without passing through intermediate servers. However, both organizations may pass the email through more than one server during delivery. – BillThor Dec 8 '10 at 17:29

Simply said; it isn't.
By security I'm guessing you mean that nobody else can read your mail.
In essence security depends on 3 points; A origin;B path, and C destination.

If you are sending mail from you computer; and you consider your computer secure; that's it for point A. If you are sending from webmail interface; gmail uses ssl that helps; but sending from your computer is still more secure.

in case of path; you need to encrypt in a way that will be difficult to crack; and agree with receiver how to decrypt it. For example pgp is quite popular and simple.

Everything mentioned for point A works for point C

share|improve this answer

"email is just plain text sent over multiple machines, all of them capable of reading the content of the mail"

to achieve what you want you have to accomplish 3 - 4 goals:

  • confidentiality: you do not want any 3rd party involved in transmitting the email to read the content, only the recipient
  • integrity: you do not want any 3rd party involved in transmitting the email to modify the email
  • authenticity: you want that the recipients knows that the messages comes from you
  • (liability: if you get an email from someone you want to be sure that (s)he and only (s)he sent it and that (s)he can't deny that (s)he sent it)

these goals are achieved by using cryptography. for email it is common to use either gpg or pgp. anything else is bogus, the ssl/https-connection towards the gmail-webinterface is just to protect your password to your account and the contacts etc, NOT the email you sent from within the interface since "

"email is just plain text sent over multiple machines, all of them capable of reading the content of the mail"

share|improve this answer
@ChrisF: ah, edited by you, honored :) – akira Dec 8 '10 at 14:38
+1 To reiterate: email is just plain text sent over multiple machines, all of them capable of reading the content of the mail – Sathya Dec 8 '10 at 15:30

Yes, you should not be sending confidential information via unencrypted email.

And since emails can and do get lost on the way to the recipient, you should probably not be sending important information in there either.

share|improve this answer

If you're sending confidential information from Gmail the G is reading and storing your email. I would be more worried by that than some (highly unlikely) man in the middle attack. Google scan everything, store it forever, pass anything 'suspicious' to the FBI, and use everything you type to profile and then advertise at you.

That's way more frightening than some snooper down the line. Which is unlikely given that the route your message takes through the internet is essentially random, and even to cover some of the possible routes the attacker would have to compromise either the large bulk servers at the ISP at one or other end of the route, or else the major servers on the internet backbone. How likely is that?

No, I'd be more worried by what you're letting Google see.

share|improve this answer
Conspiracy theories and misinformation are not particularly useful. – Robert Norris Dec 9 '10 at 20:38

only GPG can secure your email for 99%. But it cant secure if your receiver or you have some viruses in your computer =)

share|improve this answer

Gmail's now-default HTTPS setting encrypts the information between your browser and their servers, protecting it from third-parties that could try to access it from, say, public Wifi. Once you send an email, however, you're depending on the servers between you and your recipient, and there is no guarantee of security in that case.

share|improve this answer

Gmail now requires an HTTPS connection between you and the Gmail server(s). Further, all transfers between Google servers are similarly secured.

Where it goes after Google sends it off to your email server is anyone's guess. As has been mentioned, you should not send confidential information via email.

(Staying at the forefront of email security and reliability: HTTPS-only and 99.978% availability)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.