Starting this week, Gmail users will begin to get a full-page warning when they click on a potentially dangerous link in an email message.
The notification will inform users that visiting the Website the particular link is pointing to could harm their computer. The alert will provide a link to Google’s Safe Browsing diagnostic page, from where users can get more information on the problems that Google has identified with the particular Website.
Also starting this week, Google will deliver enhanced warnings to recipients of emails that the company suspects may have been sent by a state-sponsored attacker.
Less than 0.1 percent of Gmail users receive such messages, Google engineers Nicolas Lidzborski and Jonathan Pevarnek wrote in the company’s security blog Thursday. But the ones that do are journalists, human rights activists, policy makers and others in important roles around the world.
Such users will now start receiving a full-page warning from Google if an email appears to originate from a state-sponsored attacker. The notice will inform the recipient about the possibility of a government-backed attacker attempting to steal his or her Google Account password to spy on the user and to steal the user’s data.
The message won’t tell users why or how Google may have determined the email is from a state-sponsored attacker. “We can’t reveal the tip-off because these attackers will adapt,” the notice will say while urging recipients to enable two-factor authentication and set up a security key for protecting access to their Gmail account.
The new notices build on existing protections that Google has in place for Gmail. For example, last month Google introduced a new visual element in Gmail—in the form of a red broken lock icon—to warn users about messages that were delivered without encryption, or about messages they are about to send to someone whose email service does not support encryption. Similarly, Google’s Safe Browsing technology already warns Gmail users about messages from potentially unsafe sources.
What the latest notifications do is make those warnings more explicit and prominent. According to Lidzborski and Pevarnek, Google’s focus is as much about protecting Gmail users as it is about promoting email security best practices across the industry.
For instance, Google’s decision to warn users about messages received from or sent to email service providers that haven’t yet adopted encryption has already begun to have a positive impact, the two engineers said. In the six weeks since the alerts were implemented, the amount of inbound mail sent to Google servers via an encrypted connection has shot up by 25 percent. “Given the relative ease of implementing encryption and its significant benefits for users, we expect to see this progress continue,” Lidzborski and Pevarnek claimed.
Going forward, Google will also work with other partners such as Microsoft, Yahoo and Comcast to promote proper use of Transport Layer Security (TLS) encryption across the Internet. The four companies have jointly submitted a draft specification to the Internet Engineering Task Force (IETF) for a standard that companies can use to ensure that mail is only delivered to them through encrypted channels, the Google engineers said.