If you are using an e-mail client, you will be connecting to the gmail server using STARTTLS, so your e-mails will not be transferred over the public internet in plain text.
If you use the web client, everything is over HTTPS, and, like the gp stated, probably goes nowhere beyond the database, although merely a supposition.
If you're using a client your mail is probably delivered to a local smtp server, might bounce around for a while, and is then delivered to gmail server. You don't know that the last step uses ssl/tsl. Even if it does, what about the 3 other servers it touched? Was it logged somewhere? Did the anti-spam store it? Was it even removed from the spool at all?
My point is, email was not designed to be "secure" (i.e., secret), and is not though that way. Therefore ppl do not work very hard to secure email, and one little band-aid doesn't magically make the whole system "secure".
Your mail could turn up in a log file 5 years from now.
The packets are routed over the public Internet, but if you're using HTTPS, they'll look like encrypted garbage to anyone who doesn't have Google's SSL private key.
It's nowhere near as rare as you think. There are sub-CA certs issued to private companies all the time, allowing them to MITM any default browser config.
I have a feeling he was referring to e-mailing yourself with g-mail's web interface (which you connection to is, typically, SSL Encrypted). However, as the data is still stored unencrypted on google's servers so... yeah, still sucks.
Since email generally traverses the internet unencrypted, the consensus is that it's already insecure. There's little to be gained by encrypting it after the fact.
Besides that, what key would they encrypt it with? Something from your password? What do they do with email you get while not logged in? How do you build a search index? I'm actually building something similar, and even after a lot of effort, there's tons of corner cases that simply cannot be protected, so it seems a reasonable guess that gmail does nothing special to encrypt your data.
[edit to add that once you include oauth in the picture, I think the encryption story starts getting really fuzzy.]
Even if the data is stored encrypted, Google can always decrypt it on an as needed basis (since they serve ads based on the content of the email messages.)
It doesn't really matter. Any method of server-side encryption for email (and many other) systems as we currently understand them has inherent flaws.
The simple fact is that key material is accessible in RAM, and even if it weren't, the data still must be decrypted at some point, and once the server is compromised, you can likely capture that decrypted data.
That's not to say you shouldn't do it -- it helps prevent accidents like unwiped drives getting out, and might be a reasonably effective obfuscation against some attacks, but it just isn't secure in the same way that real end-to-end encryption can be.
I beg to differ:
Or on windows: Now do correct me if I'm wrong. But those commands seem to show my packets being routed over the public Internet.EDIT: While the point about SSL is valid, see my post below.
EDIT2: And as stated above, having your passwords plaintext anywhere, espicially in the cloud, isn't ideal.