Sending securely attachments over email

Question

Email exchange is not a secure means of communication despite using SSL to connect to (all/most?) the email providers.
What I am not sure though, is what is a good way to send important information via email in a secure way if the recipient is not a tech person.
Would sending a link to Google Drive containing the information and giving access only to the specific emails (non gmail) qualify as a good approach?
Are there any other to consider?

Answer 1

The answer to this really depends on both "how secure" and "how not technical" you're looking for. I'll evaluate my suggestions on those grounds, though. In roughly descending order of security (but roughly ascending order of ease-of-use):

1. GPG/OpenPGP: A well-established program, and the open standard it implements (respectively), for secure storage and transfer of data (primary via email). Extremely secure when used correctly, giving nobody at all a way to access or modify the data (unlike merely sending email via TLS, where the servers can do whatever they like with the messages before forwarding them to the recipient, OpenPGP is end-to-end encrypted). Notable in that it will let you send messages in plain text, optionally with a verifiable signature, and attach encrypted (and optionally signed) attachments, all using any email system or indeed any messaging network at all. Some email clients also have built-in support. Not extraordinarily difficult to use but probably more than you want to subject a non-tech person to, and kind of inconvenient for even tech people. Difficult to scale key distribution in a fully secure way, though there are approaches (especially if you are willing to accept some risk of impersonation, or can exchange keys in person).
2. S/MIME: A standardized protocol for end-to-end security of email. Similar to OpenPGP, but uses the same kind of certificates as TLS for key exchange. You can often find basic certificates for free; higher-quality ones cost money and take time (to verify your identity), but they have the advantage that there's a nominally-trustworthy entity (the certificate authority you get the cert from) vouching for the validity (this makes distribution way easier). Unlike OpenPGP, must be supported by the email client; most desktop mail clients (Outlook, Thunderbird, etc.) support it but most web interfaces do not and Gmail in particular is known to fail to handle S/MIME messages even with sent an desktop mail client. If everybody is already using Outlook or similar it's perhaps less technical than OpenPGP but for general use it's probably worse.
3. Password-encrypted files, probably archive formats, with passphrase exchanged out-of-band. Classical ZIP encryption is garbage, but some of the more modern encryption formats for things like 7z and even modern ZIP are... possibly not perfect but probably good enough. As long as the key/passphrase can be securely exchanged out-of-band (e.g. via in-person communication), this should be quite secure enough and end-to-end protected. Pretty simple technically-speaking but you do need to ensure that the sender and all recipients have compatible software for opening and decrypting the files (most programs that handle the same formats should have compatible decryption features, and some programs like 7-Zip are cross-platform).
4. Find a cloud storage service (such as Google Drive, Dropbox, OneDrive, Box, etc.) that the sender and recipient(s) both have accounts with. Upload the files to that service, share them with the other account, and (if necessary) send the recipient(s) a link to the item. This is generally secure against third parties but NOT against the storage provider - most of them do not provide any end-to-end security and explicitly retain the ability to access your files if necessary (as they see it) - so it requires trusting Google or whoever. It sounds like you're already considering this option, so hopefully it's not too technical.
5. If you both use the same email provider, and you trust that email provider, and that email provider requires encrypted connections (the good ones all do), then you can just send the emails directly. If Alice sends an email from her Gmail account to Bob's Gmail account, it will never be sent over the unencrypted Internet. (Microsoft's email services should provide the same protection, though I know less about their protections.) Obviously this one requires the most trust assumptions, but it's not actually less secure than sharing a link to a Google Drive item with somebody, and it requires no significant technical knowledge beyond basic use of email.

Note that putting a file in a cloud storage system and then just creating a sharing link ("Anybody with the link can access the file") and emailing the link is not actually more secure than just emailing the file directly. If you both have accounts on the same service, it's strictly less secure than sharing with their account directly.

There are a ton of other options, but they're all either specific to certain contexts (like both using one of the many services that aren't primarily for file-sharing but can do it) or using things that allow easy and secure file transfer but are not email (such as Signal).