Privacy Limited
Features
Pricing
Blog
About
Contact Us
5 June 2022 
By Denote
Managing private data is a challenging proposition to a Cloud Service Provider (CSP) such as Apple, Google, Netsuite, SalesForce, DropBox, Amazon, Microsoft and many more. That data is often incredibly sensitive and the loss of control of it, such as during a cyber attack, is damaging to the company and to their customers. However it is also valuable, and sharing it earns the company significant revenue. What are they to do?
In almost all instances, the CSP chooses to share, get the revenue, and protect it as best they can. Most CSPs have certifications (such as ISO27001 and SOC2/3) which show they have policies, and practices to ensure they and their customer's data is secure. These certifications are hard work, and reflect their acknowledgement that they really don't want to lose control of the data they hold. And yet it still happens - a website for checking whether your personal data has escaped (haveibeenpwned.com - a worthwhile site to visit and check) currently lists 11 billion account records that they have retrieved from places like the dark web. Each record represents some user information that has escaped the control of some company, and could be anything from an email address, passwords, home addresses to Biometric data.
All the companies controlling your data really don't want to lose it - but despite their best efforts, it still gets out. How could that be stopped?
The best possible answer is to not collect user data at all. It's a toxic asset full of risks, but it's also incredibly valuable to a company living off its use.
The next best answers are:
Many companies get the first right, very few get the second.
So what is End To End Encryption (E2EE)? To answer this - lets look at the various types of encryption companies use to manage your data.
All CSPs, and indeed most trustworthy websites, will provide encryption in transit which means encrypting data as it travels over the internet. The standard for this is TLS (Transport Layer Security) which replaced the obsolete SSL (Secure Sockets Layer) although the terms are often used interchangeably. TLS causes your data to be encrypted before it leaves your machine and then decrypted once it arrives at the destination service. The service gets a decrypted copy of your data (known as "in clear").
TLS also verifies that you are talking to the website you think you are and eliminates most Man-In-The-Middle attacks.
If TLS is active, you will see a lock icon (or some variant) in your web browser's address bar:
In most browsers, you can click on that lock icon to see the certificate details for the website you are talking to.
Most CSP's also provide encryption at rest, meaning any data they store is encrypted as it is written to disk. While this sounds useful against against people stealing the hard drives from the servers, the most common threat it protects from is disposal. It is not uncommon for companies to discard hardware when it is end-of-life and to have that hardware picked up or repurposed by other organisations. In fact - one analysis of 200 old drives purchased on Ebay and Craigslist found 67% of them contained recoverable information, include PII (Personally Identifiable Information) such as names, addresses and SSNs.
Fortunately these are less-likely attack vectors in the cloud because those servers and drives are managed by companies like Amazon (AWS), Google (Google Cloud) and others who are all certified with ISO27001 or SOC3, and therefore have very good disposal practices for old drives.
Far more likely attack vectors include privilege escalation, account takeover, or simply reading unprotected data, which allow the attacker to read your data using the company's own tools or via a web browser, thereby bypassing any protection provided by encryption at rest.
Encryption At Rest is useful, but less than you think.
End to end Encryption (E2EE) is the gold standard for data protection. The company that holds the data (Denote, for example as your CSP) does not have access to your decryption key, and so the data being held is simply encrypted bits that are completely incomprehensible. Your data can only be read after being downloaded to your device and decrypted with your key. If hackers could get access to data stored by a CSP who uses E2EE, they would be able to download those same encrypted bits, which are useless.
There are very few CSPs that provide end-to-end encryption. Here are a few that do use it:
Most CSPs do not provide E2EE - instead they provide marketing literature that makes their encryption sound good (in transit and at rest) - but the CSP still has full access to your data to be shared and monetised as they wish.
Examples are:
and many more...
Here is an example from Dropbox's website:
Dropbox encryption statement from https://www.dropbox.com/en_GB/business/trust/security/encryption
Note that they mention in transit and at rest only - Dropbox do not provide end-to-end encryption. Back in 2012, Dropbox misconfigured their service and allowed a small number of users to see other users' data. If they used E2EE, this mistake wouldn't matter because no-one can decrypt another user's data.
We raise this as an example and not to malign Dropbox - they are a great company with a fantastic product and very secure practices. But their security story is limited by their lack of E2EE.
Wired have an excellent article on why end-to-end encryption should play a central role in modern self defence. They contend that you don't actually have to be doing anything wrong - future laws might criminalize your actions, and some current laws are bad. End to end encryption is essential for protecting you and your future.