What do we mean, simply speaking, by Encryption and End-to-End Encryption?

And why End-to-End Encryption is the most secure and private way to protect your data…

You always hear about “encryption”, whether with your online bank account, your search engine, your cloud service, or even WhatsApp. But what does it actually mean?

Simply put, encryption is a method for hiding and protecting your files so that only people with the password (aka the key) can access it. Your info is converted into something that’s not readable, and with your password you can open it and read it.

Let’s explain how end-to-end encryption differs from standard encryption.

Standard encryption: What does encryption mean?

Let’s explain and illustrate with two well known providers you’re probably familiar with: Google and Dropbox. They use “standard encryption”, which combines two approaches:

1)“In-transit” encryption: it protects your information or data being transferred over the internet, when it’s being sent between devices or to a server. Your data is only protected on the network i.e. on the internet. Practically speaking, when you send your data to Google, it’s encrypted and protected when it’s on the internet. When it arrives to Google, though, it gets decrypted, and Google handles your data in clear, so they can read everything you send to them once it reaches their servers. That means your data is safe when it travels on the internet until it reaches their servers. It basically guards your data from unauthorized interception. Not encrypting your data “in transit” is like sending a letter through the post without an envelope. Anyone can intercept it, read it, and even edit its contents.

2) “At rest” encryption: it protects your data wherever you’ve stored it, whether it’s on your hardrive, or on your cloud provider’s servers (e.g. Dropbox). For example, you’ve put some sensitive bank details into your cloud using Dropbox. You definitely don’t want that to fall into the wrong hands. Dropbox will encrypt this “data at rest”, essentially converting this sensitive data into something unreadable by anyone who does not have an encryption key to decode it. Only authorized personnel will have access to these files, thus ensuring that your data stays secure (at least from the outside world). Thing is, again, just like with Google, your files are decrypted by Dropbox, as it has the encryption key, and thus it gets to decrypt your sensitive data.

“Encryption at rest” is like storing your data in a vault and “encryption in transit” is like putting it in an armored car for transport. It’s harder to intercept, access, or transform. But it still doesn’t prevent the likes of Google or Dropbox to access the data, as they have the key to the vault.

Standard encryption means these companies e.g. Google, Dropbox protect your files from the whole process these files go through, but they don’t protect your files from them, as they can access your info once it reaches them. They have your files’ encryption keys. The main reason they do this is because they need to process the info. Why? because that enables them to offer some functionalities (e.g. it enables Dropbox to provide “block-level file copying”, i.e. only the modifications of your files are sent to Dropbox, which reduces the size of the uploads and therefore goes faster. But that requires processing of information, which means Dropbox needs to access your file info in their servers. For more info here is a nice article explaining it). In order to do so they need to access your data to be able to handle it and to work with it, which means it gets decrypted once it reaches their servers. Another reason for them to use standard encryption is simply that this kind of encryption is much easier to set up than End-to-End Encryption.

Without specifying these approaches to encryption, “encryption” is just a vague generic term that we use to talk about protection of your data, but it doesn’t specify at which stage it is encrypted. Just like the cloud, these are big terms we use that mean everything and nothing at the same time. End-to-End Encryption is a more specific term that requires high-level encryption.

What about End-to-End Encryption (E2EE) ?

With E2EE, nobody decrypts your data, but you. Once your data leaves your device, it’s encrypted, and it stays so through the whole circuit of where your data flows. At no point is it decrypted. It’s only when it comes back to you that the info can be read again. Your data is protected at every level, and no one has the key to decrypt except you. For example, say you’ve got your phone and your computer, and you’re using an “end-to-end encrypted” cloud service. You upload a picture you took with your phone to your cloud. The picture gets encrypted before leaving your phone. It then goes through the internet, the servers, etc. Then only when it comes back to you, the moment you take your laptop and download that same picture from the cloud is it decrypted. Let’s illustrate with another example: messaging apps (e.g. WhatsApp, Signal). I send you a message: “I’m hungry”. This message gets encrypted/becomes unreadable right before leaving my phone, when I hit send, stays encrypted throughout the whole path it follows in order to reach you, going through the internet, as well as the provider’s servers (WhatsApp), and only gets decrypted/becomes readable once reaching your phone. That’s how E2EE works. It’s always encrypted outside your own personal devices. And that differs from standard encryption (“in transit” and “at rest”) where only some parts of where your data goes are protected. With E2EE it’s the whole circle that’s protected, until it comes back to you.

To summarise these points: standard encryption is just a way for your provider to protect your data from the “outside world”, however that very provider has access to it once it reaches its servers. Obviously this gives rise to important security and privacy concerns. Whereas with E2EE, no one has access. That makes E2EE a lot more secure and private than standard encryption.

So… Why don’t most cloud companies offer End-to-End Encryption?

1) It’s very hard to do, technically speaking.

2) Some companies might want access to your data for, say, advertising purposes…

3) Most companies don’t offer E2EE because they need access to your data to be able to provide all the functionalities of a full cloud. Some functionalities require some data processing which generally happens on the server, which means they need to be able to decrypt the data on their servers (and that cannot be done with E2EE). Unless… unless you manage to remove the need for server…. Which is what we did with Duple.

What we do with Duple: the best of both worlds!

What we’ve developed at Duple is completely new: we’ve eliminated the need for a server to have a full cloud, and therefore removed all the data processing from the server. So there is no server processing required. All the data processing required to have a full cloud is done on the client-side. Which means all this happens in the user app, on your device. And once the data is processed, on your device, it’s encrypted. It can go around, travel safely. Nobody can read it. There’s no need for us at Duple to handle info. So we don’t read it, we don’t handle it, we don’t work with it, we don’t store it. We cannot access it. And that allows us to give every functionality a normal cloud company does while providing E2EE. The best of both worlds without the negative points!

Please note: you also are responsible for the protection of your data!

It is important to note, though, that no matter how high the encryption level is, it is also your responsibility to protect your data on your devices. There’s only so much encryption and E2EE can do to protect your data. E2EE means only you can read and decrypt your data on your devices. But what is that really worth if you don’t protect your own devices? I can easily access your phone if your pin code is weak e.g. 1234 (or worse, if you don’t even have a pin code), and as a result read your private info there. I then get access to your Facebook, WhatsApp, your email. I reset the passwords for all these apps, maybe even including your online bank account, and take control of absolutely everything. An attacker could also drop some spyware on your phone and read your E2EE messages (before they are encrypted or after they are decrypted). At the end of the day, you are also very much responsible for the protection of your data on your devices. Setting strong passwords, installing security updates (apps and operating system), etc. This is all done by you. We’ll soon release a blog post addressing these issues and providing tips on what you can do to maximise your data protection on your devices.

Thanks for reading! Follow us on Twitter, Linkedin, Youtube for more blogposts/videos on topics related to online privacy and security.

Originally published at https://blog.duple.io.