Why don’t most web services use end-to-end encryption?

When talking about government monitoring user data on the Internet, we often find an important question: Why does the cloud services do not encrypt our data? Well, practically these companies encrypt your data, but they have the key so that they can decrypt it any time they like, so why not make use of end-to-end encryption. Let’s ask the real question, why don’t web services encrypt and decrypt our data locally, so they are stored in an encrypted form that no one can interfere with? We do not deny that some services do this, such as the LastPass password-encryption service.

How will end-to-end encryption be different?

To illustrate, your data may be encrypted, for example, Dropbox. When you connect to Dropbox, Dropbox transmits all data over an encrypted connection so no one can snoop on it during the transfer, and Dropbox also promises to store your files on their servers in an encrypted form.

However, encryption is a lock, so what is locked won’t be important if you don’t have the key to open it. Dropbox has an encryption key to view all your files on their servers, so while it’s encrypted, Dropbox has full access to them and they can collaborate with the government or an employee can browse the files.

The idea of ​​end-to-end encryption – you can also refer to it as “local encryption and decryption” – is different. With end-to-end encryption, data is decrypted only at the endpoints. In other words, email sent will be encrypted with end-to-end encryption at the source, and cannot be read to providers such as Gmail during the transition, then decrypted at the endpoint. It is critical that the end-user email is decrypted on his computer and will remain in the encrypted and unreadable form to an email service such as Gmail, which will not have the keys available to decrypt it. That’s much more difficult.

Upload and decrypt locally

The LastPass application uses local encryption and decryption via your web browser. It downloads an encrypted point containing your passwords, decrypts your password, and allows you to access your other passwords. Note that LastPass must download an entire store of passwords and other data to decrypt it. In the case of LastPass, this works well and in the end, it’s a fairly small file.

However, this will not be easy to do with other web services. For example, if Gmail works similarly, Gmail will have to download a file representing the entire 5 GB email inbox to your computer.

LocalStorage specification may use HTML5 encryption for this purpose if local storage can store more data. You will then have to decrypt this file locally to provide access to your incoming email, which will take some time. Gmail can do this differently, with a separate file representing each new encrypted email. But there’s a lot of complexity involved in designing an email client this way.

This can be quite impossible today as local storage is often limited to 5 MB or less per website in common browsers. The specification suggests that users should be able to increase this limit if they wish, but few browsers implement this.

No secure web applications

Cloud storage services like SpiderOak and Tresorit are different from Dropbox as they provide full local encryption and decryption. Just install the SpiderOak or Tresorit PC software and it will encrypt your files before downloading them, so the service itself never knows what to store.

However, these services are different from Dropbox in other ways as well, they do not encourage the use of a web interface for easy access. Dropbox provides a web application that gives you access to your files because it understands what these files are. While SpiderOak and tresorit don’t understand what you store, so it’s easier for them to only allow you to download all the encrypted dots using a program on your computer and let your computer program do the hard work.

These services should allow you to decrypt and understand encrypted file names, download the encrypted file to your browser, possibly via LocalStorage, use the decryption algorithm to decrypt it locally, and then prompt you to save it to your computer. But due to local storage restrictions, this will be impossible in practice.

No spam filtering, search and other smart features

Services like Gmail are a user’s favorite because they provide additional services rather than just a box that keeps all your email.

For example, Gmail checks your incoming email and runs a spam filter against it to determine if it is junk and indexes your email so you can quickly search through it. Gmail partially searches the contents of an email to determine if it is important and allows you to set up filters that automatically perform actions based on your email content.

All of these features depend on being able to understand your email. If they don’t have access, they won’t be able to filter spam, enable email filtering based on their content, or allow you to search your inbox. Many of the most important features depend on the service having access to your files.

No password recovery

Most online services provide password recovery services. However, for truly secure local encryption, there cannot be a password recovery mechanism when applying end-to-end encryption where you will have an encryption key that decrypts files. If you lose access to this key, you won’t be able to decrypt your files.

It will be impossible to provide a password reset mechanism unless the service is aware of the data contents. Services can do this now because your password is just a way to authenticate with your account. It’s not a mandatory code that makes your data accessible. Even if the services can easily switch to end-to-end encryption, this would give them a pause, as many users forget their encryption keys, lose their data, complain, and then move to an unencrypted service provider.

Your data is being sold by web services?

We won’t pretend otherwise as many companies that offer you online services also want to analyze your data and use it to make money. Google scans your email messages and uses the information they have about you, to deliver targeted ads, but at least those do not sell personal information to other companies. Unlike Facebook, which sells your personal information directly to other companies as it has appeared in its numerous scandals.

Those different companies need access to your data so they can do so, so they are motivated not to provide end-to-end encryption.

For all those reasons and more we find the end-to-end encryption feature unsuitable for the vast majority of cloud services. With the possibility that much of your data can be read in theory by other people. There may be easier ways to implement some encryption features, for example, by allowing users to send encrypted email through Gmail, but don’t expect all services to be encrypted from end to end any time soon.