11 ms·
>while all organization accounts are end-to-end encrypted, it is still possible for organization admins to access the emails of other organization users. Thus,
by ComodoHacker 9y ago
>while all organization accounts are end-to-end encrypted, it is still possible for organization admins to access the emails of other organization users. Thus, organizational oversight and management is still possible, even with end-to-end encryption. Furthermore, administrative read permissions are also granted or revoked automatically when admin users are created or demoted.
I wonder how can they provide this without either storing encryption keys on their servers or reencrypting (client-side!) all email during such events.
- bartbutler 9y agoIt's a key escrow system. The admins hold a copy of the user's key, and promoting a new admin involves giving access to this key.
- ComodoHacker 9y agoSo where is this copy stored?
- ThePhysicist 9y agoInteresting! You could probably do it by using the key of an existing admin to decrypt the escrow key and then reencrypt it with the public key of the new admin, all client-side.