> This is not our position, and I feel it is disingenuous of you to say that. Every time I’ve seen someone bring up ZKE, you demur or say that most of your cus

> This is not our position, and I feel it is disingenuous of you to say that. Every time I’ve seen someone bring up ZKE, you demur or say that most of your customers don’t need it because they are non-technical and their data is not sensitive enough to warrant that level of protection. Every time, you strongly imply that the only people who would need zero-knowledge encryption are criminals. (You’ve just done all of this again here.) If your position is not what I claimed, and you do think ZKE is something users need, I’d recommend that you spend your engineering budget on implementing it, instead of using that time to do things like rename your Git branches[0]. > Now sometimes people accuse Backblaze of not being a "zero knowledge" backup. What they are saying is that only #4 is "valid" and they really want Backblaze to stop offering #1, #2, or #3. Could you please give a link to an example of someone actually saying this? > Security Level 3 - Backblaze Personal Backup with a "custom" unrecoverable private encryption key. The private key for decryption is automatically generated and sent to Backblaze without any passphrase at install time. It doesn’t get replaced when the passphrase changes, so the original unprotected private key could just be stored and reused later. Setting a passphrase sends it to Backblaze (necessarily, since the private key is only stored on Backblaze servers), so that too could easily be stored (accidentally or intentionally). Restoration requires decryption on Backblaze’s servers, which both requires the passphrase to be sent and also puts all the user’s decrypted data onto persistent storage. All these design flaws make “Level 3” not meaningfully more secure than “Level 2”. Because of this, it seems to me to exist primarily as a marketing tool, rather than to meaningfully protect users from threat actors. I think we will probably have to agree to disagree on this point. > Security Level 4 - "Zero Knowledge". This is not a thing that Backblaze offer. Saying “hey, we have storage, use some third party software to get actually encrypted backups” is no different than me selling some server space and advertising it as “zero knowledge”. > This is a more secure system, but it is less convenient to restore. Outside of the issue of forgetting your backup passphrase, there’s nothing more inconvenient about a properly designed zero-knowledge backup. In fact, I would say that the way Backblaze works right now—requiring users to go to a web site to download a zip file, or have a disk sent in the mail—is way more inconvenient than most other backup software which restores directly from the client, including ones with ZKE like Arq and SpiderOak. [0] https://www.backblaze.com/blog/code-and-culture-what-happens-when-they-clash/ https://www.backblaze.com/blog/code-and-culture-what-happens...