6 ms·

I wonder how large is the submarket of developers aware of the need to encrypt data ... And also OK to bring a third party like evervault into the deal.

ithkuil 5y ago
Perhaps it's not as small as you think. It all depends on who is the adversary in your threat model. If you have applications that run in the field, and need to perform computation on data you don't want to be seized if the adversary gets hold of the device itself (state or private agents), then this may be a relatively low cost way to address this concern. If you search for a solution for all possible threat models, well homomorphic encryption would all the boxes except it's too slow for doing anything practical with it.
- tmikaeld 5y ago
  If someone has access to the physical device, that device need to be able to display the actual data = the device has the "secret" information already.
  - ithkuil 5y ago
    if you need to output the secret, then you have no use for offloading computation on encrypted data. There are scenarios where you can compute on encrypted data and produce a result that doesn't leak the entire data.
    - tmikaeld 5y ago
      That is a use case, sure, but this service doesn’t provide computations, only management of keys.
      - ithkuil 5y ago
        I don't know; I just read what's written on their home page: Evervault Cages Process the data you encrypt with Relay or our SDK by deploying your code in Cages — isolated serverless functions hosted on Evervault. Cages automatically decrypt your data in an isolated environment, so you can still process data without handling it in plaintext. perhaps I misunderstood what that feature is; if that's true I suspect it's not entirely my fault, but there is something misleading in the product description.
        tmikaeld 5y ago
        No, you're right, I missed that feature.
    - kodah 5y ago
      > There are scenarios where you can compute on encrypted data and produce a result that doesn't leak the entire data. I believe what you're referring to is homomorphic encryption.
      - ithkuil 5y ago
        Yes I did mention that technique in my comment upthread. But there is a more simple stupid way: just perform the computation somewhere else, on some server you own, one some server you rent, on some service you rent... From the POV of the device in the field it doesn't really matter.
tmikaeld 5y ago
Was thinking the same thing, there's a reason encryption and auth software is open source and run internally (like hashicorps Vault). Is it easier to use than setting up a Vault cluster? Yes, without a doubt, so for building new things as a single developer, it definitely has a market. It would be more difficult on larger businesses though, since they have internal processes & certifications, that now need to rely on a 3rd party.
tailspin2019 5y ago
Yeah I would definitely be wary about this. A self-hosted option, even if not open sourced, seems like a no-brainer to me. Nothing wrong with providing it as a SaaS as well. Also being in the EU the first thing I look at is where the company is based and/or where they host my data, but I've trawled through this site and cannot seem to find a company address anywhere or details of their hosting setup? Nor is there a single "Security" page which outlines their credentials and security measures. I feel like these are critically important for a business like this which needs to build trust with potential customers. The website design looks superb though and the product is definitely interesting. EDIT: Ah noticed on the jobs page that they're in Ireland, but looks like their app front-end is hosted on Vercel and (per below) backend on AWS. EDIT: And further confusion from the "Evervault Inc" in the footer and "Evervault Ltd" on Privacy Policy page. I'm not clear if this is an Irish company (and therefore covered by EU law) or a US company? These details are important for potential European customers.
- tmikaeld 5y ago
  They use AWS and their security enclaves called Nitro [0][1] [0] https://aws.amazon.com/ec2/nitro/ https://aws.amazon.com/ec2/nitro/ [1] https://evervault.com/blog/e3 https://evervault.com/blog/e3
  - tailspin2019 5y ago
    Thanks! Well I did ask for detail and [1] certainly delivers that...! Definitely still needs an exec summary "Security" page though with a callout to relevant blog articles if necessary.
    - arcurn 5y ago
      This is a great suggestion, thank you! We'll get to work creating this.
arcurn 5y ago
Hi! Founder of Evervault here. You're totally right in saying the number of developers who are actively integrating encryption is pretty small as of today. What we're trying to do is improve developer experience to a point where encrypting all sensitive data is a no-brainer. Still early days here, but we're expending a lot of energy to make this happen. Re: third-party dependency — we think the same way at Evervault. We bring third-party vendors into the mix if we think they can build something better than we could do ourselves, which is why we partnered with AWS on their Nitro Enclaves[0] product. Our root of trust is the AWS Nitro System. For customers who still aren't comfortable with us managing their security posture, we also offer on-prem and in-VPC options. [0]: https://evervault.com/blog/e3 https://evervault.com/blog/e3
- taylorhughes 5y ago
  Really appreciate the plain "how it works" section just below the fold on the homepage. So many security products offer fluffy marketing pages — it's clear what this does from an implementation perspective right away.
anshublog 5y ago
I am founder & CEO of Skyflow PII data privacy vault. We are vaguely similar but our product line is focused on offering "PII database as a service" - and not really relays and cages. Happy to answer any questions. To answer your question: "market for encrypting data" is infinite but in reality that's not really a market since encryption is a concept and not really a product. The markets that do exist are: * GDPR & CCPA compliance (think OneTrust) * Data Residency (think Cloudflare) * Data Security as a Service (think Okta/Auth0) * Customer Data Management (think CRM)
ignoramous 5y ago
> I wonder how large is the submarket... large enough to warrant a crypto-currency: https://build.scrt.network/
- anshublog 5y ago
  By that definition, everything is a trillion dollar market. :)

ithkuil 5y ago

Perhaps it's not as small as you think. It all depends on who is the adversary in your threat model. If you have applications that run in the field, and need to perform computation on data you don't want to be seized if the adversary gets hold of the device itself (state or private agents), then this may be a relatively low cost way to address this concern. If you search for a solution for all possible threat models, well homomorphic encryption would all the boxes except it's too slow for doing anything practical with it.

tmikaeld 5y ago
If someone has access to the physical device, that device need to be able to display the actual data = the device has the "secret" information already.
- ithkuil 5y ago
  if you need to output the secret, then you have no use for offloading computation on encrypted data. There are scenarios where you can compute on encrypted data and produce a result that doesn't leak the entire data.
  - tmikaeld 5y ago
    That is a use case, sure, but this service doesn’t provide computations, only management of keys.
    - ithkuil 5y ago
      I don't know; I just read what's written on their home page: Evervault Cages Process the data you encrypt with Relay or our SDK by deploying your code in Cages — isolated serverless functions hosted on Evervault. Cages automatically decrypt your data in an isolated environment, so you can still process data without handling it in plaintext. perhaps I misunderstood what that feature is; if that's true I suspect it's not entirely my fault, but there is something misleading in the product description.
      - tmikaeld 5y ago
        No, you're right, I missed that feature.
  - kodah 5y ago
    > There are scenarios where you can compute on encrypted data and produce a result that doesn't leak the entire data. I believe what you're referring to is homomorphic encryption.
    - ithkuil 5y ago
      Yes I did mention that technique in my comment upthread. But there is a more simple stupid way: just perform the computation somewhere else, on some server you own, one some server you rent, on some service you rent... From the POV of the device in the field it doesn't really matter.

tmikaeld 5y ago

Was thinking the same thing, there's a reason encryption and auth software is open source and run internally (like hashicorps Vault). Is it easier to use than setting up a Vault cluster? Yes, without a doubt, so for building new things as a single developer, it definitely has a market. It would be more difficult on larger businesses though, since they have internal processes & certifications, that now need to rely on a 3rd party.

tailspin2019 5y ago

Yeah I would definitely be wary about this. A self-hosted option, even if not open sourced, seems like a no-brainer to me. Nothing wrong with providing it as a SaaS as well. Also being in the EU the first thing I look at is where the company is based and/or where they host my data, but I've trawled through this site and cannot seem to find a company address anywhere or details of their hosting setup? Nor is there a single "Security" page which outlines their credentials and security measures. I feel like these are critically important for a business like this which needs to build trust with potential customers. The website design looks superb though and the product is definitely interesting. EDIT: Ah noticed on the jobs page that they're in Ireland, but looks like their app front-end is hosted on Vercel and (per below) backend on AWS. EDIT: And further confusion from the "Evervault Inc" in the footer and "Evervault Ltd" on Privacy Policy page. I'm not clear if this is an Irish company (and therefore covered by EU law) or a US company? These details are important for potential European customers.

tmikaeld 5y ago
They use AWS and their security enclaves called Nitro [0][1] [0] https://aws.amazon.com/ec2/nitro/ https://aws.amazon.com/ec2/nitro/ [1] https://evervault.com/blog/e3 https://evervault.com/blog/e3
- tailspin2019 5y ago
  Thanks! Well I did ask for detail and [1] certainly delivers that...! Definitely still needs an exec summary "Security" page though with a callout to relevant blog articles if necessary.
  - arcurn 5y ago
    This is a great suggestion, thank you! We'll get to work creating this.

arcurn 5y ago

Hi! Founder of Evervault here. You're totally right in saying the number of developers who are actively integrating encryption is pretty small as of today. What we're trying to do is improve developer experience to a point where encrypting all sensitive data is a no-brainer. Still early days here, but we're expending a lot of energy to make this happen. Re: third-party dependency — we think the same way at Evervault. We bring third-party vendors into the mix if we think they can build something better than we could do ourselves, which is why we partnered with AWS on their Nitro Enclaves[0] product. Our root of trust is the AWS Nitro System. For customers who still aren't comfortable with us managing their security posture, we also offer on-prem and in-VPC options. [0]: https://evervault.com/blog/e3 https://evervault.com/blog/e3

taylorhughes 5y ago
Really appreciate the plain "how it works" section just below the fold on the homepage. So many security products offer fluffy marketing pages — it's clear what this does from an implementation perspective right away.

anshublog 5y ago

I am founder & CEO of Skyflow PII data privacy vault. We are vaguely similar but our product line is focused on offering "PII database as a service" - and not really relays and cages. Happy to answer any questions. To answer your question: "market for encrypting data" is infinite but in reality that's not really a market since encryption is a concept and not really a product. The markets that do exist are: * GDPR & CCPA compliance (think OneTrust) * Data Residency (think Cloudflare) * Data Security as a Service (think Okta/Auth0) * Customer Data Management (think CRM)

ignoramous 5y ago

> I wonder how large is the submarket... large enough to warrant a crypto-currency: https://build.scrt.network/

anshublog 5y ago
By that definition, everything is a trillion dollar market. :)