4 ms·
What I mean by end-to-end encrypted here is during transportation and at rest (not that it is never decrypted in memory). As you are pointing out, it obviously
by mshuffett 4y ago
What I mean by end-to-end encrypted here is during transportation and at rest (not that it is never decrypted in memory). As you are pointing out, it obviously has to be in memory as clear text at some point. But that is being done on a private VPC and only very briefly.
- alwayslikethis 4y agoThat's not end-to-end encrypted then. In an end-to-end encrypted system the server never sees the plaintext. I'm not saying that this is a must-have for something you are making, but please do not mislead people into a false sense of privacy.
- eddd-ddde 4y agoI guess he meant end to end where the other client is, well, the server. Haha
- ragnarok451 4y agoAny plans to use homomorphic encryption eventually? low priority rn but would be v nice to have
- mshuffett 4y agoWe've looked at things like this or federated learning as well. Definitely will keep our eye on it as we continue.
- lolinder 4y agoI believe that you didn't intend to mislead, but "end-to-end encryption" is a term of art and you don't meet the definition. It would only apply to your product if you had some sort of synchronization between clients and you didn't have the keys to decrypt that data. What you're describing is "encrypted in transit" and "encrypted at rest". Encryption in transit is table stakes for any software today, not a differentiator. As for encryption at rest, if I saw that I'd wonder why my email content is ever at rest on your servers. Again, I don't think you meant to mislead, but it's important to use terms of art accurately, especially when marketing to professionals in the field.