3 ms·
On a related topic, I wish someone would implement "user-encrypted-at-rest" to protect me from the provider getting breached. I don't care so much for the tran
by gnyman 3y ago
On a related topic, I wish someone would implement "user-encrypted-at-rest" to protect me from the provider getting breached.
I don't care so much for the transit, but I'm a bit worried about the fact that I have many years of emails stored in "plaintext" (citation makes because they probably use FDE and maybe other encryptions but they can still read everything) on the providers server.
I'm not worried about a malicious provider, but worries they might at some point make a mistake which allows them to be hacked.
If anyone knows any solutions for this that works in iOS/Mac I'd love to hear.
The only thing I've found on this is some research a few years ago with ideas how to do this; but I haven't seen any implementations of it. I've linked to it here: https://www.cs.columbia.edu/~koh/papers/koh-eurosys19-e3_easy_email_encryption-final.pdf https://www.cs.columbia.edu/~koh/papers/koh-eurosys19-e3_eas...
- bartbutler 3y agoProton does this.
- upofadown 3y agoThat's actually the Protonmail feature that is causing the problem.
- twiss 3y agoNot really, grandparent is asking about what we call "zero access encryption" [1]: encryption at rest of received and sent emails, without the provider having access to the keys (unlike typical "encryption at rest", which doesn't give you much). Instead, OP is talking about outgoing end-to-end encryption using public keys from keys.openpgp.org. [1]: https://proton.me/blog/zero-access-encryption https://proton.me/blog/zero-access-encryption
- kjhcvkek77 3y agoDownload all the emails from the server. Create a backup dump file from your email client. Encrypt that with any program you like. Upload to eg Google drive. Verify the backup and then delete all the server-side copies of your emails.