Client-Side Encryption Debate

The cluster focuses on debates about client-side (end-to-end) encryption versus server-side or at-rest encryption in cloud services, emphasizing privacy risks when providers hold decryption keys.

📉 Falling 0.4x Security
5,313
Comments
20
Years Active
5
Top Authors
#4363
Topic ID

Activity Over Time

2007
5
2008
16
2009
24
2010
112
2011
178
2012
210
2013
459
2014
245
2015
294
2016
293
2017
374
2018
342
2019
280
2020
363
2021
529
2022
438
2023
427
2024
396
2025
283
2026
49

Keywords

AWS LiveDrive CC TrueVault FAQ ZumoDrive GP PS3 security.html TLS encryption encrypted data client server key encrypt access attacker decrypt

Sample Comments

ownagefool Jul 13, 2013 View on HN

It's technically possible with encryption. One cannot be sure that said encryption will not be trivially broken in the future, but theres a massive difference between using a service that doesn't know how to read your data now and one that does.

sunshinerag Mar 30, 2024 View on HN

I read it as the encrypted data is on the user's devices and not servers?

BorisEm Aug 10, 2020 View on HN

Files are encrypted at rest, but no end to end encryption, you're right.

hxa7241 Dec 14, 2008 View on HN

Their FAQ item says the data is stored encrypted.

eevilspock Apr 23, 2015 View on HN

I can't figure out whether they have client-side encryption with a user-specific encryption key that they do not have access to.

orthecreedence Mar 17, 2014 View on HN

Unless said app uses client-side encryption for everything.

Triv888 Feb 3, 2021 View on HN

The provider is me... so if I get hacked, they could get the data while it is unencrypted on the client side.

vukjanosevic Sep 23, 2020 View on HN

What encryption do you use for storage? It seems like an additional risk

exolymph Nov 10, 2018 View on HN

No, because the point of client-side encryption is that the service provider does not have the data to hand over.

sek Jul 2, 2011 View on HN

Absolutely, client side encryption is the only way to go in my opinion.