"When you send something to your friend Rabbit, your message doesn't actually go directly to him."
Lots of companies say that they encrypt data, but it’s important to know just what type of encryption they use. Unless companies specify that they use end-to-end encryption, they’re most likely only encrypting data in-transit and at-rest.
Here’s how messaging apps generally work. When you send something to your friend Rabbit, your message doesn’t actually go directly to him. It goes to the app’s servers, which then pass what you sent onto Rabbit. Often, the server doesn’t just relay your communication - it also keeps a record of it. If you can read messages from a year ago, it’s usually because they’re stored on the company’s servers. When you open an old message, the app finds it on the servers and sends that record back to you.
It’s important to protect your online communication with encryption. When your message is traveling around the internet, it’s easy for a hacker to get a hold of it.
Encryption uses a key to scramble your communication into unreadable text. The only way to turn that encrypted gibberish back to its original form is by using the correct decryption key.
"Encryption uses a key to scramble your communication into unreadable text."
Someone who gets a hold of your encrypted message, but doesn’t have the right decryption key, won’t be able to read what you sent.
Lots of companies use some kind of encryption when you share your information with their server. Any time you see “https” instead of “http” in the URL, it means that the data you’re entering is encrypted in-transit. For example, Slack, the popular team collaboration platform, encrypts your content both in-transit and at-rest. Peerio, on the other hand, uses full end-to-end encryption.
So what’s the difference between these three ways to encrypt?
1. Where your information is encrypted
In-transit encryption encrypts information as it travels between devices and an app’s servers. This means your message to Rabbit is encrypted while it travels from your device to the messaging app’s servers, and after it leaves the servers to get to Rabbit’s device. But the record of your communication is left unencrypted on the servers.
At-rest encryption encrypts your information when it’s inactive on a server, like when it’s in an archive. Any time information is active, it isn’t encrypted. So the message you’re sending to Rabbit right now isn’t secured while it’s on its way to him. And when the server temporarily stores your message on its memory for reading and updating, that’s also unencrypted. And any time Rabbit opens one of your old messages, the app’s server sends them to him unencrypted. So at-rest encryption means your communication with Rabbit is encrypted only when it’s just sitting, inactive, on an app’s servers.
End-to-end encryption encrypts your message right on your device, and it stays encrypted as it travels to an app’s servers, then from the servers to Rabbit. And when your message is stored on the server, any server, it’s always encrypted. Whenever you pull up an old message, the server is sending that still encrypted record back to you. Your information is never not secured. It is only decrypted on your device.
An app that only uses in-transit encryption leaves your communication vulnerable whenever it’s stored. An app that only uses at-rest encryption leaves your communication open to attackers when it’s traveling to Rabbit or on Rabbit’s computer memory.
You might be thinking: there must be a way to get around these problems. What if an app uses in-transit encryption and at-rest encryption together? That way, your communication would be encrypted when it’s traveling to the servers and when it’s traveling from the servers to Rabbit. Plus, the record of your communication would also be encrypted. Is the combination of in-transit and at-rest encryption as good as end-to-end encryption?
Well, end-to-end encryption isn’t simply more comprehensive than the other two. There’s also the issue of keys.
2. Who Owns the Keys
Even if an app uses in-transit and at-rest encryption together, your communication is still at risk. This is because both in-transit and at-rest encryption uses keys that belong to the company that owns the app you’re using. The same servers that relay and hold your communication also stores the keys to decrypt all that information.
Let’s say a hacker, Owl, breaks into your messaging app’s servers. She can steal your encrypted communication and the company’s keys. And with decryption keys in hand, Owl can read everything. She can intercept your message on its way to Rabbit and open it with her new decryption keys. She can also take the encrypted record of your whole conversation and comb through everything.
"Even if an app uses in-transit and at-rest encryption together, your communication is still at risk."
Besides, the people who run the app you’re using can also decrypt your messages whenever they want. With full access to your communication history, the company could use it for anything - like selling it to advertisers or other agencies.
End-to-end encryption works differently. The actual process is pretty complicated, but the basic principle of end-to-end encryption is called asymmetric key encryption. With asymmetric key encryption, everyone has two different keys: a public key that other people can use to encrypt stuff to you, and a private key that only you can use to decrypt what other people send you.
Asymmetric key encryption is sort of like a locked mailbox in a public location. Anyone can drop a letter into this public mailbox, but only one person can unlock the box and access the messages inside.
When you send something to Rabbit, your message is encrypted with his public key. Everyone else can use that same public key to encrypt their own messages to Rabbit. But the only thing that could decrypt all those messages is Rabbit’s private key, which is associated with a password that only he knows. And no one else has access to that key, not even the app that’s relaying and storing all your communication with Rabbit. The same applies to anything that other people encrypt to you, using your public key. Only your private key can decrypt it.
Now, let’s say Owl hacks into the servers of an end-to-end encrypted app like Peerio. She can steal the encrypted record of your communication with Rabbit, but she’ll have no way to decrypt any of it. All she sees is gibberish. Even people working at Peerio have no way of opening these messages, even if Owl tries to make them do it.
"Even people working at Peerio have no way of opening these messages."
What Does This Mean for You?
So, in-transit encryption means that your communication is only encrypted while it travels between devices and servers. At-rest encryption means that record of your communication is only encrypted when it’s stored and not being used. Both of them use keys that belong to the company running the servers. End-to-end encryption, on the other hand, encrypts a message right on a user’s device, using encryption/decryption keys that belong to the recipient. And it always stays encrypted that way.
Now that you know the difference between these three types of encryption, it’s important to dig deeper whenever you see a company talk about encrypting its data. Is it using in-transit encryption, at-rest encryption, or both - all of which can compromises your privacy? Or is it true end-to-end encryption?