Once upon a time, the biggest fear in network security was the man in the middle — the guy who sits between two communicating computers, intercepting their traffic, stealing passwords, and even hijacking sessions. But encryption caught up and made things more and more difficult for him. Security protocols like TLS, HTTPS everywhere, VPNs made attacks harder, noisier, and riskier to pull off.
But while we were busy securing the pipes, we forgot to lock the ends.
As the founder and principal architect of SealedWeb, I wear two hats every day: that of an application developer, and that of a privacy advocate. For the developer, the man at the end is the malicious user; for the privacy advocate, it’s the server administrator. I keep moving between both ends of the pipe to figure out how much of a threat each side can potentially be.
Ergo, for all practical purposes, the real threat for most users today is what I term as the man at the end (vis-à-vis the man in the middle).
-
For software service providers, it’s the malicious user exploiting APIs or scraping data.
-
And for end users of services, it’s the server personnel — the quiet observers at the service provider end who can see everything, store everything, and (sometimes) sell everything.
Encryption in transit works great guns — but the question still remains, what about after the data has arrived, when data is at rest?
At SealedWeb, we truly believe true security starts where encryption ends. And that’s the reason we are such strong advocates of zero-knowledge architecture.
Only by mitigating the threats of the man at the end can we assert that we ensure end-to-end confidentiality. For us, privacy doesn’t stop at HTTPS; rather, that’s where it begins.
The middle is (mostly) safe. The ends? That’s where the war is now.
#SealedWeb #PrivacyByDesign #ZeroKnowledge #NetworkSecurity #DataConfidentiality
