End to End Encryption for All

What end-to-end encryption is, why it matters for you, and how you can use it to protect your privacy online.

Image Source

The digital economy has been built on principles of unilateral trust. As a consumer, when you use an online software service, you have to trust the service provider to be responsible with your personal data, while the service provider has no need or expectation to trust you. Furthermore, there is no clear definition of what can be considered ‘responsible’ use. When your favourite chat application promises to ‘protect your privacy’, what does that even mean? Does it mean they won’t use your data to show you better ads or improve their product, does it mean they’ll never read your messages, or does it simply mean that they’re not selling your personal data on the deep web? Fortunately, there is a better way of building technology, which removes the reliance on trust by making your personal data inaccessible to anyone except yourself and the people you are communicating with — the end-to-end (E2E) encrypted way! In this article, I will explain in non-technical terms what E2E encryption is, how it can benefit regular consumers, what its limitations are, and how you can get started with using software that applies it.

What is End-to-End Encryption?

E2E encryption is a software design pattern which guarantees that any communication between two or more clients is comprehensible only to the clients in the exchange. In E2E encrypted applications connected over a network (like the internet), your communications are encrypted (making them incomprehensible) before they leave your device, and decrypted (making them comprehensible again) only when they arrive at your recipient’s device, leaving all middlemen, including the application’s own servers, incapable of intercepting your communications. This principle applies regardless of how many people are using the software to communicate with each other.

To understand this better, let’s look at an example of a generic E2E encrypted chat application:

Let’s look at this diagram from a consumer’s perspective to understand what’s going on:

1. Bob uses his phone to send a message over an E2E encrypted chat.
2. If things work correctly, this message gets encrypted immediately on Bob’s device. When a message is encrypted, its contents become unintelligible to anyone reading the encrypted message. Furthermore, to decrypt the message and read it in its original form, one or more special keys are required. A good E2E encrypted app would guarantee that only the recipient(s) of the message would have the keys to decrypt the message.
3. Once the encrypted message leaves Bob’s phone, it makes the long journey to Alice’s phone. This journey can be perilous as the message travels through your internet service provider’s routing, the backend datastore of the messaging app, and other such proxies. If Bob’s message was not encrypted at his device, any middle-man in this process can intercept and read the message, or store it somewhere for future use. This also creates the risk of unwanted data harvesting by hackers, government surveillance etc. Fortunately, in this example, Bob’s message is indeed encrypted, so our middlemen only see garbled gibberish rather than the actual message.
4. Once the message reaches Alice’s phone, she has a special key to decrypt it and read the original text. If the data on her phone’s app is ever corrupted, it can always restore the encrypted message(s) from the app’s database, and Alice can always decrypt them again, creating a secure communication line.

Notice the flexibility of this design. You can replace Alice with multiple recipients. These recipients might just be Bob himself from his other devices. The same pattern works just as well. The communication can also flow in both directions and follow the same pattern. This is a generic example of how E2E encryption works, specific apps might adapt and improve upon this model. One key challenge is how to guarantee that the keys required to encrypt and decrypt messages are managed securely, and stored only within the client’s devices. Different applications have different ways of handling this, the details of which we can revisit in a more technical discussion.

Does End-to-End Encryption Matter?

This is an important question that you’ll have to answer on a case-by-case basis. When you are using an app that does not offer E2E Encryption, you can assume that your private communications will be collected by middlemen. More often than not, these will be used for benign analytics, data science, reporting etc. However, once this data has been collected, there is a permanent risk of serious privacy breaches such as cyber attacks, government surveillance, data leaks etc. The permanence of the liability is something that a lot of people don’t immediately understand — once your data has been stored, the risk of a privacy breach will exist for as long as the storage disks don’t start to rust.

The question then is, does the data you’re sending pose any liability for you, now or in the far future? If the answer is yes and E2E encrypted alternatives exist, you have to consider whether the cost of using the safer alternative is worth mitigating the privacy liability.

Limitations of End-to-End Encrypted Applications

Like everything else in this world, no system is perfect. End to end encrypted applications do have their limitations, and as a consumer, there are a few you need to be particularly aware of:

1. It only works if all the clients communicating over the channel are using E2E encryption. If you are using an E2E encrypted email client, and you email someone using a regular email client, your communications are NOT going to be encrypted. This is an important detail, and applies to all E2E encrypted software. It may also apply to cross-platform communication between two different E2E encrypted applications. Unless they have engineered the cross-platform communications to also be encrypted, your privacy cannot be guaranteed.
2. In most cases, even E2E encrypted apps cannot encrypt your metadata. Metadata refers to the data about the communication. This includes information such as the identity of the sender(s) and the recipient(s), the date and time of interactions, the size of the data being transmitted, etc. For a lot of us, this is an acceptable compromise, but in case you want to guarantee the privacy and anonymity of your metadata as well, you may have to take extra precautions, such as using a VPN, masking your MAC address etc.
3. E2E encrypted apps usually can’t protect your privacy from spyware on your device. If you are using a phone or laptop that has a keylogger (something which tracks everything you type), or if you are using a 3rd party client app to read communications from the original E2E encrypted app, your communications may still be at risk of prying eyes. You may think this doesn’t apply to you, but you may be surprised. Did you install a free autocorrect on your smartphone? Are any apps on your phone able to monitor your screen? One can never be too careful!

Getting Started with End-to-End Encrypted Apps

All this theory would be wasted if I didn’t leave you with some practical suggestions. Here are some E2E encrypted apps you can start using right away to better protect your privacy:

• Signal for Messaging: When it comes to E2E messaging apps, there are a wide variety of options. I like Signal because it’s free, non-profit, straightforward, and feature rich.
• Sync Cloud or PCloud for Cloud Storage: E2E encryption cloud storage can get a bit pricey but it is definitely worth considering for the peace of mind. Both PCloud and Sync Cloud have a sizable free tier, and I would definitely recommend migrating to them for at least your most private and confidential data.
• Tutanota for Emails: E2E encrypted email clients can be a tricky one — they only really work if the person you are communicating with also uses the same email client, or another E2E encrypted client which uses the same encryption and decryption strategy. While there are a few other options, I found Tutanota the best for privacy protection. If you end up using this, use it only to communicate with other Tutanota users to avoid inbox bloat with email threads which cannot be encrypted anyway. This way you may be able to remain within its free tier for a little longer.

These apps are easy to install, free to get started with, and can hopefully introduce you to a new way of thinking about your digital privacy. In future, any time you are considering any new communication or cloud storage apps, try to find out if they offer E2E encryption, and if not, keep in mind the privacy liabilities of using the product.

Editorial Review by Lulu Tan.

Originally posted on Project Alesia by me.

Project Alesia

Enjoyed this article? Subscribe to our newsletter on the site above for more resources on personal data privacy, digital well-being, ethical data science & engineering, and a lot more!

You can also join our community on Discord.