Learn / Encryption
Encryption · 2 min read
Who can read your messages? Transit, rest and end to end
Three kinds of "encrypted" give very different answers. Flip between them and see who gets a peek.
A lot of apps say their messages are "encrypted." That can mean three different things, and only one of them keeps the company itself out. Use the switch to see how the picture changes.
Who can read it?
- Someone snooping on café Wi-FiCan read it
- A hacker who steals the server's disksCan read it
- The company running the serverCan read it
- A legal demand served on the companyCan read it
- The person you sent it toCan read it
The difference in one sentence each
- In transit protects the connection, like an armored truck. The warehouse at the end can still open the boxes.
- At rest protects stored data on disk. If the company holds the keys, the company can still read it.
- End to end means the keys live only on the devices in the conversation. The company stores sealed boxes it cannot open.
Why it matters in real life
- A breach of a company's servers exposes readable messages unless they are end-to-end encrypted.
- A request from authorities can only hand over what the company can read.
- An employee with too much access cannot browse what the system cannot open.