End-to-end encrypted doesn't mean secure—Anastasiia Voitova, Cossack Labs, for Mobile Notts 2021 скачать в хорошем качестве

End-to-end encrypted doesn't mean secure—Anastasiia Voitova, Cossack Labs, for Mobile Notts 2021

Slides: https://speakerdeck.com/vixentael/e2e... End-to-end encryption doesn't guarantee privacy and/or security of your data. Your favourite application can use E2EE and sell data to someone at the same time. Anastasiia @vixentael explained the relationship between security, privacy and encryption, and how different encryption approaches protect users data from various events or threats. Chapters: 0:00 Intro 0:39 Anastasiia talks about her experience in data security and Cossack Labs' expertise in E2EE implementation for various use cases. 2:13 Typical misunderstanding about security, privacy, and encryption — explained. 5:43 How Signal, WhatsApp, Messenger, Telegram, and other messaging apps use E2EE and collect users data. 7:43 Learn the differences in concepts of privacy&trust, security, and E2EE. 10:26 Encryption from data-flow perspective: 12:14 Encryption at rest and in motion, 13:09 Application-level encryption (read more: https://www.infoq.com/articles/ale-so..., 13:35 TLS and ALE, learn the difference, 15:41 Field-level encryption (FLE) and E2EE, learn the difference, 17:15 Transparent database encryption (TDE), 19:39 How TLS, disk/FS, TDE/DB encryption, ALE, and E2EE address various threat models. 22:53 Why we don't use E2EE everywhere? 25:19 More complicated schemes: Client-side field-level encryption (CSFLE) explained. 27:31 More complicated schemes: Proxy-side transparent field-level encryption, Acra proxy explained. 29:54 Links to useful articles to read. Follow for more:   / vixentael​   https://speakerdeck.com/vixentael/   / cossacklabs   https://github.com/cossacklabs/acra https://github.com/cossacklabs/themis​   / cossack-labs   https://dev.to/cossacklabs https://www.cossacklabs.com/