This communication system essentially prevents eavesdroppers, including your telecom service provider, internet provider, and the provider of the communication service under consideration, from accessing and reading your messages.
Such prevention is possible because plain text messages are encrypted in the form of cipher text and then again decrypted when the recipient is expected to receive it. In other words, in the computing world, encryption is the conversion of data from a readable format into an encoded format that can only be read or processed after it’s been decrypted.
Why do we need end-to-end encryption? The reason is simple: In today’s social media-dominated world wherein most of the communication happens online, end-to-end encryption prevents your private information from being read or secretly modified, other than by the true sender or recipient(s).
After all, whether we are talking about family conversations, exchange of authentication information, businesses handling sensitive information, everyone should expect and demand privacy when communicating online.
Moreover, the need for secure communication is even more important given how personal information can be easily used to target audience-specific ads, manipulate people’s political and religious standpoints, keeping a tab on important societal figures, spreading rumours in the form of fake news, and even causing terrorist attacks worldwide.
So, how does end-to-end encryption work in preventing people with malicious intent from using personal information for nefarious means? As the basic building block of data security, end-to-end encryption functions using encryption algorithms and “keys." When information is sent, it’s encrypted using an algorithm and can only be decoded by using the appropriate key. A key could be stored on the receiving system or it could be transmitted along with the encrypted data.
Therefore, to approach the issue of data security, we must consider the ways a message chain or voice communication can get exposed to a third party. The options are few. Any message, regardless of its nature (text, video, photo, or voice) is recorded on local storage volumes on the sender’s and recipient’s systems; secondly, transferred via wired or wireless networks; and, thirdly, is processed by the service’s server (well, not obligatory).
And if one can, to some extent, control the access to the messaging history in the first case, the rest of the path the message travels is completely out of control.
While end-to-end encryption sits at the heart of data security and allows users to feel safe about their exchanged information, it is also not 100% secure. At the beginning of the encryption era, it was only used by governments and major firms as they had the great responsibility of keeping huge databases private.
However, as most of the world’s population is online today and is exchanging data across the globe, it has become necessary for various networks to protect user passwords, payment information, addresses, other personal information including mobile data and any message sent across these networks.
Hence, encryption from being a strong security measure at the beginning has now become a basic security measure for companies and networks.
Every app that we use in today’s time can be exploited by cybercriminals in some way or the other and as consumers, our data privacy is left in our own hands. As consumers, we must be well aware of all the alternative apps that we can use and current news about them in terms of threats and breaches.
Looking at how the app company responds to such a breach is also important to know if we can trust them for our data in future.
Companies too need to focus on advanced technologies like post-quantum cryptography, which offers a promising alternative to the existing systems that may eventually become obsolete. With support from other corporations, these new technologies will bring about the evolution, and not the end, of encryption.
Saurabh Sharma is a senior security researcher (GReAT), Kaspersky (APAC)