You shouldn't trust anyone. There's nothing stopping them from doing it again, or continuing to do it and publishing that nice writeup. Of course when your data is on a 3rd party server, that 3rd party has access to it. Why do we keep pretending like anything else is the case?
Of course when your data is on a 3rd party server, that 3rd party has access to it.
You realize that oblivious third-party storage can exist, right? For example, Tarsnap. It's the the durable-storage equivalent of end-to-end encrypted messaging. The client does all the encrypting; and the client is open-source; so you don't have to trust the third-party at all.
This is a bit more challenging when you want clients to be able to operate over an index of the data, rather than just the raw data (i.e. you want them to be able to search through their stored email)—but it's fully possible to architect a service such that all indexing happens on the client (perhaps distributed between many connected clients in the case of a shared data-source like a Slack workspace), where the backend is just obliviously storing and returning E2E-encrypted copies of generated index chunks, in the same way it obliviously stores and returns E2E-encrypted copies of the data itself.
Comments
You shouldn't trust anyone. There's nothing stopping them from doing it again, or continuing to do it and publishing that nice writeup. Of course when your data is on a 3rd party server, that 3rd party has access to it. Why do we keep pretending like anything else is the case?
You realize that oblivious third-party storage can exist, right? For example, Tarsnap. It's the the durable-storage equivalent of end-to-end encrypted messaging. The client does all the encrypting; and the client is open-source; so you don't have to trust the third-party at all.
This is a bit more challenging when you want clients to be able to operate over an index of the data, rather than just the raw data (i.e. you want them to be able to search through their stored email)—but it's fully possible to architect a service such that all indexing happens on the client (perhaps distributed between many connected clients in the case of a shared data-source like a Slack workspace), where the backend is just obliviously storing and returning E2E-encrypted copies of generated index chunks, in the same way it obliviously stores and returns E2E-encrypted copies of the data itself.