Re:Microsoft exec: Targeting of Americans’ records ‘routine’
by xyst on Wednesday June 30, 2021 @11:57PM
(#27696138)
Is there a law that prevents companies from completely encrypting their data at rest? Data should only be decrypted if the person(s) have the private keys. Government entities can request the information all they want but all they will get is an encrypted dump. You will need to ask the person that owns the private keys to decrypt or just pound sand (there are laws preventing self incrimination, so private keys should fall in the same domain)
[ Parent
| on HN ]
Re:Microsoft exec: Targeting of Americans’ records ‘routine’
by karmeliet on Thursday July 01, 2021 @01:25AM
(#27696491)
Actually, you can do that already in M365 with Double Key Encryption [1]. The obvious trade-off though is that none of the cloud services will be able to work with your data. For example you won't be able to search or open the document inside the browser which basically renders your SaaS environment (partially) just a plain cloud storage.
DKE should not be confused with any other BYOK service, where you only manage the key, but host it on Azure so MS still has access to you private key.
I think there could be middle ground where customers could select a set of metadata that they are willing to share with the cloud provider or even better, select only the sensitive parts of the document that must be encrypted with their own key.
[1] https://docs.microsoft.com/en-us/microsoft-365/compliance/do...