End

What is your threat model?

All of our vulnerabilities are in the setting of a malicious server. This means that the server is controlled by an adversary, who can read, modify, and inject data at will. This may seem like a strong adversary model, but it is the most realistic for E2EE cloud storage. This model is also consistent with the security claims made by the providers we analyzed.

What are the takeaways of your analysis?

First, there is a gap between what is marketed by some providers and the reasonable expectations users have of their products. Confidentiality is a baseline requirement which we break for some providers. We violate integrity for files and metadata in many other providers, injecting (possibly incriminating) files in the storage of users. Metadata is leaked in many cases, which can be a privacy concern.

What must be done to improve this field?

The effort should be two-fold. On the one hand, more analyses of E2EE cloud storage systems "in the wild" need to be conducted. This is crucial to understand the current state of deployed protocols and what the challenges are. On the other hand, more theoretical work is required to provide a solid foundation for the design of secure E2EE cloud storage systems.

How did you choose which products to analyze? Why have you not analyzed X?

We have chosen the products based on their popularity, especially when using queries such as "most secure end-to-end encrypted cloud storage" on search engines. While clearly there are many more providers, some of which might be secure, we have decided to leave those as future work. We did not omit any provider on purpose, and we are open to analyzing more providers in the future.