Microsoft Announces Encryption for OneDrive and Outlook.com
After illegal-snooping allegation for paid advertisements by Microsoft, Google in April finally offered end-to-end encryption to Gmail users in April 2014. Following the requirement of rigid security for webmail and cloud storage services, now Microsoft has come forward by encrypting Outlook.com and OneDrive data transfer to Microsoft’s data centers. This major step by one of the computing giants aims to save normal user data from being snooped by government bodies or online attackers.
What is Making the News?
Transport Layer Security Added to Outlook.com
Outlook.com uses TLS (Transport Layer Security) which is a two way encryption technique. Under TLS certificate, users can ensure that when their email travels from one account to another and passes through various email providers, it remain encrypted, reducing the chances of being read or accessed. Applications like Skype, Office 365 are already using this kind of encryption service.
However, TLS will take care of email transmission; it does not do anything in regards to data that is stored on Microsoft’s Server. In the announcement, the giant representatives did not make a mention about medium that will encrypt the data saved on their Server. This means any organization that access to the Server can still access email database, in spite of high-end encryption used while email transmission from one end to another.
Perfect Forward Secrecy added to Outlook.com and One Drive
For encryption while sending or receiving mails through different ISPs, Perfect Forward Secrecy (PFS) has been introduced. This means a new key for connection will be set. This way, if the key is cracked by chance, only a specific amount of data can be retrieved which makes it complicated for attackers to crack the key. This protection is also available for online storage service OneDrive.
Meanwhile…
Microsoft’s Transparency Center
Microsoft is also opening its Transparency Centers that will allow participating governments to review source code of their products so as to ensure that they have not met hands with US government to give them to cloud data of any individual, businesses, or any government agency.