What "zero-knowledge" really means (and what it doesn't)
Encrypted in transit, encrypted at rest, end-to-end, zero-knowledge — the terms get blurred. Here's how we use them.
Security marketing is full of reassuring phrases that mean very different things. Before we throw “zero-knowledge” around, it’s worth being precise about what it does and doesn’t promise.
The short version: encryption-in-transit and encryption-at-rest still let the service read your data. Zero-knowledge doesn’t.
The ladder of protection
Encrypted in transit means data is protected while it travels between your device and the server (that’s what HTTPS gives you). Necessary, but the server still decrypts and reads everything on arrival.
Encrypted at rest means the server writes data to disk in encrypted form. Also good — but the server holds the keys, so it can read the data whenever it wants.
End-to-end encrypted means only the endpoints (the people communicating) can read the content; the server in the middle can’t.
Zero-knowledge, as we use it, is that last idea applied to a whole system: the service operator is never given the keys to read what it stores, by design.
Where Crowdbook sits
[Placeholder — expand with a worked example of a shared attribute’s journey and the exact keys involved.] The important property is that plaintext exists only on your devices. In between, the server is a courier for sealed envelopes it can’t open.
There’s more detail on the mechanics — the device key hierarchy, the group key wrapping, the challenge-response login — on the technology page.