1

Perhaps I am under the wrong impression, but I thought that my password encrypted all of my sensitive data on a website. Let's take Gmail as an example. What I would hope, is that without my password, nobody could view my emails. Not Gmail, and not the NSA. But if this is the case, how does Google know so much about me? How do they have access to the information stored in my email?

Edit:

The reason I was under this impression is for security rather than privacy; if a database is leaked, or an employee is not trustworthy, there goes all of my information...

  • 3
    Your password is only used for authentication. Its purpose is to prove to the service that you are you. The fact that a system requires a password doesn't give you any clue about how they store your information. – Arminius Nov 5 '17 at 22:24
  • 2
    Why do you have this impression? Did you have any evidence that this might be the case, or is it rather that you were hoping this was the case? Impressions require some form of evidence to come to that conclusion. – schroeder Nov 5 '17 at 23:42
  • This depends on the websites. But generally it is not the case that your passwords protects all your data. Only specialized email providers or password safe providers or privacy oriented storage clouds do tha (or at least claim they do it). And it comes with some limitations. Google does not. – eckes Dec 6 '17 at 5:08
  • FWIW, on most sites its pretty trivial to prove that that your data is in fact not encrypted with your password. Simply reset your password using the normal account recovery process and log in. If all your data is not completely gone after this, then it was definitely not encrypted with your password. (Or at least, not in a secure manner.) – Ajedi32 Dec 6 '17 at 16:19
2

Your password does not encrypt anything

The owners of the website can see everything*, including your plaintext password

*There are exceptions, but always assume that they can.

This is one of the reasons why you should not reuse passwords.

Your perception is a dangerous one to have. Maybe you can expand your question to what lead you to believe this?

1

There's a slight misunderstanding here.

Passwords are used for authentication - that's letting an application know it's really you when you log in to some service, not to encrypt your personal data.

If your personal data is encrypted (which you would hope it is), the data is not encrypted with your password. If "a database is leaked or an employee is not trustworthy", your data and emails still can't be seen because it is stored on their servers in an encrypted, unreadable form.

0

Perhaps I am under the wrong impression, but I thought that my password encrypted all of my sensitive data on a website.

Sadly, this is a wrong impression. Password is only used for authentication(think of it as a key to the door which leads you to your unencrypted data). While the data might be encrypted while it is in transit, most of the websites(like Gmail) do not keep the data encrypted in back-end.

What I would hope, is that without my password, nobody could view my emails. Not Gmail, and not the NSA.

Google has access to your emails. It is a part of their revenue model(you see ads based on your emails in Gmail). Not going to talk about NSA...

how does Google know so much about me?

They have access to all the data you share with them.

How do they have access to the information stored in my email?

Well, all the emails are unencrypted, and they have access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.