Goodbye Evernote...
19/12/16 08:55 Filed in: Industry
Discussions around Evernote's Privacy Policy has made me look at their offering in more detail…and it's not cool.
====
UPDATE: Over the last week I've received numerous emails on my customer's email platforms (like many consultants, I end up with a lot of accounts) re-affirming that corporate data must not be kept on Evernote. How much damage have Evernote done to themselves here? It's looking like a colossal backfire.
Original Article
I stumbled across the Evernote platform a number of years ago. It's multi-platform, sync to any device, electronic-scrapbook method of operation became very useful, very quickly. Here I am now with the best part of 10Gb of information in there. Not any more however.
Some articles flying around over the last couple of weeks set the alarm bells going off about their privacy policy. Take this one for example over at LifeHacker:
Evernote Employees Can Read Your Notes, and There's No Way to Opt-Out
Even the headline made me sit up and take notice. So they can read your notes without opt-out made me immediately wonder about how. Surely my data is encrypted at rest within their cloud? So I can only assume they have access to the encryption keys. No, wait, how wrong I was. More on that in a second.
Firstly, the update to the privacy policy due end of January 2017 stated that a machine learning tool may require Evernote employees to look at your data. Hmmm. Ok. Perhaps. But wait, even if you opt out of that, you absolutely cannot opt out of allowing Evernote employees to look at your data. Think about that for a minute.
Now of course after a fair bit of pressure they've backed down on the changes, and sound contrite about it. See here:
Evernote Revisits Privacy Policy Change in Response to Feedback
By 'feedback' I assume they mean 'rage'.
Note that they say that Evernote employees won't access your data without your permission. Now, after that thing over having to opt-out of stuff explicitly to stop them reading your data - well, it's got my spider senses tingling for a couple of reasons.
Firstly, what else have I opted in/out of that would allow them access whenever they like?
Secondly - and far more important to me - is how are they accessing my data? There's only two options here really - the data is stored at rest with no encryption, or Evernote employee's have access to your encryption keys.
After some investigation it would seem it's the former - your data is not encrypted. A lot of talk about the encryption in the service really only is at a transport layer - I.e. Data to and from the US Data Centres. It is not encrypted at the data centre itself. (Update: It appears Google Cloud is encrypted at rest…but it's not relevant really if Evernote staff can get a clear view of your data).
That sets off all kinds of uncomfortable feelings.
Looking into this even more, I can see that in the forums encryption at rest has been a long-requested feature. Why wouldn't they implement it? Access - that's why. I suppose there's a marginal technical reason about workloads (encrypted data is slightly more expensive from a transactional point of view to process)….but hey, now they've moved to Google's cloud there's no issue there, is there?
Yes, Google Cloud.
So here we are now with your data, unencrypted at storage point, and within Google's platform. The forum thread on the subject is interesting.
I am so not down with this I couldn't get my stuff off their platform quick enough. In particular this one almost made me choke on my coffee:
I've always been of the mindset that any company that has 'Don't be evil' as a corporate motto has a reason for that motto being in place. This is not a good thing. I will add though that as far as I know Google's Cloud does encrypt data at rest, so perhaps this is progress of a kind?
Everything about this move - the issue around access to data, the lack of encryption, the move to Google - has my tech senses tingling like Spiderman at a Marvel party. Consider this from the forums:
- We don’t provide you with a feature that lets you client-side encrypt all your content in a way that we can no longer read it.
- The only end-to-end encryption feature we offer is note text encryption. We’ve had a lot of people voice their interest in full note, notebook, and account encryption, but we don’t have any plans to support that right now.
- Both Evernote and Google will have access to data that you don’t manually encrypt using our note text encryption feature.
Well ain't that dandy.
So, for me, sadly, it's goodbye Evernote. The platform front end is great - really great - the back end, and their attitude to their user's data, not so much.
What will I replace it with? Well, not one product that's for sure. I'm sure OneNote will be in the mix, as will making more use of my Office365 50Gb Mailbox, as will putting stuff in flat-file store again. All of them more preferable that what Evernote is doing with my data today.
Sad times.
blog comments powered by Disqus