Zero-knowledge service

Not to be confused with Zero-knowledge proof.

In cloud computing, the term zero-knowledge (or occasionally no-knowledge or zero access) refers to software services that store, transfer or manipulate data such that it is only accessible to its owner, not to the service provider. This is accomplished by encrypting the raw data at the client side or end-to-end (in case of one or more clients, respectively), without disclosing the password to the service provider. This means neither the service provider, nor any third party that might intercept the data, can ever decrypt and access the data on their own, allowing the client a higher degree of privacy than would otherwise be possible. In addition, zero-knowledge services usually aspire to hold as little metadata as possible, so as not to jeopardize clients' privacy by holding data beyond what is functionally needed by the service.

The term "zero-knowledge" was popularized by backup service SpiderOak, which later switched to using the term "no knowledge" to avoid confusion with the computer science concept of zero-knowledge proof.

Providers of zero-knowledge services include:

• Cubbit
• LucidLink
• NordPass
• ProtonMail
• Signal
• SpiderOak
• Sync.com
• Tresorit
• Tarsnap

Disadvantages

Most cloud storage services keep a copy of the client's password on their servers, allowing clients who have lost their passwords to retrieve and decrypt their data using alternative means of authentication; but since zero-knowledge services do not store copies of clients' passwords, if a client loses their password then their data cannot be decrypted, making it practically unrecoverable.

Most cloud storage services are also able to furnish access requests from law enforcement agencies for similar reasons; zero-knowledge services, however, are unable to do so, since their systems are designed to make clients' data inaccessible without the client's explicit cooperation.