1

Perhaps I am under the wrong impression, but I thought that my password encrypted all of my sensitive data on a website. Let's take Gmail as an example. What I would hope, is that without my password, nobody could view my emails. Not Gmail, and not the NSA. But if this is the case, how does Google know so much about me? How do they have access to the information stored in my email?

Edit:

The reason I was under this impression is for security rather than privacy; if a database is leaked, or an employee is not trustworthy, there goes all of my information...

Improve this question
4
  • 3
    Your password is only used for authentication. Its purpose is to prove to the service that you are you. The fact that a system requires a password doesn't give you any clue about how they store your information. Commented Nov 5, 2017 at 22:24
  • 2
    Why do you have this impression? Did you have any evidence that this might be the case, or is it rather that you were hoping this was the case? Impressions require some form of evidence to come to that conclusion. Commented Nov 5, 2017 at 23:42
  • This depends on the websites. But generally it is not the case that your passwords protects all your data. Only specialized email providers or password safe providers or privacy oriented storage clouds do tha (or at least claim they do it). And it comes with some limitations. Google does not. Commented Dec 6, 2017 at 5:08
  • FWIW, on most sites its pretty trivial to prove that that your data is in fact not encrypted with your password. Simply reset your password using the normal account recovery process and log in. If all your data is not completely gone after this, then it was definitely not encrypted with your password. (Or at least, not in a secure manner.) Commented Dec 6, 2017 at 16:19

3 Answers 3

Reset to default
2

Your password does not encrypt anything

The owners of the website can see everything*, including your plaintext password

*There are exceptions, but always assume that they can.

This is one of the reasons why you should not reuse passwords.

Your perception is a dangerous one to have. Maybe you can expand your question to what lead you to believe this?

Improve this answer
1

There's a slight misunderstanding here.

Passwords are used for authentication - that's letting an application know it's really you when you log in to some service, not to encrypt your personal data.

If your personal data is encrypted (which you would hope it is), the data is not encrypted with your password. If "a database is leaked or an employee is not trustworthy", your data and emails still can't be seen because it is stored on their servers in an encrypted, unreadable form.

Improve this answer
0

Perhaps I am under the wrong impression, but I thought that my password encrypted all of my sensitive data on a website.

Sadly, this is a wrong impression. Password is only used for authentication(think of it as a key to the door which leads you to your unencrypted data). While the data might be encrypted while it is in transit, most of the websites(like Gmail) do not keep the data encrypted in back-end.

What I would hope, is that without my password, nobody could view my emails. Not Gmail, and not the NSA.

Google has access to your emails. It is a part of their revenue model(you see ads based on your emails in Gmail). Not going to talk about NSA...

how does Google know so much about me?

They have access to all the data you share with them.

How do they have access to the information stored in my email?

Well, all the emails are unencrypted, and they have access.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.