Anastasiia Voitova -- Encryption is easy, key management is hard

Adding encryption is easy; designing a system that protects keys, metadata, and users is much harder. Anastasiia Voitova joins Chris and Robert to explain end-to-end encryption as a system property rather than a single cryptographic feature. She examines what encryption does and does not protect, how modern web and mobile architectures complicate trust boundaries, and why cloud storage creates difficult key-management choices. The discussion covers performance, recovery, usability, and the gap between marketing claims and honest threat models. Anastasiia closes with practical advice for product and security teams deciding whether end-to-end encryption fits their system and how to communicate its tradeoffs clearly.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Anastasiia Voitova:→ Anastasiia Voitova on LinkedIn→ Cossack LabsMentioned in this episode:→ Cossack LabsFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Encryption is easy; key management is hard02:44 Defining end-to-end encryption06:28 What end-to-end encryption protects09:15 Modern web and mobile trust boundaries12:36 Cloud storage and key-management choices14:00 The downsides of stronger encryption16:38 Performance and operational costs19:01 Usability and honest encryption claims23:18 Can users trust messaging applications?27:00 Choosing the right security tradeoffs30:38 A call to action for product teams