Ask HN: Is there a point to encrypting user data?
As an aside, for security minded users I already plan on making a self-hosted option which will work in tandem with the hosted option. (this is mainly because I want to self host haha)
With that said, I was debating encrypting all user data on the hosted system. There of course might need to be some non-encrypted data for indexing, but that's a side concern. My question on this becomes:
Is there even a point to encrypting user data on the server?
If my server is breached, the at-rest data is secure - sure, but someone has access to the server, which means hypothetically they could MITM the decryption data when users write it or read it. So is this even worth while? Furthermore, users have to blindly trust that I'm not storing their key, which undermines the goal of encrypting their data.
I'm aware that an alternate method to do this could be to keep the decryption in javascript and encrypt/decrypt before ever getting to the server. However the question I asked above is because I'm just trying to understand if server-encryption is even worth while. Is it a pointless venture? A waste of time?
Thanks.