Researchers Jonas Hofmann and Kien Tuong Truong of the Eidgenössische Technische Hochschule Zürich (ETH Zurich) examined several cloud services. In doing so, they discovered several vulnerabilities in end-to-end encrypted cloud services. It was even possible to access data.
They are Sync, pCloud, Icedrive and Seafile. These cloud companies offer end-to-end encrypted storage. These cloud providers, by their own admission, have no access to user data. They themselves describe this as zero-knowledge encryption.
The security vulnerabilities include failure to authenticate user key material, allowing a malicious party to inject its own keys. Other vulnerabilities include unauthenticated public keys, protocol downgrades, exchanging files via links, unauthenticated encryption modes, "unauthenticated chunking," modifying file names and their location, modifying file metadata and injecting folders and files.
