I have enabled shield platform encryption in dev org. I have encrypted some of the standard fields like Account Name on Account Object and Email on Contact Object. The System Administrator does not have "View Encrypted Data" permission, but still I am able to see the actual values of those fields instead of getting masked values. How can I get masked values instead of original values.
From the Spring 17 release notes -
Turn Off Masking for Encrypted Data
Data masking is being decoupled from Shield Platform Encryption. The “View Encrypted Data” permission and its resulting masking behavior will no longer be available in Shield Platform Encryption when you activate this critical update.
Field-level and object-level security features control who has access to data, regardless of whether it is encrypted.
With this change:
• You get a more consistent experience for users when they access encrypted data
• You reduce confusion between data that’s masked and data that’s encrypted. They aren’t the same thing.
The “View Encrypted Data” permission still applies to Classic Encryption.
Salesforce confirmed that “Platform Encryption is Disabled for fields for Masking the data” from Summer 17. Instead they are recommending to do the FIELD LEVEL SECURITY in such case to hide the values who shouldn’t see the values. But still Platform encryption is important in security aspect for below reasons.
Data is Encrypted at Rest - For any compliance or certification that requires all data be encrypted at rest Platform Encryption is the solution as all data will be encrypted on the servers.
In the event that Salesforce is ever breached Platform Encryption will be the only way to ensure any of your customers data that is stolen will be encrypted and unreadable. By default customer data is not stored as encrypted on the servers and only encrypted during transmission.