-
Notifications
You must be signed in to change notification settings - Fork 133
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
End-To-End Encryption #476
Comments
E2EE would be a very nice feature for the Notes-App! |
What exactly are you expecting regarding the attack vector? I didn't fully get it yet. The notes stored on the server are files and will be encrypted if you activate server side encryption. While transmitting the notes e.g. to the Android client they are protected by On the Android client itself, they are stored in a Where in the chain do you see an issue which could be solved by an |
In my case, it's not about the (or a new) attack vector, more about performance. I think it would be good to have an option to encrypt only the notes without encrypting the whole nextcloud. I guess this would have some performance benefits. Correct me if I'm wrong. Not sure how much effort it would take to implement something like this.
Does the Android App support an encrypted nextcloud? |
Honestly i haven't tried it yet but given the requests are send from the main Nextcloud app to the API of Notes, i guess it should be supported. I am currently not interested in implementing this into the Android client as i have more important topics to do (and as you stated missing this feature is not a security vulnerability, but a performance topic at most - and this only in an edge case). |
This is indeed a very complex feature request. We would have to think about how we could implement this for all notes clients (Web, Android, iOS, maybe QOwnNotes). Challenging would be, e.g., how to transfer cryptographic keys between different (types of) clients. Of course, this feature would be nice. But I agree with @stefan-niedermann that we don't have the resources to implement this, currently. However, if there is somebody who has enough free time and cryptographic know-how, we appreciate any help on this. |
Makes sense, I'm sure there are a bunch of other features that are more important and/or easier to implement. But I think it doesn't hurt to have it in the issues-tracker, just in case. :) |
The problem with server side encryption is that you still have to trust your server provider, as they could easily bypass that, if they really wanted to. |
Would love to see end-to-encryption in Notes. One could reuse E2E code from the passwords app. |
Please add the ability to have client side encryption with Nextcloud notes. This will require the Nextcloud Notes app on Android and either a free Nextcloud Notes app to be made for iOS or for CloudNotes to add this client side encryption feature.
There are client side encrypted note apps such as Turtl and Stanard Notes. I would like to see Nextcloud add this security and even allow the ability to edit the notes in the browser using JavaScript to encrypt/decrypt the client side encryption. And I would like notes sharing to still be possible within the same domain and to be federated.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
The text was updated successfully, but these errors were encountered: