Originally published at: https://nextcloud.com/blog/nextcloud-14-focus-on-security-and-compliance/
Nextcloud is designed to keep your data secure while you sync your data and work with other people. With every release, we bring new technologies, visible and invisible, to secure files and enhance collaboration. Nextcloud 14 introduces our innovative Video Verification and Signal & Telegram 2FA support for security. To enhance collaboration, we introduce note shares, search in the content of comments, recovery of deleted group shares and improved federation. This blog post aims to update you on these and other improvements.
HackerOne: paying experts to find issuesWhile we regularly get praise from customers who have done pentesting on our software, we believe that getting the help from the global security community is important to validate our security efforts. Our HackerOne program pays out money to hackers who find issues in our software and responsibly disclose those to our security team.
A recent HackerOne case study has analyzed our security work and concluded our bug bounty handling is an example for others to follow. Michiel Prins, co-founder HackerOne, had this to say:
Nextcloud’s lightning fast response times are impressive and make them a model for how to build an efficient bug bounty triage and response process.
You can learn more and download the case study from the HackerOne website.
New security features in Nextcloud 14For Nextcloud 14, two main security features are new:
- Video Verification
- Signal/Telegram/SMS 2FA support
Video VerificationVideo Verification is our new, unique feature that is meant to ensure that only the right person looks at the data you shared. You might think: well, I put a password on it, won't that do the trick? It is indeed true that a password for a share link, especially when sent through another channel like sms, makes it harder for a third party to get access to the files. But there are certainly scenarios where this still happens: a spouse might use the phone, or a child. For most data, this isn't a big deal. But think of a doctor who wants to make sure an X-ray only can be seen by the patient, not their family?
Just like a bank might require you to physically come in to open a bank account and a doctor would require a visit to tell you the results of an examination, you might want to make sure some data strictly ends up before the intended recipient. This is where Video Verification comes in. When this option is enabled, the user receives only the share link, not the password. The share link page gives a ‘request password’ button, which starts a call using Nextcloud Talk. Your phone will ring and you will be able to see and talk to the intended recipient! Once you have verified who it is, you can give the password and he/she can log in and view the data.
The YouTube video below demonstrates how this works.
Signal/Telegram/SMS 2FA supportThe second main security feature in Nextcloud 14 is a new second factor authentication provider. 2-factor authentication improves the security of authentication by using a second way of ensuring only the right person can log in: besides a password, a code from a device like a phone has to be entered. New in this release is the 'gateway' 2-factor provider. It allows use of the secure messaging apps Signal and Telegram as well as various SMS gateways as second factor to secure their authentication. Most up-to-date applications communicating with Nextcloud now use Login flow so you will be able to log in just like you would on the web, including, but not limited to SMS-based authentication. Absent support for the Login flow, your legacy applications will accept device passwords.
Note that especially the Signal authentication support relies on a third party docker container, so take some care with it. You can learn more on this page.
In other 2-factor news, the app now officially supports authentication via NFC (Yubikey NEO)!