I’m wondering if the server encryption is worth it when using a VPS. I’m the only person who is using Nextcloud. What are the advantages and the disadvantages in doing so? I don’t want to blindly activate it because I can’t turn it off then.
The only advantage would be somebody stealing the hard disks - they will be encrypted.
If that is not likely, there is just a performance disadvantage for you.
1 Like
Thank you. So they would need to steal them from my hoster? I don’t think that’s likely. How about access from my hoster? If I activate this option, can they still see or access my files? I doubt so because they’re encrypted, huh?
If you have physical access to the hardware, you can access everything. The encryption keys are on the same hardware … It is difficult of course, but not impossible. So essentially the server side encryption is an obfuscation in your case …
you are sure the keys are not protected with the users password?
If you enable external storages (dropbox etc.) then I think the server side encryption would also kick in for those and thus improve security quite a bit.
Hello, and if there are multiple users in the cloud, do you think that’s necessary ?
If you use the user based encryption, yes that is the case. But even then the passwords are hold in the session and theoretically can be captured, just way more difficult then masterkey.
However this has other disadvantages, like LDAP integration and password changes as well as the challenges when a new user comes into a group. So as usal with the increased security comes a challenge in usability.
sure. but we talking here about which skill level? nsa? kgb?
it shouldn’t be that way. and the description should be a bit more clear.
@LukasReschke
Go for encryption if there is a risk of someone (another evil customer of your provider) evading his VPS and accessing your files (that risk is always present 
). Note that your data will be decrypted by PHP: at some point your decryption key will be on your VPS and could be compromise by the same evil guy (or girl 
). Enabeling encryption is more part of hardening your set-up. If security is important for you, maybe you should spent more time on firewall configuration, integrity checks…
Do not go for encryption if you are looking for performance (yes it matters, even if you have a few gigas) and comptaibiliy: a lot of apps are not comptaible with server side encryption (group folder, preview generator…). Plus many app store data in database (wich ins not par of file encryption) like the calendar app and not in files. So if you like to protect your data in databases, di not go for encryption.
I hope it will help, tell us your choice when you have made one 
It is way more easy than you think! NCs passwords are stored in database, like I said above, they are not encrypted with master key. But users password’s are used to generate there own master key. If you need more info, go read the code en GitHub or go read white paper about encryption.
Yes, but they will need to look for the encryption key in PHP cache or when you connect to your NC. But it is way more hardcore.
Indeed so. And that’s one heck of an advantage!
I enable server-side encryption, and it’s in addition to full disk encryption that is also enabled. Might be overkill, but when it comes to security, layers offer significant benefits.
1 Like
hashed. and therefore “a bit” secured?
Yes, hashed is better than nothing, it prevent system administrator from reading users’s password. Server admin should protect DB access. Some people like @wizlon go for disk encryption.
You can start with this article.
yes that too 
1 Like