Status End2End-Encryption in NextCloud?

ℹ️ Support
, , ,
1

(Foreword: If there is any recent documentation, tutorial, howto or FAQ, please point me there. I may have overlooked it.)

NextCloud proudly advertises End2End Encryption at

Unfortunately, it’s a bit more terse when it comes to concrete instructions of how to actually use / enable it an what’s needed to to so.

There seems to have been quite a bit of buzz about this topic about a year ago, yet the corresponding app still warns that it’s a beta release and really should not be used for anything else than test data:

https://apps.nextcloud.com/apps/end_to_end_encryption

Mh. Encrypting test data only does not look like a killer feature to me. :wink:

I’m not really in a situation that I’d like to utilize E2EE using the Windows and Linux desktop clients on data which I actually also want to be able to get back again - reliably. :wink:

  • Is E2EE in NextCloud actually usable nowadays, or still not yet?
  • If it is, what’s the best combination of server, app and client - will NextCloud 14 and App version 1.0.5 suffice, or is NextCloud 15 with App version 1.1.0 better / more recommended?
  • Does the standard desktop client build version 2.5.2 have E2EE enabled and in a usable state?
  • Will I risk anything concerning my unencrypted data which already resides on the server (and shall stay unencrypted)?
3 Likes
2

a bit off-topic; it looks to me that Cryptomator (https://cryptomator.org/) is more stable and well tested. It is “multi-platform transparent client-side encryption of your files in the cloud”. That software is also mentioned at Best Privacy Tools & Software Guide in in 2023. I have used it for a couple of months and it works fine.

https://github.com/cryptomator/cryptomator

It also mentions Nextcloud;

Works with Dropbox, Google Drive, OneDrive, ownCloud, Nextcloud and any other cloud storage service which synchronizes with a local directory

1 Like
3

Mh… If it can be avoided, I’d rather prefer not to rely on an additional piece of software here, which is also written in Java and pulls in some version of a JRE as a dependency…

However, trying Nextcloud E2E encryption I failed miserably…

I tested it against a test setup, where it seemed to work well. (I don’t understand why you’re forbidden to list the encrypted data in the web frontend, but you’re allowed to download it in a ZIP, but that’s a different issue…)

However when I tried to replicate my results on my production system (which in the process I upgraded to exactly the same version as the test system), it simply did not work at all - but even worse, it looked as if it would.

This means that I could enable encryption for an empty folder in the Desktop sync client and it would show a green padlock there. It would also show a padlock on this folder in the web UI, and the folder was inaccessible there, so all looked fine.

However, data copied to this folder and synced to the server actually showed up in plain text in the server’s file system!!! What gives?!?

After a restart of the desktop sync client, also there the padlock on the folder was gone, while it was still shown in the web UI, and still inaccessible there…

This behaviour was totally reproducible and probably is something like a “worst possible outcome” - make it look like the data is protected / encrypted, but actually upload it without any encryption… Wow.

So, ok, I give up, this stuff does not work at all, I wasted several hours of my life and will now have a closer look at this Cryptomator thingy…

Bottom line: Take the warning serious, this is still alpha stuff unfortunately, and do not “encrypt” any valuable data! If you still want to use it, double check that the data actually ends up in encrypted form in the server’s file store, before you use it for valuable data! And don’t confuse the result of enabled server-side encryption with the result of E2E encryption, so make sure what you’re checking is actually the E2E encryption result, in case you have server-side encryption enable because you’re working with untrusted storage providers…

2 Likes
4

I have similar experiences. Gave it a try twice - never worked properly. Odd things started to happen, like you described (directories disappeared, desktop client crashed - even after disabling E2E again, etc.).

I had a look at Cryptomator too. Great software, but what I didn’t like was the fact that I was having all the data twice. Means the original data (like 20 GB) and in addition to that the encrypted data (again like 20 GB). So I didn’t really see the difference between Cryptomator and an encrypted 7zip file.
I was looking for something that reads a local directory and encrypts its content in the background only before sending it (the encrypted data) to Nextcloud.
Now I’m using the command line tool duplicity (http://duplicity.nongnu.org/), which works perfectly!

5

I agree. E2EE should be marked as highly unstable and insecure. I too have difficulties with E2EE enabled and found unencrypted documents in presumably encrypted folders which should never have happened.

1 Like
6

I’m not sure this is true… it looks as if you were having the data twice but the mounted drive is just a virtual one; there should be no original files anymore after you encrypt them, unless you would have created a back up of them. When you edit files inside the mounted drive, Cryptomator automatically encrypts them for you.

7

In my case I wanted to create an encrypted backup of my photo collection. At the same time I want to have access all the time to my original (unencrypted) local files (i.e. through Photoshop).

Also, I’m not sure if Cryptomator makes incremental backups (or how this is called). If I edit only one photo (among hundreds), I think, it would upload the entire “virtual drive” again with all the hundreds unedited photos.

8

I think you got some of the concepts of Cryptomator wrong. I’m now also using it as a replacement to NextCloud E2E encryption, and all data definitely is stored only once, in encrypted form.

If you make a backup, you also backup each file (in its encrypted form) only once.

However, of course if you want to make a backup, you have to copy all encrypted files somewhere else, which occupies extra space (as every backup does).

The encrypted store used by Cryptomator is a “live data store” which dynamically updates on-the-fly while you use its unencrypted view - so you cannot use it as a backup, it’s the actual modifiable data.

First of all, Cryptomator is no backup software, so it does not make any backups itself. It’s “just” an encrypted store which acts like a virtual drive which stores all contained data in encrypted form on another drive.

No, that’s not the case. Contrary to eg. Verycrypt / Truecrypt, Cryptomator does not create one huge encrypted image file. It encrypts each image / document and so on individually into its own encrypted file of more or less the same size as the original.

Each of those encrypted files can be synced to a Cloud store individually.

1 Like
9

Well, in a sense it already is - the E2E app is described as

End-to-end encryption is still in alpha state, don’t use this in production and only with test data!

The only thing is that it’s rather unfortunate that it still is like that. :frowning:

And maybe the proud ad for E2EE at Nextcloud features that put you in control should be taken down until E2EE actually is a usable feature… :wink:

4 Likes
10

You don’t have your data once in encrypted and once in unencrypted form - you only have it in encrypted form, and it only looks as if it also would be available in unencrypted form. Actually it’s encrypted and decrypted on-demand during usage. The “unencrypted files” you’re seen is just a virtual view of the data which does not actually exist on disk.

That’s the difference to an encrypted 7zip file - there you actually have to store the data in unencrypted form, have to zip/encrypt it locally in one big 7z file and then to upload it somewhere else.

OTOH that’s also not what Cryptomator does, so if you want just that, duplicity may be the tool for you. However AFAIK it does not sync data dynamically, which you would get with Cryptomator and the NextCloud Sync client.

11

E2EE is developed here:

I think if you find the bug which can be reproduced consistently, you should not hesitate to report that there like I did: https://github.com/nextcloud/end_to_end_encryption/issues/105 The repository is quiet and based on the commit history, it’s not actively developed for a while (most of the recent commits are translation updates).

RFC is available here: https://github.com/nextcloud/end_to_end_encryption_rfc/blob/master/RFC.md

12

“Testing” can mean a lot as can alpha since everyone in open source knows a product in “alpha state” which is quite stable and used. The fact that the E2EE feature is mentionend in every second product presentation doesn’t help to show that alpha in this case means that even a proper encryption can not be assured. I just saw a product presentation where Frank Karlitscheck mentioned E2EE without any further comment to a (very) buggy alpha state.

I really like Nextcloud and the people behind it, but policies to advertise half baked products don’t help to build a reputation for stability; especially since this happens quite often. Anyone remembers the guest functionality that was advertised but never delivered? Or the many problems with the groupfolder implementation? The latter was used by a bigger NGO in which I volunteer and lead to loud critic by users of which some loudly wanted that we migrate to a “more professional product” (not my words) like Office365 oder Google.

3 Likes
13

Es gibt noch ein anderer Platz wo man Probleme von E2EE mitteilt: https://github.com/nextcloud/desktop/issues?utf8=✓&q=is%3Aissue+is%3Aopen+label%3A"feature%3A+%3Alock%3A+end+to+end+encryption". Wo sollte ich?

14

Is E2EE in NextCloud actually usable nowadays, or still not yet?

No. If you have only one folder it seems to work with the actual server/client/app combination. But finding out that is still more something that is in development will cost you some time. If you need it now - look for something else. If you can wait: it will be the thing that is needed for cloud sync!

Does the standard desktop client build version 2.5.2 have E2EE enabled and in a usable state?

It would be nice to see it working. Be aware that E2E is only an add-on to nextcloud and not the standardway of transferring data.

Will I risk anything concerning my unencrypted data which already resides on the server (and shall stay unencrypted)?
Besides some other bugs, I have not seen problems with other data than in encrypted folders. But as E2E seems more experimentell than established, I would take care of the data you want to sync :wink:

I agree will all of you, that there will be some disappointments if you find out, that E2E is not really that useable than it is advertised… I’m not looking for the next big new server version with new features - I want the featured features stable working in every day live. :wink: As it is only an app we don’t have to expect it to be the main focus when it comes to new releases?!

2 Likes
15

Hey,
Anybody know how to contact the webmaster or what to do to temporarily take down/change the mentioned website https://nextcloud.com/endtoend/

I think we lose a lot of trust if people try nextcloud because of this page, only to find out that it does not work as advertised, or even just to find out that is still alpha and should not be used in production.

1 Like
16

Hi there,

The website is maintained here: https://github.com/nextcloud/documentation

The source of the page is this one: https://github.com/nextcloud/nextcloud.com/blob/master/page-endtoend.php

You would want to create an issue there to discuss the necessity of the change.

17

Thank you.

Does anybody have time to open this issue?

1 Like
18

Does anyone have experience with “duplicati”

19

take rclone (rclone.org).

Highly tested and rock solid even when uploading TB-sized files to the cloud.

20

I do intensively use duplicity, which is like the command line (step) mother of duplicati.

It is really mighty and works so smooth. You just need to invest some time to understand how to use it.

I love it: 5/5