I manage for our team a NC instance hosted/managed by Hetzner. Please confirm me that I have understood correctly the 3 main forms of encryption offered by Nextcloud.
The following is based on Data encryption methods in Nextcloud - Nextcloud (a bit outdated) and several other blogs/documentation pages.
NC encryption modes advantages/disadvantages
Server-side single system-wide password
key is kept in NC config space
nc admin users can see users file lists but not content
server admin/hackers of a compromised server can do everything
if remote spaces are used, remote space server admins can see users file lists but not content
nothing change for the user
Server side user-key password
keys are still kept in some NC config space, but are one per user and keys are encrypted by user own passwords
nc admin users can see users file lists but not content
server admin/hackers of a compromised server can do everything provided they hack a bit NC in order to get the users key during a user session (including sync clients)
if remote spaces are used, remote space server admins can see users file lists but not content
users need to remember their own password or bye bye their data
End to End encryption
keys are encrypted by “mnemonic keys” kept in user clients and shown, on the client, at user request
only specific users-chosen sub-folders are encrypted, not the root NC space
nc admin users can’t see anything about the users encrypted folders
server admin/hackers of a compromised server can’t see anything about the users encrypted folders
if remote spaces are used, remote space server admins can’t see anything about the users encrypted folders
if the client is no longer accessible, users need to have saved their “mnemonic keys” or bye bye their data
encrypted folders (and their content) is not shareable and, by default, not visualized in the NC web interface
users can choose to visualize files in the web interface but need their “mnemonic keys” and accept that the server admin (on an hacker) could intercept the keys during this time
hmmm.. I have enables server side with system-wide master key, but I can still impersonate/see users files or change their password and login as them.
I would like to set the system with the “simple” server side encryption + recommendation for the users to keep their super secrets using something like the cryptomator software.
The threat I want to defend them from is.. myself. I am “ok” trusting the hosting company, but I don’t want to be able to see the users stuff.
I did want to experiment on server side with user specific keys (on a test NC instance of course) but I can see that Hetzner doesn’t provide the occ commad occ encryption:disable-master-key
Thank tou.
I would suggest to add a difference between server admin (& root/hackers) and NC admin. This of course is relevant only for hosted cases, but it may be important, for example to guarantee that the NC admin can’t access user data.
This was the use case, the server-side encryption was designed for in the first place.
Everything what happens server-side, an admin can manipulate. Even NC admin, this can depend a lot on the installed apps, and if they can add apps themselves, change group memberships, add external storage, … there are always ways around it.
