Password protection

[Den4ik]

It would be good if add password protection to notebook. I like share my notebook on dropbox, but I want to be sure that my notes is in secure

[ylian]

Do you mean password protection for a shared notebook or encrypting your notebook?

If the latter, Dropbox already encrypts all the files on their server: https://www.dropbox.com/en/help/27.

[nhi-vanye]

I'd like client side encryption at the notebook level. Its not that I don't trust dropbox, but maybe I only want to share my notebooks inside the firewall

Since there are multiple ways to share a notebook between computers - encryption should be handled client side and not rely on the server storing things securely.

[n3bulous]

I'd like encryption at the notebook level as well. IMNSHO, I think in-app note sharing is overrated. Will pay extra for encryption :)

[nhi-vanye]

Since getting encryption correct seems to be hard - is it possible to work with an existing trusted vendor - i.e. 1Password ?

[n3bulous]

Thoughts on what makes it hard? The encryption itself is easy, but depending on your file store it could be difficult. I figured it could be easy for you since everything is text. Search might be annoying, but that could/should be ignored for an encrypted note book (except maybe titles?)

I suppose my definition of an encrypted notebook is that all notes w/in it are individually encrypted, not the notebook encrypted as a whole. The Chef config management tool handles it by adding encryption meta data to each top-level hash key with the contents of the hash key encrypted. Applying this concept to one of the Quiver tutorial pages might look like:

{
  "title": "5 - Preview and Presentation",
  "cells": [
    {
      "type": "text",
      "encrypted_data": "...",
      "cipher": "aes-256-cbc",
      "iv": "AAAAAAAAAAAAAAAAAAAAAA==",
      "version": 1
    },
    {
      "type": "text",
      "encrypted_data": "...",
      "cipher": "aes-256-cbc",
      "iv": "AAAAAAAAAAAAAAAAAAAAAA==",
      "version": 1
    },
    {
      "type": "text",
      "encrypted_data": "...",
      "cipher": "aes-256-cbc",
      "iv": "AAAAAAAAAAAAAAAAAAAAAA==",
      "version": 1
    }
  ]
}

iv is just the initialization vector/nonce (I googled it).

Alternatively (and faster), you could encrypt all the cells together. In the back of my head, I thought the type of cell data might be useful...

Another issue might be Apple App Store policy, but I can't remember which app I came across that may have claimed that.

Thoughts?

EDIT: Possibly useful for reference: https://github.com/chef/chef/tree/master/lib/chef/encrypted_data_bag_item

[ylian]

@n3bulous Thanks for the reference. I don't think this is particularly hard to implement, but it does require major work (UI, workflow, data format changes, etc.). This will be implemented sometime down the road, as I want to address many other more pressing issues right now.

[MauledByLove]

One approach for the original user would be to create a password-protected disk image (on Mac, a sparseimage) and sync that with Dropbox.

[n3bulous]

@MauledByLove Good suggestion until the mobile app is released! :)

[pdrbrnd]

@ylian any news on password-protecting notes or notebooks? It's the one feature that's currently keeping me from buying it

[hunttom]

As a temporary solution, you could mount an encrypted drive using third-party tool like Cryptomator. Within the mounted drive (on the cloud of your choice), save your Library. Its the best solution I could come up with for a transparent, client-side encrypted notebook.

[CyberTianzun]

if quiver support p2p encryption, i'll buy quiver.