[DOC-152] End-to-End Encryption for Documents

documenso / backlog

The long-term backlog of Documenso. Issues that are being worked on or will be worked on soon are in the main repo.

2 stars 0 forks source link

Open ElTimuro opened 1 year ago

ElTimuro commented 1 year ago

Encrypting Document E2E would allow for greater privacy when using Documenso instances, especially the hosted version by Documens Inc.
This brings the classical Key Dilemma: If there is a key who holds it and what if they lose it? Will everything be lost
A tradeoff has to be made here between failure recovery and privacy.
E2E encryption could be opt-in for informed users and organizations.

The-Robin-Hood commented 1 year ago

Hi @ElTimuro, I would like to discuss regarding this feature.

what's your thought about this ?

ElTimuro commented 11 months ago

Interesting.

Not uploading is an interesting architecture, Certifaction does sth. Like this.
We are currently thing about rather encrypting at rest than E2E
Letting customers manage the encryption keys for the whole setup is risky (loss rather than leak) and not what the enterprise wants AFAIK
since the high-security cases host themselves anyway.

The-Robin-Hood commented 11 months ago

Do we have any other better approach for this ?