feature request: switch off encryption
pkoevesdi opened this issue · comments
Encryption is nice and I'm a total fan of it. :-) And, of course, this feature request is not about switching it off by default, but to give the user the option.
Since I use an own server for my notes, secured with SSL, I have no need to have it enrypted on the server. In this case, encryption makes things unnecessary complicated.
The problem is, I cannot reach my notes without a client app out of the naturally limited choice (no offend!) that this project provides.
I'm not sure, which format the notes would have if unencrypted, but I'd like to see markdown; and I think all the formatting could be made in markdown.
Use Cases:
- read/write Notes on
- own Linux desktop computer (see #138)
- internet cafe's computer (any OS, but I'm not allowed to install something)
- webbrowser (at least viewing text files via webdav would be possible, if not encrypted)
- the server itself (nano, cat, or any desktop text editor, in case it has a desktop)
If not markdown, I'd appreciate any reasonably human readble format. html or xml would already be a workable compromise. At least not encrypted and not some sort of binary format. What is the "original" format that silent notes uses outside encryption? I'd take a look on my android phone, but couldn't find them. Where are they stored?
The notes are stored in the HTML format, when they are stored locally on the device. The paths to the repositories are:
- Windows: %localappdata%\Packages\22846MartinStoeckli.SilentNotes_4aa5zt7h99ppe\LocalState
- Android: data/data/ch.martinstoeckli.silentnotes/no_backup/
I wouldn't like the idea of making the online storage available in unencrypted form, it is just a matter of storing the transfercode and would open possible security vulnerabilities. Instead I already thought about implementing an automatic backup to a user defined directory, which could be done in unencrypted form. The backup should be independend of the online synchronization. This would also solve the problem, what do you think?
Thank for the links. On my device, it's not in data/data/ch.martinstoeckli.silentnotes/no_backup/, but I looked into the exports, it's ok, it's easy html.
With the proposed solution as a backup, I copuld take care myself for syncing it, but the problem is: I still couldn't edit it and get it back into the app, could I?
Another possible solution for server owners like me:
Make some sort of component (maybe the linux client with headless capacilities), which is able to read and write to and from the silentnotes repo. This could run on the server and I can make a script to make the component decrypt notes into a local server directory, when the repo has changed and encrypt it back into the repo when the unpacked files have changed.
In my case I'd convert them on the server to .md and vice versa and make them available in my nextcloud instance.
Considering the problem of simultaneously changes: handle them the same way as between different clients now - I didn't try it, but it must be handled already, right?
I could try to help developing, If You would point me in the right direction. Is there some sort of library to decrypt and encrypt the container?
Some side notes:
I must say, I totally appreciate silentnotes for the very good Android app, but now I found joplin and find many of my requirements apart from that already fulfilled there. But they have an horrible Android App without Wysiwyg, only markdown source editable.
And: a very strong and often voiced demand by the users for Wysiwyg on Android is declined by the developers, in an very strict, almost rude way, like other requests as well.
So, big compliment to You for Your way of seemingly appreciating voiced wishes by users.
That's why I'd really like to help this project, in case I can (by competency and time effort).
The path is protected by Android, you would require a rooted device to read the file, but on Windows the file is accessible. I can send you an example if you want, it is a readable XML file and the notes are encoded HTML so the XML syntax stays valid.
Theoretically one could alter the XML file and SilentNotes would read the modified notes, but one would have to take care about the timestamps too, the newer modification date determines which note wins by a synchronisation. Deleted notes have to be marked, so they are either in the recycle bin or their ID is in the list of deleted notes (necessary for multi device sync). Notes which are part of a safe are still encrypted with the user password. Finally there is the problem of updating the respository format, this can be done by incrementing the version number, so devices with older versions do not remove features which are not yet implemented.
A synchronization means getting the repo from the server, merge the newer notes from server or client, and if necessary upload the new repository to the server. When we implement it on the server, the steps are actually the same, but it would indeed be possible to reuse the code, it's Xamarin and it can be compiled for Unix. The problem so far was the GUI, I didn't get the WebView to run.
The code for encryption you can find here: https://github.com/martinstoeckli/SilentNotes/blob/main/src/SilentNotes.Shared/Crypto/Cryptor.cs . Before the encryption, the content is also compressed, to save bandwidth. It should be possible to compile on Linux. The merging of two repositories is handled here: https://github.com/martinstoeckli/SilentNotes/blob/main/src/SilentNotes.Shared/Workers/NoteRepositoryMerger.cs
Ok, thank You very much, that can be a starting point for me. But I cannot promise anything more than taking a look at it, and of course share, what ever I'll be able to do.