Add encryption support
sbernhard opened this issue · 20 comments
Currently, encryption isn't supported for group folders. Group folders are a highly used feature if you use nextcloud in groups - which is, a very common scenario.
To finish the story of encrypt all files and end-to-end encryption, it would really make sense to support encryption for group folders, too!
Yes, i agree with @sbernhard i think this should be a must have.
I'm also encrypting everything in NextCloud by default, but it would certainly be very useful to have group folders.
I assume this is complicated by NextCloud's per user encryption keys? Maybe create a virtual user to own all of the files in group folders?
+1 for this feature
Yes, encryption for group folders should be a must have.
Users of the plugin should be warned when they try to use encrypted group folders when that is not supported.
Otherwise they consider the software to be be "unstable" - that's bad for this great project :-)
I support this request - until right now i thought it was a bug, but as i see now, it is encryption is as of now not supported in group folders.
is somebody working on implementing encryption to group folders?
Is anything in particular stopping the development of this? Can we contribute anything? Is NC missing some core feature which makes this impossible?
this feature is very strategic .Is anything in particular stopping the development of this?
Could we have an official comment on this issue please ? Groupfolders is officially featured. Encryption 🔑 seems so critical for sovereign data hosting; it is beyond my comprehension that this issue has not been addressed at a higher priority level. 😮
Is there some alternative planning for group folders / sharing? What is there that we do not see here? 🧐
NB: not judging, just truly confused as a fervent supporter of NextCloud 🥺
@juliushaertl What do think about this? Do you see this request happening in the near future?
Nothing planned in that regard. I also question the actual use case of using server side encryption which was primarily designed for external storages. In the end the keys and secret (when using a master key) are stored on the same storage so anyone who has access to those can also decrypt the files.
I also question the actual use case ... primarily designed for external storages.
Use case: I run NC in AWS, and would like to use S3 for storage. I have users who want to use group folders, but I don't trust the connection between my instance and S3. These features really shouldn't be mutually exclusive.
I understand this is a tricky problem to solve, but users have been asking for this for four years, and the need seems pretty clear cut to me.
I also question the actual use case of using server side encryption which was primarily designed for external storages
There are many use cases. External storage can be mounted locally. Protecting a single master key is a lot easier than an entire directory structure. And let's not forget the simple fact that NC supports locally encrypted storage, and that it's only the groupfolders feature that doesn't.
Some of the people in this thread have been trying to understand what the technical difficulties with this issue are. Some of us are willing to put in the effort to help get this off the ground. But this attitude of ignoring the problem for well over a year (and presumably longer) doesn't seem very constructive. We want to help, but we need a place to start.
@juliushaertl Thank you for your prompt reply; much appreciated 🙌
Having the public & secret keys at the same location is not the only design possible though, is it? I'm no expert but I believe a program installed on another server could be used for authentication / master key validation.
Nothing planned in that regard. I also question the actual use case of using server side encryption which was primarily designed for external storages. In the end the keys and secret (when using a master key) are stored on the same storage so anyone who has access to those can also decrypt the files.
@juliushaertl Thank you very much for the quick response :)
I think if it is not supported at least it should not fail when moving files from a user share to a groupfolder. In my case the user share was encrypted and after moving the file to the group folder (using the web interface), the encrypted file was in the groupfolder but no keymaterial available anymore. The file was broken and I needed to recover from a backup.
At least encrypted files should be decrypted before moving to a group folder!
What is the status here, since encryption can be activated in the latest release?
https://github.com/nextcloud/groupfolders/releases/tag/v12.0.2
Still an issue on NC 25.0.1 with groupfolder enabled and encryption on
in the following commit it looks like you still have to enable encryption for groupfolders:
2df8760
But I have not yet found anything about this in the documentary.
Any news on this one year later?