3 ms·

So what is the implication of this? The major reason to use the crypto module is that my users can add their google drives to owncloud and its encrypted on ther

by nickik 11y ago

So what is the implication of this? The major reason to use the crypto module is that my users can add their google drives to owncloud and its encrypted on there. Whats the recommended course of action?

schlowmo 11y ago
If you want to go along with owncloud (and I don't know a proper alternative) there's not much you can do then upgrading to Owncloud 9 and hope that the fix was done right. In the meantime you could encourage your users to use their own client-side encryption while giving up the idea of an easy setup.
- nickik 11y ago
  Im already running the newest version. I hope they approve on it in future versions. Client side crypto would be cool.
  - ultra2d 11y ago
    Someone is working on that. It's called ownCrypt: https://github.com/owncloud/client/issues/4327 https://github.com/owncloud/client/issues/4327 and https://conference.owncloud.org/conference/oCC2015/proposal/72 https://conference.owncloud.org/conference/oCC2015/proposal/...
  - BjoernSchiessle 11y ago
    There are some community activities to implement client-side encryption. But as far as I know there doesn't exists any running code at the moment. So don't expect to much in the next few months. In general I want to note that client side encryption is great. I also like and use it in many areas. But you also have to keep in mind that it will make most of the web interface and it features useless. Personally I run my ownCloud in my basement. The connection to the server is secured by https and the hard disc is encrypted with LUKS. In this case it doesn't make sense to me to add additionally server-side or client-side encryption. The first step is always to check your threat model, your setup and your requirements to see if you really need server-/client-side encryption.
BjoernSchiessle 11y ago
As always it is not black and white. It depends on your threat model. If you just want to make sure that Google can't read your content (which was the original intention of ownClouds server-side encryption) then everything is fine. Also with older versions. But if you fear that Google might not only read your data but manipulate it then I would suggest to upgrade to ownCloud >= 9.0. But keep in mind that the files only get encrypted the new way the first time you touch them. ownCloud will not migrate all your existing files to the new encryption which includes the signature.

by nickik 11y ago

schlowmo 11y ago

If you want to go along with owncloud (and I don't know a proper alternative) there's not much you can do then upgrading to Owncloud 9 and hope that the fix was done right. In the meantime you could encourage your users to use their own client-side encryption while giving up the idea of an easy setup.

nickik 11y ago
Im already running the newest version. I hope they approve on it in future versions. Client side crypto would be cool.
- ultra2d 11y ago
  Someone is working on that. It's called ownCrypt: https://github.com/owncloud/client/issues/4327 https://github.com/owncloud/client/issues/4327 and https://conference.owncloud.org/conference/oCC2015/proposal/72 https://conference.owncloud.org/conference/oCC2015/proposal/...
- BjoernSchiessle 11y ago
  There are some community activities to implement client-side encryption. But as far as I know there doesn't exists any running code at the moment. So don't expect to much in the next few months. In general I want to note that client side encryption is great. I also like and use it in many areas. But you also have to keep in mind that it will make most of the web interface and it features useless. Personally I run my ownCloud in my basement. The connection to the server is secured by https and the hard disc is encrypted with LUKS. In this case it doesn't make sense to me to add additionally server-side or client-side encryption. The first step is always to check your threat model, your setup and your requirements to see if you really need server-/client-side encryption.

BjoernSchiessle 11y ago

As always it is not black and white. It depends on your threat model. If you just want to make sure that Google can't read your content (which was the original intention of ownClouds server-side encryption) then everything is fine. Also with older versions. But if you fear that Google might not only read your data but manipulate it then I would suggest to upgrade to ownCloud >= 9.0. But keep in mind that the files only get encrypted the new way the first time you touch them. ownCloud will not migrate all your existing files to the new encryption which includes the signature.