4 ms·

I've been concerned about Obsidian sync. IIRC, data goes to AWS servers but where does it go from there? From reading the Obsidian website, they seem a tiny co

I've been concerned about Obsidian sync. IIRC, data goes to AWS servers but where does it go from there? From reading the Obsidian website, they seem a tiny company. However, it is unclear where they are based and, therefore, what legal obligations they are operating under. What more, Obsidian has so far avoided the levels of compliance that allows for adoption by big businesses. I love me some Obsidian but I'm mindful that, using their services, I just don't know how my data is being treated. I realize vaults are encrypted locally. However, do we know that our vault secret isn't shared with Obsidian? Sure, it's (mostly?) an Electron app. But just how transparent and accountable is Obsidian about their operations?

operator-name 4y ago
You don't have to use obsidian sync. Workspaces are just markdown files in your prefered folder structure, with some obsidian metadata (plugins, recently opened, etc). You can back them up in the same way as any files/folders.
Royaljj 4y ago
I can't answer any of your other questions but Obsidian is owned by Dynalist, which is based in Oakville, Ontario, Canada. Their OCN number is 2538019 if you want to search them up, they're also on CrunchBase https://www.crunchbase.com/organization/dynalist https://www.crunchbase.com/organization/dynalist
kepano 4y ago
Obsidian is based in Canada. Obsidian Sync is E2E encrypted so the company has no way of accessing your files. The privacy policy is here https://obsidian.md/privacy https://obsidian.md/privacy You also do not need to trust Obsidian with any of your data. The files are local to your device so you can sync them however you want. If you don't want to use Obsidian Sync you can use Git, Dropbox, Syncthing, etc.
pjdkoch 4y ago
https://syncthing.net/ https://syncthing.net/ is your friend, too.
bovermyer 4y ago
I just have Obsidian save locally, and I use Sync to sync those files between machines.
joethei 4y ago
No, we do not use AWS. The Sync and Publish servers are running in Digital Ocean datacenters in the US. How sync encrypts the data is documented here: https://help.obsidian.md/Obsidian+Sync/Security+and+privacy https://help.obsidian.md/Obsidian+Sync/Security+and+privacy As others have already pointed out, Sync is not the only option to synchronize notes, Obsidian sync is just a convenience option. For compliance, I am guessing you mean certs like SOC 2 / ISO 27001?, or what are you referencing? As we are a tiny company (6 people, not all full time) we just can't expense the time needed to get such a certificate.
- sleight42 4y ago
  SOC2, yes.
  - jpillora 4y ago
    Relevant https://securitycryptographywhatever.buzzsprout.com/1822302/11510254-soc2-with-sarah-harvey https://securitycryptographywhatever.buzzsprout.com/1822302/...
- sasas 4y ago
  From the link: > AES-256 is a military-grade encryption specification that's widely used in for example online banking. The term “military grade” is meaningless and if anything raises a red flag (at least to me). What would be more useful is a detailed spec on the implementation. Are the crypto routines implemented in house or has a well tested library been used? If in house, had there been an external code audit done? What were the results ?
  - s0ulphire 4y ago
    The data is successfully encrypted before it's sent (which you can verify with wireshark). What exactly are your concerns, given that the data isn't encrypted locally in the first place? And seriously with the question...what do you think is more likely, that the tiny team of 6 invested a ton of time reinventing the wheel with a custom in-house AES implementation, OR that they used any of the readily available and extremely well tested libraries? SMH

operator-name 4y ago

You don't have to use obsidian sync. Workspaces are just markdown files in your prefered folder structure, with some obsidian metadata (plugins, recently opened, etc). You can back them up in the same way as any files/folders.

Royaljj 4y ago

I can't answer any of your other questions but Obsidian is owned by Dynalist, which is based in Oakville, Ontario, Canada. Their OCN number is 2538019 if you want to search them up, they're also on CrunchBase https://www.crunchbase.com/organization/dynalist https://www.crunchbase.com/organization/dynalist

kepano 4y ago

Obsidian is based in Canada. Obsidian Sync is E2E encrypted so the company has no way of accessing your files. The privacy policy is here https://obsidian.md/privacy https://obsidian.md/privacy You also do not need to trust Obsidian with any of your data. The files are local to your device so you can sync them however you want. If you don't want to use Obsidian Sync you can use Git, Dropbox, Syncthing, etc.

pjdkoch 4y ago

https://syncthing.net/ https://syncthing.net/ is your friend, too.

bovermyer 4y ago

I just have Obsidian save locally, and I use Sync to sync those files between machines.

joethei 4y ago

No, we do not use AWS. The Sync and Publish servers are running in Digital Ocean datacenters in the US. How sync encrypts the data is documented here: https://help.obsidian.md/Obsidian+Sync/Security+and+privacy https://help.obsidian.md/Obsidian+Sync/Security+and+privacy As others have already pointed out, Sync is not the only option to synchronize notes, Obsidian sync is just a convenience option. For compliance, I am guessing you mean certs like SOC 2 / ISO 27001?, or what are you referencing? As we are a tiny company (6 people, not all full time) we just can't expense the time needed to get such a certificate.

sleight42 4y ago
SOC2, yes.
- jpillora 4y ago
  Relevant https://securitycryptographywhatever.buzzsprout.com/1822302/11510254-soc2-with-sarah-harvey https://securitycryptographywhatever.buzzsprout.com/1822302/...
sasas 4y ago
From the link: > AES-256 is a military-grade encryption specification that's widely used in for example online banking. The term “military grade” is meaningless and if anything raises a red flag (at least to me). What would be more useful is a detailed spec on the implementation. Are the crypto routines implemented in house or has a well tested library been used? If in house, had there been an external code audit done? What were the results ?
- s0ulphire 4y ago
  The data is successfully encrypted before it's sent (which you can verify with wireshark). What exactly are your concerns, given that the data isn't encrypted locally in the first place? And seriously with the question...what do you think is more likely, that the tiny team of 6 invested a ton of time reinventing the wheel with a custom in-house AES implementation, OR that they used any of the readily available and extremely well tested libraries? SMH