4 ms·

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Beca

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that remain of your grandma - you just copy across the .jpgs to a new device.

Grombobulous 3mo ago
I think we can imagine a scenario where not all of our photos are non-sensitive. I also imagine that a true E2EE architecture means you have more flexibility with cloud storage, managed hosting, and off-site backups.
- AussieWog93 3mo ago
  I hear ya, I was being a little bit over the top. But I really do think that for every one user who would turn on e2ee and get some genuine benefit out of it, there would be a dozen that turn it on because "encryption good" and accidentally lose all their data.
  - Grombobulous 3mo ago
    True, e2ee is pretty scary as far as data loss. Still, good application design can help mitigate that. Apple does it with their e2ee recovery methods, although Ente does rely on a recovery key that you should print out and put in a safe as well as store in other safe locations. But also, what I love about the E2EE of Ente is that I can securely use a cloud hosted provider but then my home NAS backups are unencrypted. The Ente desktop app has a continuous export feature where I just leave the application on my main desktop computer and it constantly backs it up to my home NAS. It also does the local machine learning and video streaming encoding processing on the desktop. So, if I lose my Ente account, no big deal. I get another one and wipe everything and restore from my NAS backup. I feel like this is the best of all worlds. I get cloud convenience and no real self-hosting burden along with solid ownership of my data. Perhaps Immich doesn’t bother with e2ee since it’s primarily designed for self-hosting, while for Ente it’s meant to be suitable for both a paid cloud service and self-hosting.
    - sylens 3mo ago
      Yeah Immich and Ente are going for two different use cases. While Ente can be self hosted, I view it as more of an escape hatch if they ever enshittify vs how I would start off using the service. I like not having to manage ingress for a photos service so my family can use it but others cannot
whalesalad 3mo ago
You solve this by communicating with it via encrypted methods, like HTTPS, and using a storage volume that is encrypted and gets unlocked at boot.
gchamonlive 3mo ago
If they steal your homelab, e2ee doesn't help, it's encryption at rest. E2ee is for rogue devices sniffing the network, which is more or less of a concern depending on your setup. I'd not have unencrypted traffic in my network if I had for instance those shady TV boxes.
- hokumguru 3mo ago
  TLS?
- drdaeman 3mo ago
  That’s incorrect. E2EE means encrypted data leaves the device, stored encrypted, and server(s) have no keys to decrypt it, only your (or other) client software does.
  - gchamonlive 3mo ago
    It's encryption both at rest and on transit. At rest there are levels of encryption, at object level or at filesystem level. E2ee for immich would mean the objects are encrypted and transmitting the data is encrypted. If the scenario is the server is stolen, you need encryption at rest. Even at FS level is enough.
    - AussieWog93 3mo ago
      Not sure why you're continuing to argue, GP's right. e2ee means that the encryption keys are stored client-side by the intended recipient. It's not just in transit and in rest.
      - gchamonlive 3mo ago
        Freedom of speech
        yownie 3mo ago
        yes that does guarantee you the right to espouse stupid opinion, correct!
drdaeman 3mo ago
I have an use case. I have a multi-region homelab cluster and I share some photos with my friends in the US and my parents in Russia. I’m auto-uploading full library (basically replacing iCloud/Google Photos) and I can share links to selected photos or albums (a reachable node will be determined by a split-view DNS). All without risks of exposing my full photo archive in case either node gets seized or otherwise compromised. (Now, this is what I’m trying to do. I set things up, but it’s not really functional at the moment, because Ente is buggy af, and I haven’t yet learned how to rebuild and debug their iOS app.)
eddythompson80 3mo ago
It would make hosting a "Family and/or friends" instance possible. I do go back and forth on the accessibility tradeoffs of E2EE for average people though. In this scenario, lose or forget your key/password and you lose ALL of your photos which are very important to some people. Losing them is pretty catastrophic. Google Photos or iPhotos really gives people a sense of security about their photos. ps: It would also make it easier to host cloud instances for Immich without encrypting the file system of a remote server/VPS. Especially when renting servers from small-time sellers, I'm always weary about how much I can really trust their employees access control. I know some level of trust is unavoidable with physical access, but how do they handle those disks during maintenance would also be relevant.
- bjackman 3mo ago
  I really don't think you want E2EE for this. I host storage for family and friends, I haven't set Immich up yet (don't think I'd have space for everyone's photos) but the choice is between: 1. "Hey just so you know, I have access to everything you upload here". 2. "Do NOT lose your password or your data will be GONE FOREVER and I CANNOT get it back". I definitely prefer 1 and I'm sure my users do too. They shouldn't upload it if they didn't trust me anyway. In my case I follow it up with "and I might actually go digging around in your files if I need to debug something or you're wasting disk space". But I think you could also follow it up with "but I do promise not to look" and that would be valid too. This whole thing only makes sense for people you're pretty close to. (I do tell people not to back up their password managers on my system though). I guess maybe for Immich specifically it would be nice to have a "vault" feature where people can upload nudes etc where they are willing to trade risk of loss for privacy on a per-photo basis.
  - palata 3mo ago
    I do agree that this is a use-case. Now a use-case for E2EE is if you want to host it on a VPS, I would say. I wouldn't trust the VPS with the photos of my friends/family.
    - eptcyka 3mo ago
drdexebtjl 3mo ago
I think the point of E2E encryption is that you could host it with a cloud provider and the provider would not be able to see your data. Kind of like how Proton Drive claims it does not know which files you have. This would force features like semantic search, face detection, video transcoding and thumbnail generation into the clients instead. Immich assumes trusting the server to have access to your photos is fine. That is always the case when you’re self-hosting. And I think that’s reasonable, since most users give that trust to Google and Apple.
- TalkingCodeMonk 3mo ago
  Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation, or abuse of user data is to prevent anyone from being able to decrypt it but the end users themselves. IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It should be standard for anything hosted on someone else's computer. You might argue it's not neccessary for cat photos, but mistakes happen and you can accidentally upload things you don't intend to. You might argue it's not neccessary for games, ebooks or other copyrighted media, but the cloud provider could scan and delete anything you own that matches a hash of copyrighted material, at any time. You can accidentally paste a password, or other sensitive piece of text, into any text field of any website or application, and have it distributed to computers around the world. E2EE can mitigate against numerous attack vectors, and reduces the surface area and blast radius of most attacks. That also applies to your own computers, if someone steals your hardware or hacks into your network. It is vital in the age of AI where all of your data could be exploited for training and profit, or used against you. The only data that should not be E2EE is situations where it is technically impossible, or the data is explicitly shared as "public" (e.g. the clearnet).
  - drdexebtjl 3mo ago
    I don’t agree E2EE is right for everything, and especially not for a personal photo library. I don’t want to hold the keys to my photo library on someone else’s computer. I want to actually have all the bits and all the hardware in my house. I want to have access to it even if the Internet ends.
dddddaviddddd 3mo ago
I think the application layer is the wrong layer for encryption for immich anyways, I just encrypt the whole disk on my server. When _self_ hosting, there's no need to prevent access to files from the operator.
palata 3mo ago
To me there are two good products: Immich and Ente. * Immich doesn't have end-to-end encryption, so I see it for self-hosting (i.e. on hardware I trust, typically at home). * Ente has end-to-end encryption, which means I can host it on a random VPS. Two different requirements for two different setups. E2EE adds some complexity, typically to set up a backup somewhere accessible. The fact that I have an unencrypted SDD next to my server at home that my family can grab and access photos is a feature to me: if I disappear I want them to be able to access them.
Gasp0de 3mo ago
You seem to be mixing up e2e encryption with at-rest-encryption? If you have a server in your homelab where you self-host I mich just encrypt the hard drive with LUKS.
utopiah 3mo ago
Agreed. It's especially frustrating to read of extremely high standard (even though justified, I'm not suggesting it's OK to have a subpar experience) while most people just share everything and anything on Facebook, TikTok, SharePoint, etc and have no idea what permissions even mean. So... yeah, sure, e2ee and encryption and all that but don't wait on perfection when the otherwise situation is pretty dire. It's only encroaching BigTech fueled by surveillance capitalism even more!
INTPenis 3mo ago
I agree, we used to have photo albums in cupboards, and they used to get burnt if the house burned down, or water damaged if the boiler broke, or even stolen. Now we have them digitally and we can back them up off-site. That's all the change I need with immich. To fully encrypt them would just be inviting more problems.
- dsego 3mo ago
  This actually happened to me, without getting into the specifics, a family member with mental issues took all the childhood photo albums and burned them.
alper 3mo ago
Privacy extremists are always very vocal but most people do not care at all about this. Maybe people have pornography production streams they want to manage using Immmich?
- pydry 3mo ago
  Im wary about having my PII hosted on vpses which I suppose makes me a privacy nut. I just host immich on an old laptop and use the VPS to establish a wireguard tunnel. I think it's ridiculous to expect immich to rearchitect everything in order to make it better able to run on untrusted hardware. It should stick to doing what it is good at.
imalerba 3mo ago
I just want to be able to share my hosted service with other people and not have the responsibility of being able to access their photos. Me or anyone that happens to gain access to my server.
owaislone 3mo ago
I want to host an instance for me and my family. Right now we have a Google One instance shared by 5 people. Having e2e means my family members can rest assured that I or whoever I share admin rights with cannot look at their private photos. It's an important enough feature even without thinking about 3rd party bad actors.
Cider9986 3mo ago
>So many comments here about missing end to end encryption, but seriously - why would anyone want this? I trust GrapheneOS's security 10x more than my server. Why would I want encryption on messaging, if it's 'just for messaging my grandma'. My data is important to me and I want to keep it secure, even if I don't have a high threat model. E2ee should be the baseline, there's no reason to make security worse on purpose. Encryption in this case is important because it allows defense in depth, it allows others to know their photos are private when using my server and it prevents data access if someone has physical access. Why trust two devices when one trust one device do trick? > Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that remain of your grandma - you just copy across the .jpgs to a new device. Yes, that's what happens when you lose your keys with e2ee. Every e2ee service is like this. Apple photos, Ente photos, Signal. If I couldn't manage a few words, why would I trust myself to manage a whole server?
rirze 3mo ago
You know why. I know why. The people who care about this disproportionately collect distasteful media and would be in criminal proceedings if their material was uncovered.
wookmaster 3mo ago
I have no idea, I use wireguard to access it. I have disk encryption setup. They'd need to hack my linux server SSH which I have protection turned on to shut it down after failed attempts. It would be a challenge to get access to my photos on disk. They could steal my phone and access through the app if they could get them all before I disabled access since Im using encrypted icloud account. In the end who would want all my photos for that amount of work lol?

Grombobulous 3mo ago

I think we can imagine a scenario where not all of our photos are non-sensitive. I also imagine that a true E2EE architecture means you have more flexibility with cloud storage, managed hosting, and off-site backups.

AussieWog93 3mo ago
I hear ya, I was being a little bit over the top. But I really do think that for every one user who would turn on e2ee and get some genuine benefit out of it, there would be a dozen that turn it on because "encryption good" and accidentally lose all their data.
- Grombobulous 3mo ago
  True, e2ee is pretty scary as far as data loss. Still, good application design can help mitigate that. Apple does it with their e2ee recovery methods, although Ente does rely on a recovery key that you should print out and put in a safe as well as store in other safe locations. But also, what I love about the E2EE of Ente is that I can securely use a cloud hosted provider but then my home NAS backups are unencrypted. The Ente desktop app has a continuous export feature where I just leave the application on my main desktop computer and it constantly backs it up to my home NAS. It also does the local machine learning and video streaming encoding processing on the desktop. So, if I lose my Ente account, no big deal. I get another one and wipe everything and restore from my NAS backup. I feel like this is the best of all worlds. I get cloud convenience and no real self-hosting burden along with solid ownership of my data. Perhaps Immich doesn’t bother with e2ee since it’s primarily designed for self-hosting, while for Ente it’s meant to be suitable for both a paid cloud service and self-hosting.
  - sylens 3mo ago
    Yeah Immich and Ente are going for two different use cases. While Ente can be self hosted, I view it as more of an escape hatch if they ever enshittify vs how I would start off using the service. I like not having to manage ingress for a photos service so my family can use it but others cannot

whalesalad 3mo ago

You solve this by communicating with it via encrypted methods, like HTTPS, and using a storage volume that is encrypted and gets unlocked at boot.

gchamonlive 3mo ago

If they steal your homelab, e2ee doesn't help, it's encryption at rest. E2ee is for rogue devices sniffing the network, which is more or less of a concern depending on your setup. I'd not have unencrypted traffic in my network if I had for instance those shady TV boxes.

hokumguru 3mo ago
TLS?
drdaeman 3mo ago
That’s incorrect. E2EE means encrypted data leaves the device, stored encrypted, and server(s) have no keys to decrypt it, only your (or other) client software does.
- gchamonlive 3mo ago
  It's encryption both at rest and on transit. At rest there are levels of encryption, at object level or at filesystem level. E2ee for immich would mean the objects are encrypted and transmitting the data is encrypted. If the scenario is the server is stolen, you need encryption at rest. Even at FS level is enough.
  - AussieWog93 3mo ago
    Not sure why you're continuing to argue, GP's right. e2ee means that the encryption keys are stored client-side by the intended recipient. It's not just in transit and in rest.
    - gchamonlive 3mo ago
      Freedom of speech
      - yownie 3mo ago
        yes that does guarantee you the right to espouse stupid opinion, correct!

drdaeman 3mo ago

I have an use case. I have a multi-region homelab cluster and I share some photos with my friends in the US and my parents in Russia. I’m auto-uploading full library (basically replacing iCloud/Google Photos) and I can share links to selected photos or albums (a reachable node will be determined by a split-view DNS). All without risks of exposing my full photo archive in case either node gets seized or otherwise compromised. (Now, this is what I’m trying to do. I set things up, but it’s not really functional at the moment, because Ente is buggy af, and I haven’t yet learned how to rebuild and debug their iOS app.)

eddythompson80 3mo ago

It would make hosting a "Family and/or friends" instance possible. I do go back and forth on the accessibility tradeoffs of E2EE for average people though. In this scenario, lose or forget your key/password and you lose ALL of your photos which are very important to some people. Losing them is pretty catastrophic. Google Photos or iPhotos really gives people a sense of security about their photos. ps: It would also make it easier to host cloud instances for Immich without encrypting the file system of a remote server/VPS. Especially when renting servers from small-time sellers, I'm always weary about how much I can really trust their employees access control. I know some level of trust is unavoidable with physical access, but how do they handle those disks during maintenance would also be relevant.

bjackman 3mo ago
I really don't think you want E2EE for this. I host storage for family and friends, I haven't set Immich up yet (don't think I'd have space for everyone's photos) but the choice is between: 1. "Hey just so you know, I have access to everything you upload here". 2. "Do NOT lose your password or your data will be GONE FOREVER and I CANNOT get it back". I definitely prefer 1 and I'm sure my users do too. They shouldn't upload it if they didn't trust me anyway. In my case I follow it up with "and I might actually go digging around in your files if I need to debug something or you're wasting disk space". But I think you could also follow it up with "but I do promise not to look" and that would be valid too. This whole thing only makes sense for people you're pretty close to. (I do tell people not to back up their password managers on my system though). I guess maybe for Immich specifically it would be nice to have a "vault" feature where people can upload nudes etc where they are willing to trade risk of loss for privacy on a per-photo basis.
- palata 3mo ago
  I do agree that this is a use-case. Now a use-case for E2EE is if you want to host it on a VPS, I would say. I wouldn't trust the VPS with the photos of my friends/family.
  - eptcyka 3mo ago

drdexebtjl 3mo ago

I think the point of E2E encryption is that you could host it with a cloud provider and the provider would not be able to see your data. Kind of like how Proton Drive claims it does not know which files you have. This would force features like semantic search, face detection, video transcoding and thumbnail generation into the clients instead. Immich assumes trusting the server to have access to your photos is fine. That is always the case when you’re self-hosting. And I think that’s reasonable, since most users give that trust to Google and Apple.

TalkingCodeMonk 3mo ago
Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation, or abuse of user data is to prevent anyone from being able to decrypt it but the end users themselves. IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It should be standard for anything hosted on someone else's computer. You might argue it's not neccessary for cat photos, but mistakes happen and you can accidentally upload things you don't intend to. You might argue it's not neccessary for games, ebooks or other copyrighted media, but the cloud provider could scan and delete anything you own that matches a hash of copyrighted material, at any time. You can accidentally paste a password, or other sensitive piece of text, into any text field of any website or application, and have it distributed to computers around the world. E2EE can mitigate against numerous attack vectors, and reduces the surface area and blast radius of most attacks. That also applies to your own computers, if someone steals your hardware or hacks into your network. It is vital in the age of AI where all of your data could be exploited for training and profit, or used against you. The only data that should not be E2EE is situations where it is technically impossible, or the data is explicitly shared as "public" (e.g. the clearnet).
- drdexebtjl 3mo ago
  I don’t agree E2EE is right for everything, and especially not for a personal photo library. I don’t want to hold the keys to my photo library on someone else’s computer. I want to actually have all the bits and all the hardware in my house. I want to have access to it even if the Internet ends.

dddddaviddddd 3mo ago

I think the application layer is the wrong layer for encryption for immich anyways, I just encrypt the whole disk on my server. When _self_ hosting, there's no need to prevent access to files from the operator.

palata 3mo ago

To me there are two good products: Immich and Ente. * Immich doesn't have end-to-end encryption, so I see it for self-hosting (i.e. on hardware I trust, typically at home). * Ente has end-to-end encryption, which means I can host it on a random VPS. Two different requirements for two different setups. E2EE adds some complexity, typically to set up a backup somewhere accessible. The fact that I have an unencrypted SDD next to my server at home that my family can grab and access photos is a feature to me: if I disappear I want them to be able to access them.

Gasp0de 3mo ago

You seem to be mixing up e2e encryption with at-rest-encryption? If you have a server in your homelab where you self-host I mich just encrypt the hard drive with LUKS.

utopiah 3mo ago

Agreed. It's especially frustrating to read of extremely high standard (even though justified, I'm not suggesting it's OK to have a subpar experience) while most people just share everything and anything on Facebook, TikTok, SharePoint, etc and have no idea what permissions even mean. So... yeah, sure, e2ee and encryption and all that but don't wait on perfection when the otherwise situation is pretty dire. It's only encroaching BigTech fueled by surveillance capitalism even more!

INTPenis 3mo ago

I agree, we used to have photo albums in cupboards, and they used to get burnt if the house burned down, or water damaged if the boiler broke, or even stolen. Now we have them digitally and we can back them up off-site. That's all the change I need with immich. To fully encrypt them would just be inviting more problems.

dsego 3mo ago
This actually happened to me, without getting into the specifics, a family member with mental issues took all the childhood photo albums and burned them.

alper 3mo ago

Privacy extremists are always very vocal but most people do not care at all about this. Maybe people have pornography production streams they want to manage using Immmich?

pydry 3mo ago
Im wary about having my PII hosted on vpses which I suppose makes me a privacy nut. I just host immich on an old laptop and use the VPS to establish a wireguard tunnel. I think it's ridiculous to expect immich to rearchitect everything in order to make it better able to run on untrusted hardware. It should stick to doing what it is good at.

imalerba 3mo ago

I just want to be able to share my hosted service with other people and not have the responsibility of being able to access their photos. Me or anyone that happens to gain access to my server.

owaislone 3mo ago

I want to host an instance for me and my family. Right now we have a Google One instance shared by 5 people. Having e2e means my family members can rest assured that I or whoever I share admin rights with cannot look at their private photos. It's an important enough feature even without thinking about 3rd party bad actors.

Cider9986 3mo ago

>So many comments here about missing end to end encryption, but seriously - why would anyone want this? I trust GrapheneOS's security 10x more than my server. Why would I want encryption on messaging, if it's 'just for messaging my grandma'. My data is important to me and I want to keep it secure, even if I don't have a high threat model. E2ee should be the baseline, there's no reason to make security worse on purpose. Encryption in this case is important because it allows defense in depth, it allows others to know their photos are private when using my server and it prevents data access if someone has physical access. Why trust two devices when one trust one device do trick? > Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that remain of your grandma - you just copy across the .jpgs to a new device. Yes, that's what happens when you lose your keys with e2ee. Every e2ee service is like this. Apple photos, Ente photos, Signal. If I couldn't manage a few words, why would I trust myself to manage a whole server?

rirze 3mo ago

You know why. I know why. The people who care about this disproportionately collect distasteful media and would be in criminal proceedings if their material was uncovered.

wookmaster 3mo ago

I have no idea, I use wireguard to access it. I have disk encryption setup. They'd need to hack my linux server SSH which I have protection turned on to shut it down after failed attempts. It would be a challenge to get access to my photos on disk. They could steal my phone and access through the app if they could get them all before I disabled access since Im using encrypted icloud account. In the end who would want all my photos for that amount of work lol?