3 ms·

The 'traditional' method requires gpg on the client machine. The vault was just a way of uploading text and having it encrypted on the server automatically. The

by Cogito 14y ago

The 'traditional' method requires gpg on the client machine. The vault was just a way of uploading text and having it encrypted on the server automatically. The user was required to download the encrypted data and then decode it themselves. You can now do more things, like password protect the data, provide access to specific users, and perform a 'server assisted' decryption, which allows you to provide the private key without needing a gpg client. I haven't personally worked on this plugin, so I might not have the details perfectly correct, but that is more or less how it works :) [edit] I forgot to mention, the encryption keys are uploaded by the admin, so a user is able to select from a list of keys to encrypt with when they upload the data. That might not have been clear before.

lifeisstillgood 14y ago
So the security is essentially as strong as the Confluence User security? As an aside, are you aware of what progress has or has not been made in GPG as part of a browser API? I am not sure if thats your area cheers
- Cogito 14y ago
  > So the security is essentially as strong as the Confluence User security? There are two main types of security provided by the plugin, gpg key pair encryption and user access control. The user access control is only as good as Confluence security, except that you can additionally ask for a password. The gpg encryption is as good as your private key management. There is a new option that allows users to decrypt without installing gpg on their local machine, however they still require the private key and passphrase. With regards to gpg as a browser api, I am not sure what progress has been made. For this application, if you use the in-browser decryption, it appears that the decryption is done server side. I'm not sure what the security implications of that would be, although I would want to be using a secured connection at the least.

by Cogito 14y ago

lifeisstillgood 14y ago

So the security is essentially as strong as the Confluence User security? As an aside, are you aware of what progress has or has not been made in GPG as part of a browser API? I am not sure if thats your area cheers

Cogito 14y ago
> So the security is essentially as strong as the Confluence User security? There are two main types of security provided by the plugin, gpg key pair encryption and user access control. The user access control is only as good as Confluence security, except that you can additionally ask for a password. The gpg encryption is as good as your private key management. There is a new option that allows users to decrypt without installing gpg on their local machine, however they still require the private key and passphrase. With regards to gpg as a browser api, I am not sure what progress has been made. For this application, if you use the in-browser decryption, it appears that the decryption is done server side. I'm not sure what the security implications of that would be, although I would want to be using a secured connection at the least.