At this time, Consol supports encryption only of certain content types, viz. notes, code blocks, and images, for users who have subscribed to the E2EE component. The other content types available in Consol are not yet encryptable.
Notably, Consol E2EE does not yet support encryption of the titles of any content types. For example, if you create a Consol note and encrypt it, the text you add to the note’s body will be encrypted but its title will not be encrypted. For now, you should operate accordingly. We plan to improve this in the future.
You acknowledge that if you encrypt an item after you create and add content to it, there may be a period of time in which your item’s body content is not encrypted while being stored in our database. To ensure the greatest security currently available in Consol’s system, you should, where possible, encrypt an item in its pageview before you begin adding content to it. It is better practice in Consol to encrypt an item first and only then begin work by adding content.
This means that for certain content types that require creation and upload before the pageview is visible, such as uploadable or linkable images, Consol does not yet provide a way to encrypt such body data beforehand. You acknowledge and consent to the attendant risk that you must manually designate certain content for encryption after it has been uploaded.
I don't appreciate having to dig through your FAQ to find the holes and caveats. There is literally no technical reason for this.
If you are going to make security promises like this you need to:
You acknowledge that if you encrypt an item after you create and add content to it, there may be a period of time in which your item’s body content is not encrypted while being stored in our database
So.... the data goes across the wire in clear-text, and is encrypted later? Ummm, sorry, no.
First off, I'm not interested in anything that stores data that I might want to encrypt "in the cloud". It goes on my own server. Full. Stop. And sending data across the wire in the clear and encrypting later? ? I mean.... ???
And sending data across the wire in the clear and encrypting later
As I understand it, the app uses SSL, so data is always sent over a (presumed) safe transport. I do agree that in order to meaningfully differentiate from the Google/Microsoft/Dropbox/OtherCloudFirm CanHasAllYourDataPlease-model encryption needs to happen 1) on the client 2) by default 3) For everything (including meta-data like filenames 4) should probably not be possible to turn off
Either way, I find it interesting that someone is trying to do at least some things right. It'll never be secure as a hosted solution (presumably they can (be ordered to)) backdoor the client at any time - see Lavabit) -- so I'm not sure I see the point (secure, but not actually secure?). Maybe release it under AGPL and offer a hosted version in order to a) have the client(s) be open and b) offer a solution to those that want to make the trade-off?
It would still be miles better than storing data with a provider that openly says they datamine everything.
My reading of it is that it probably has an autosave feature so if I begin typing "This is my super secret password: hunter2" and then click encrypt it may have already sent the content over the wire before I hit the encrypt button.
But that is just my reading of it, maybe the dev can correct me.
Yes, that will happen. Click "Crypto" first, then if you type content in the item, it will be encrypted from the get-go. We're working on changing this so you don't have to manually enable "Crypto" first.
This is our initial implementation and we know it's limited. Enable encryption on an item FIRST, before you add content. From then on, any data you add to that item will be encrypted by your browser before transfer. The cloud server is not encrypting the data.
Make no mistake, it is end-to-end encryption. The browser encrypts and decrypts the data, not the cloud. The version we're developing will not require the user to have to enable anything beforehand.
Comments
https://www.consol.io/encryption/
I don't appreciate having to dig through your FAQ to find the holes and caveats. There is literally no technical reason for this.
If you are going to make security promises like this you need to:
1) Actually have them implemented.
2) Have them secure by default.
So.... the data goes across the wire in clear-text, and is encrypted later? Ummm, sorry, no.
First off, I'm not interested in anything that stores data that I might want to encrypt "in the cloud". It goes on my own server. Full. Stop. And sending data across the wire in the clear and encrypting later? ? I mean.... ???
As I understand it, the app uses SSL, so data is always sent over a (presumed) safe transport. I do agree that in order to meaningfully differentiate from the Google/Microsoft/Dropbox/OtherCloudFirm CanHasAllYourDataPlease-model encryption needs to happen 1) on the client 2) by default 3) For everything (including meta-data like filenames 4) should probably not be possible to turn off
Either way, I find it interesting that someone is trying to do at least some things right. It'll never be secure as a hosted solution (presumably they can (be ordered to)) backdoor the client at any time - see Lavabit) -- so I'm not sure I see the point (secure, but not actually secure?). Maybe release it under AGPL and offer a hosted version in order to a) have the client(s) be open and b) offer a solution to those that want to make the trade-off?
It would still be miles better than storing data with a provider that openly says they datamine everything.
My reading of it is that it probably has an autosave feature so if I begin typing "This is my super secret password: hunter2" and then click encrypt it may have already sent the content over the wire before I hit the encrypt button.
But that is just my reading of it, maybe the dev can correct me.
Yes, that will happen. Click "Crypto" first, then if you type content in the item, it will be encrypted from the get-go. We're working on changing this so you don't have to manually enable "Crypto" first.
This is our initial implementation and we know it's limited. Enable encryption on an item FIRST, before you add content. From then on, any data you add to that item will be encrypted by your browser before transfer. The cloud server is not encrypting the data.
You may know it is limited but the video literally says "End-to-end encryption." That's more than misleading.
Make no mistake, it is end-to-end encryption. The browser encrypts and decrypts the data, not the cloud. The version we're developing will not require the user to have to enable anything beforehand.