Security and privacy

🛡️ Security and privacy

Tip

TL;DR — Installed mode stores passwords as DPAPI blobs in your registry hive, readable only by your Windows account on that machine. Portable mode stores them in a file encrypted with AES-256-CBC, key derived with PBKDF2 from a passphrase you choose. NcDavTray talks to your Nextcloud server and to nothing else — the only exception is GitHub: the update check, which is off by default, and the release archive when you install an update from the About box.

• Where the password lives
• Which hosts are contacted
• What the exports contain
• Cleanup

🔑 Where the password lives

	Installed	Portable
Stored in	HKCU\Software\NcDavTray\Accounts	NDT_secret.dat next to the script
Protected with	Windows DPAPI, bound to your user account	AES-256-CBC, key from PBKDF2, 100 000 iterations
Unlocked by	being logged in as that user on that machine	the passphrase you set when exporting
Copy it elsewhere?	useless — DPAPI will not decrypt it	works, if you know the passphrase

An account password belongs to the server/user pair, not to a single mount: two mounts of the same account are one and the same login, and letting them hold two different passwords would mean finding out about a change only when the other one stops working. A share-link password belongs to its mount, because a token is handed out once and used once.

Passwords are never written in plain text and never passed on a command line. In portable mode they are decrypted into memory for the session and no further.

Important

Use a Nextcloud app password, not your login password. An app password can be revoked on the server without changing anything else, and it cannot be used to log into the web interface. Log in with browser produces one without your login password ever being typed into NcDavTray: the login happens on the server's own page, in a real browser, and only the finished token comes back. Accounts and app passwords covers it, and says why the passwords it leaves on the server have to be looked after.

When the last mount of an account is removed, NcDavTray offers to withdraw its app password on the server as well — DELETE /ocs/v2.php/core/apppassword, authenticated with the very token being withdrawn. Forgetting a password here does not withdraw it there, which is why the question is asked.

🌐 Which hosts are contacted

NcDavTray connects to your Nextcloud server for:

• the reachability and maintenance-mode check (/status.php),
• the folder picker and its validation (the Nextcloud OCS API),
• the browser login and the withdrawal of an app password (/index.php/login/v2 and the OCS apppassword endpoint),
• the server favicon and your avatar, used as the drive icon and in the interface,
• the WebDAV operations that map and unmap the drive.

And to GitHub for two things, both of them updates:

• the check, at api.github.com, when you press the button or switched on the startup check. It is off by default,
• the release archive, when you press Update now and confirm it. GitHub serves that download from its own file host, which is where the release link leads.

Neither says anything about you: the check is the request a browser makes when you open the releases page, and the download is the file that page offers.

Note

No telemetry, no analytics, no third-party services. The favicon and avatar come from your own server, not from a CDN.

📤 What the exports contain

Export	Contains the passwords?	Good for
JSON (Export configuration)	yes, as DPAPI blobs	restoring this installation, on this machine, as this user. Worthless anywhere else
Portable (Export to portable)	yes, re-encrypted with a passphrase you choose	carrying the setup to another machine or a USB stick

Caution

The portable export is the one that travels — which also means it is the one that can be stolen and attacked offline. Choose a passphrase that deserves that, and treat NDT_secret.dat like the password it contains.

🧽 Cleanup

On disconnect and on exit, NcDavTray unmaps the drive and removes the cosmetic branding it applied — the Explorer label and the drive icon — so no stale entries are left behind in your registry or in Explorer.

The optional cache auto-clear goes one step further and wipes what the Windows redirector cached, which is not removed by unmapping.