Directory structure is leaked, not end to end encrypted #94
Description
The promise on the official website for the end to end encryption reads as follows:
Security properties: Never leak directory structure, filenames or file content to the server.
But currently, this is a lie. The Nextcloud Desktop Client currently doesn't automatically encrypt subfolders of encrypted folders, and even if I create subfolders using the Android App (which automatically encrypts subfolders of encrypted folders), the whole (!) directory structure is visible on the server. I can see every single folder in my so-called "end to end encrypted" folder.
This is a huge architectural flaw, leading to false promises and users who think their data is save even though it's not.
I'd like to open the discussion on how to approach the issue. End to end encryption is something I (personally) really want and need because some of my data is very sensitive. I currently see two options:
- Either fix the current implementation, which probably breaks the current approach and might not be backwards compatible
- Or integrate a different, already existing solution (like encfs, cryptomator or whatever) to address the issue
Another issue is the different code-base for desktop and mobile clients, which leads to the previously mentioned differences in the Android and Desktop app.