ownCloud encryption not working with Notes App

[maltefiala]

We are getting a lot of feedback concerning encryption not working in ownCloud Notes. As suggested by @Raydiation I hereby open this one in core. Please everyone out there:

• check your SSL Keychain before testing this issue
• give us as much feedback as possible on this

Dependent Issues

• API does not work with encryption enabled notes#48
• Issues using myownnotes with encryption enabled owncloud aykit/MyOwnNotes#35

Core Devs
It would be great if you could comment on this.

Thanks.

[karlitschek]

@schiesbn Can you test?

[tigrino]

I run an encrypted ownCloud. The Notes app is installed and enabled. Accessing the url /index.php/apps/notes/api/v0.2/notes gives me the contents. Trying to access with the myownnotes from Android generates an error "There was a connection error. Please check your username / password". The log contains the following:
XXX - xxx [02/Jul/2014:21:08:15 +0000] "GET /index.php/apps/notes/api/v0.2/notes HTTP/1.1" 302 1599 "-" "Dalvik/1.6.0 (Linux; U; Android 4.2.2; A1-810 Build/JDQ39)"
XXX - xxx [02/Jul/2014:21:08:16 +0000] "GET /apps/files_encryption/files/error.php?p=0&errorCode=1 HTTP/1.1" 403 2510 "-" "Dalvik/1.6.0 (Linux; U; Android 4.2.2; A1-810 Build/JDQ39)"

SSL keychain for the https connection? I have a RapidSSL cert, installed in Apache and intermediate cert in the config as well. Seems to work fine.

[maltefiala]

Oh man, that issue....

@Raydiation: Is owncloud/notes#48 still unresolved? @tigrino says the API is working fine. A quick check on our testmachine gave us the impression that the app is working too with ownCloud encryption enabled (aykit/MyOwnNotes#35).

However, I have no idea (nor time to look at atm) how ownCloud implemented encryption. It would be great if we could figure out if owncloud/notes#48 is solved and the app is the only "weak" link here.

Questions

• What is the best way to test an encrypted ownCloud setting with API and the app?
• How can I make sure, my ownCloud instance is encrypted?
• Is it important what app is being installed first (Notes or Encryption)? We should test all possibilities....
• Is it important to use a recovery key?

[maltefiala]

@tigrino : Please use https://www.ssllabs.com/ssltest/ to test your chain. Additionally, it would be great if you could test it with encryption disabled as well. Just to make sure... and please provide us with every step you take ;)

[BernhardPosselt]

@maltemafia Can you try it with the newest beta of 7? Works for me

[tigrino]

Mmm... Taking the server offline and replacing it with a fresh instance to check the working without/with encryption may be possible but I would rather avoid doing that if possible... Mine is encryption first, long time ago, notes installed yesterday.

Call to the API (/index.php/apps/notes/api/v0.2/notes) returns this:
[{"modified":1404366591,"title":"Hello, world!","content":"Hello, world!","id":44061}]

The file on disk is encrypted and contains this:
FnI7GrzEBZWUaETq+A==00iv00qrBKD5IemmX9hIbzx

ssllabs check reports all ok with the certificate except for limited support for forward secrecy. Do you want the complete report here?

[maltefiala]

That would be great. But if you don't want to share it, just report this:

Additional Certificates (if supplied)

Certificates provided x (z bytes)
Chain issues REPORT THIS FIELD

[maltefiala]

@Raydiation : My colleague is testing 6.0.4 today and I will test 7 later on. Btw, my name is maltefiala, not to be confused with some mafia :)

@tigrino : What server version of ownCloud are you running?

[maltefiala]

My colleague @steppenhahn made various tests today. From our point of view, encryption seems to be the problem.

My Own Notes works like a charm with the encryption-plugin disabled. As soon as we activate the encryption-plugin, we get an 403 error and the following exception:

java.io.FileNotFoundException: https://myserver.com/owncloud/apps/files_encryption/files/error.php?p=0&errorCode=1

it does not matter if the encryption is disabled or enabled (admin-tab) - If the plugin is enabled, myownnotes does not work.

System tested

• ownCloud Server Version 6.0.4
• Notes Version: 0.9
• Encryption-Plugin-version: 0.5

Next Steps

We will investigate this issue on 7.0 this weekend.

[BernhardPosselt]

Try to log out after enabling encryption. The error code in the URL means that encryption is not yet initialized

[tigrino]

@maltefiala

Additional Certificates (if supplied)
Certificates provided 2 (2295 bytes)
Chain issues None

ownCloud 6.0.4 (stable)

[tigrino]

@Raydiation I run for several months already on this version and with encryption enabled. I just installed notes and ran into problems, encryption was there before and is working fine.

[ramschmaerchen]

The chain looks good then. I will investigate further on the weekend.

[urenzel]

I came to the same conclusion as maltefiala: it must have to do with the encryption. My nginx-access.log reports
[...] GET /owncloud/index.php/apps/notes/api/v0.2/notes HTTP/1.1" 302 5 "-" "Dalvik/1.6.0 (Linux; U; Android 4.1.2; GT-I8160 Build/JZO54K)"
[...] GET /owncloud/ HTTP/1.1" 200 3017 "-" "Wget/1.14 (linux-gnu)"
[...] GET /owncloud/apps/files_encryption/files/error.php?p=0&errorCode=1 HTTP/1.1" 403 2094 "-" "Dalvik/1.6.0 (Linux; U; Android 4.1.2; GT-I8160 Build/JZO54K)"
when MyOwnNotes tries to refresh and it reports "There was a connection error. Please check your username and password.". I hope that helps, because I lost all my notes a moment ago.

[steppenhahn]

@urenzel
i am really sorry that you lost your notes. :(
had this bug too and it was tricky to find. but i fixed it in version 1.2.2

@Raydiation
tried logging out - still doesn't work.

here is exactly what i did:

• login
• make sure encryption plugin is disabled.
• logout

now myownnotes can connect properly - no errors

then:

• login
• enable encryption plugin.
• logout

now myownnotes can NOT connect. see error message from maltefiala
(waiting 5 min. after logout does not change outcome)

then:

• login
• enable encryption recovery key + enter key.
• logout

same problem as above

System tested:

• ownCloud Server Version 6.0.4
• Notes Version: 0.9
• Encryption-Plugin-version: 0.5

[phedlund]

Just for clarification owncloud/notes#48 is not solved. I spent the entire weekend working on this without a solution. It's a high priority for users.

[phedlund]

This issue is really a duplicate of #8830.

[tigrino]

With the new release, 1.3.1, I get a different message in the log file:
x.x.x.x - guest [19/Jul/2014:19:29:21 +0000] "GET /index.php/apps/notes/api/v0.2/notes HTTP/1.1" 401 956 "-" "Dalvik/1.6.0 (Linux; U; Android 4.3; D5503 Build/14.2.A.1.114)"

Accessing the URL directly in the browser returns the expected
[{"modified":1404366591,"title":"Hello, world!","content":"Hello, world!","id":44061}]

[tigrino]

Nope, back to the original errors.
x.x.x.x - guest [11/Aug/2014:11:10:53 +0000] "GET /index.php/apps/notes/api/v0.2/notes HTTP/1.1" 302 1619 "-" "Dalvik/1.6.0 (Linux; U; Android 4.3; D5503 Build/14.2.A.1.114)"
x.x.x.x - guest [11/Aug/2014:11:10:54 +0000] "GET /apps/files_encryption/files/error.php?p=0&errorCode=1 HTTP/1.1" 403 2287 "-" "Dalvik/1.6.0 (Linux; U; Android 4.3; D5503 Build/14.2.A.1.114)"

[ramschmaerchen]

Sry, we are in a summer limbo atm. We will try to find a solution in September.

[maltefiala]

Referencing aykit/MyOwnNotes#71

[ramschmaerchen]

Summer is over and we are slowly getting back on track. After thoroughly testing, the following has been found out:

Tested System:

owncloud 7.0.2
Notes: master branch, owncloud/notes@99fe1ec

405 Error

Those of you who are getting 405 errors forgot to enable mod_rewrite. Look at http://forum.owncloud.org/viewtopic.php?t=7536 for how to fix this.

Encryption app not initalised

When GETting the API-URL via browser, notes are shown. GET requests via curl lead to https://own-my-notes.maltefiala.org/owncloud/apps/files_encryption/files/error.php?p=0&errorCode=1. I guess the fix is coming in sight.

In short

Stay tuned :)

[phrag]

I have same problem. Never had it working but seems like this problem. I have encryption enabled.

Owncloud 7.0.2
Centos 6.5
PHP 5.6.0

Browsing to https://my.domain/owncloud/index.php/apps/notes/api/v0.2/notes shows my test notes:
[{"modified":1410387921,"title":"halloooooo","content":"halloooooo","id":452}

Loggy Output
NoteListActivityD menu
9140NoteListActivityD starting note synchonization
9140NoteListActivityD basePath no port
9140NoteListActivityD urlToConnect
9140NoteListActivityD writing modified notes to server
9140NoteListActivityD cursor rows modified notes
9140NoteListActivityD deleting notes from server
9140NoteListActivityD cursor rows to delete
9140NoteListActivityD writing new notes to server
9140NoteListActivityD cursor rows new notes
9140NoteListActivityD getting notes from server
9140NoteListActivityE error @ downloading notes. response code

9140NoteListActivityD menu
9140NoteListActivityD starting note synchonization
9140NoteListActivityD basePath no port
9140NoteListActivityD urlToConnect
9140NoteListActivityD writing modified notes to server
9140NoteListActivityD cursor rows modified notes
9140NoteListActivityD deleting notes from server
9140NoteListActivityD cursor rows to delete
9140NoteListActivityD writing new notes to server
9140NoteListActivityD cursor rows new notes

[anavarre]

Just want to report that it happened to me as well with OC 7.0.2 and Notes 0.9 - I enabled the module, created two notes, renamed one of them, tried to add markup (before I noticed it had been removed), moved back and forth between my 2 test notes, and all of a sudden, I got the encryption error message. This would happen each time I click on the "Notes" icon in the user menu. Only choice was to disable the Notes module entirely.

[schiessle]

Just a guess, but maybe it is related to #11127

[maltefiala]

Dear community,

after spending hours trying to understand the ownCloud encryption app's purpose and implementation we have come to the conclusion that we do not have the financial means to support encryption with My Own Notes. The reasons in detail:

encryption app misconception
ownCloud encryption was never meant to encrypt data on internal storage. Using it for this purpose is close to worthless. Read my blog entry to see why.

encryption app codebase
Encryption is a very delicate thing to do. You not only need to know a lot about computing, you need to know a lot about different implementations: randomisation, kernel, file systems, hardware, and so on. Even the biggest, most widely adopted projects like OpenSSL introduce heart bleeding bugs. Having tons of features, ownCloud never gave us the impression of a stable work horse. Quite contrary, we encountered it being a stubborn donkey, refusing to work when you need it the most. After looking at the code, we just can't suggest using the encryption app. Additionally, the following issues gave us a (really) bad feeling:

• crypt.php is insane #7832
• 7.0.2 Problem after upgrade from 7.0.1 (Files crypted) #10857
• Unable to decrypt files #8149

There is no good encryption but client-side encryption
This is the core of everything encryption related. The only good encryption is client side encryption. As long as there is no distributed key model like GPG going end to end, encryption will not be as good as we need it to be.

Conclusion
Weighing our options, we concluded that we won't support ownCloud's encryption app, at least not until we get the feeling that it's as stable and well maintained as encryption implementations need to be. I hope you, the community, are able to understand our decision. In my opinion, this issue should stay open. If someone wants to add encryption him- or herself, make sure to write a pull request. We will be happy to merge.

Your's,
Malte // aykit

[maltefiala]

There is a lot of talk about doing client side encryption with javascript. Although Javascript encryption takes place client side, the javascript code is loaded from a server that my belong to a domain not controlled by oneself. Therefore, using JS-encryption is not the same as using offline client side encryption and can not be deemed secure per se.

[tigrino]

Malte,

I appreciate all the work you and other folks at aykit do. However, I think you may be overreacting in this instance.

Your attacks on the concept of ownCloud encryption are somewhat justified but I feel that you see things in a much darker light than they should be. The encryption does what it says. It is not perfect, it is not protecting you from some of the attacks but it is useful. Discarding it just because it is not perfect is silly.

The issues you referred to above are not really issues for security within the context we are talking about. Everything seems to be well taken care of and developers provided pretty good feedback, actually.

I would say that for my purposes it is sufficient to have the encryption that the ownCloud provides. I am definitely not enjoying the idea of the client-side encryption in the browser. That has its own pitfalls. Also, I would like to note that you provide an app for ownCloud, not another system, not your own. You have to support whatever is there because we use that and we are happy with what it does despite all the shortcomings.

I would very much appreciate if you reconsidered and actually implemented proper support for encryption as it is at the moment in ownCloud.

Thank you for your consideration.

[schiessle]

@tigrino Thanks for your positive words!

@maltefiala First let me say that I use your app by my own and I really like it! I don't really understand what you mean if you say that your app doesn't support encryption. Encryption happens server-side, so there is nothing you app have to support. It just upload and download files and the rest happens on the server. I don't know the notes app API, but if the API has a problem with the encryption then it is probably a problem we need to address at the notes app.

[schiessle]

@Raydiation you are the main author of the notes app. Did you tested the API with encryption enabled?

[BernhardPosselt]

Nope. I do not maintain it anymore btw

[schiessle]

I can reproduce the problem with ownCloud 7.0.2, for some reasons I don't understand yet, the login hook isn't triggered. But this seems to be fixed in stable7, so the problem should be solved with ownCloud 7.0.3 which will be released soon.

[tigrino]

Is 7.0.3RC1 stable enough for product environment to try it out?

[BernhardPosselt]

@tigrino you have to figure that out for yourself, its in RC status atm

[tigrino]

Oh!!! It finally works! Yahoo! The release 7.0.3 made it work! Thank you!

[schiessle]

Great that it solved the problem!

[maltefiala]

@schiesbn @tigrino Good to know! Not supporting just means that we are not doing support for it for the reasons given. Nevertheless we are more than happy it's working now.

Big thanks to all developers who made this happen!