Set password for cloud sync encryption

timo

Med I current think I'll release this late-Summer. However, I likely won't advertise or announce it for existing users, which will stay on the "old" sync, but new users will automatically get it. Existing users wanting to switch could erase their Diarium folder on the Cloud and set up the Cloud sync again

Kodsama

Hi @timo !

Any news regarding this feature release?

Med

timo

Good morning, Timo,

I hope you are doing well.

Back in the summer, you mentioned that the end-to-end encryption (E2EE) improvements might be released around late summer. Since some time has passed, I just wanted to kindly follow up and ask if these improvements have already been implemented.

I remain very interested in this feature, as I consider it essential for privacy in a journaling app.

Thank you in advance for the update.

Best regards,

Mike

Hi Timo, I am also very intrested in this E2EE release and i wonder if these improvements have already or not yet been added. Also i wonder if it is possible to add the option to sync through an already E2EE cloud service like proton drive. I am not very technical and i don't know if proton even has API's in place to enable it but it would be a nice addition to users who seek a more private and encrypted experience.

timo

You can test the feature right now, it's described in this thread how you can enable it.
There's just so many things I had to work on in the last weeks that this needed to be further postponed.
Regarding Proton Drive, please use the search 😉

Mike

timo Thanks for the quick reply! I have now enabled the feature.

To add an extra layer of security—and as a substitute for Proton Drive—I saw that, on Android, there is the possibility to use iCloud to sync the diaries. I used to have an iPhone, so I have an account with ADP (Advanced Data Protection) enabled.

I was wondering whether Diarum app data synced through iCloud is end‑to‑end encrypted under ADP, or if it is not (some Apple apps are encrypted under ADP, others are not, hence the question). I plan to sync from Android to Windows (technically Linux, but running Windows in a VM). I read on the forum that using iCloud to sync from Android to Windows is not advisable because you have to authenticate every 30 days, but that isn’t a big deal for me if I can use a private cloud to sync the diary.

Thank you for your attention to my questions!

timo

Mike It's not possible to iCloud-sync on Android and Windows with ADP enabled, see here.
Why do you need an "extra layer of security"? Do you see any issues with my implementation of E2EE? Why is it not secure enough in your opinion?

Mike

timo Not at all, i am not a developer so I don’t have the knowledge to evaluate such an implementation. However, after reading the entire thread about encryption—and the diagram you posted in 2023—I gathered that the implementation has been in beta since 2023, with many users asking when the E2EE improvements will be released.

I also read that the current non‑beta cloud‑sync encryption (v4, I think) uses a universal encryption key, which means anyone with access to your cloud could download Diarium on their device and access the app data.

Consequently, I remain confused: Is the beta v5 cloud sync (enabled by creating a note titled “ENABLE E2EE”) fully operational with end‑to‑end encryption through the custom password, with only me holding the private key? If so, what are the E2EE improvements that other users mentioned, which you said had to be postponed? Can I be confident that neither the developer nor the cloud provider can access my app data right now while the feature is still in beta? This will clarify for me whether i can confidently use the feature now or if i should wait the full release to use cloud sync. Thank you again for your attention to this matter!

timo

Mike Yes the "v5 sync" is operational and implemented as noted above, and I know at least from a handful of users that are using it (likely a lot more users that found this thread and enabled it). I haven't heard any problems back from them.
The reason it is not published yet is because since I offered this feature as opt-in/beta, I've received much less demand for this feature - likely because most users interested in it found this thread and enabled E2EE - so it does not any more have the high priority that it used to have 3 years back. Switching the sync for all users is a huge undertaking and potential risk for me. If there is a small bug, it will affect thousands of users and I will have a full inbox and sleepless nights. Therefore I first want to fix all remaining issues with the app (and particularly the existing sync that the new sync builds upon) so that I have sufficient time and energy to monitor the sync and be able to act if a problem arises once I enabled it publicly.

Regarding the safety, I'd say you have to trust my words or verify it yourself - that's why I published the implementation. A developer could claim a lot of things about his secure implementation but in reality it's not so secure after all (just google "Tea app leaks" for a more recent example).
What "E2EE improvements" are you referring to in particular that I said would be postponed?

Mike

timo Thank you for the clarification. I read about the E2EE improvements from the most recent posts on this thread, especially from the user called Med, to whom you answered that you were still working on the feature. That got me thinking that the feature was not fully ready and safe to use.

ralph

timo I found that thread, and got v5-sync to work. But the information is a bit hidden in all those text. And the note with ENABLE E2EE has to be written, it didn‘t work for me with cut&paste.

Now sync is fine with MacBook Pro M1, 9th generation iPad, and A56 Samsung Galaxy, using Google drive.

gruebler

I can not set a new password.

DISABLE E2EE.
New Sync with WebDAV
ENABLE E2EE
No password question.

timo

gruebler Because there is still password-protected data on your Cloud, which you'd need to delete first. The app only asks for a password when there is no data on the selected Cloud service yet

Dana

I am so glad I found this thread! One of the big selling points of this app was the encryption. If it's the same key for all, it might as well be unencrypted. I've turned on the custom E2EE, I just wish it was the default.

Justin

timo likely because most users interested in it found this thread and enabled E2EE

I was one of those users ... enabled E2EE. No issues since I enabled it in July of 2025.

« Previous Page