Having read the article I'm still not sure if this could affect people using DropBox as a sync source, but I thought I would post this just in case.
Mods, please feel free to remove if you think this is off topic.
2 Likes
2 screens long (!) cookie banner preventing to see the article is irony on entirely new, professional level
This is not a comment against the post or article, just thought to share funny observation
3 Likes
Joplin's E2E would defeat it if set up because the AI would only see encrypted content which is indistinguishable from garbage in most aspects, without E2E enabled though, it's all just raw text for them to grep.
2 Likes
Is that actually true? I can go into DropBox and read the files. I mean, there is a lot of junk, but they certainly aren't encrypted.
1 Like
It should cover the note content and attachments, for the metadata itself I'd have to look and aren't sure the answer, so reasonably I'd expect the potential for minor metadata leakage but things such as the note content and attachments themselves should be covered and look like junk.
Of course, this assumes you're using Dropbox as the sync target and have also set E2E up. If it's the case Dropbox is scanning for files in the same way e.g OneDrive would and taking them directly from the filesystem then there might be leaks happening if it grabs the notes whilst they're unencrypted locally, and if E2E isn't set up, then you're giving it to them as raw data anyway.
If the E2E isn't at least protecting note content and attachments then to me that would sound broken.
1 Like
Almost everything is encrypted except for structural properties such as notebook parent ID, note ID and those required for sync, such as timestamp, etc. They are listed here:
5 Likes
My apologies. I don't actually have it setup.
Slightly off topic, but if I were to turn on encryption at this point, would that mean that all of my files would have to be re-uploaded to DropBox? I'm assuming so. I only have about 1.5k documents, so it might not be a problem.