Notes can be a really private place. Would it be possible to password lock the opening of Joplin like in many note apps like Evernote?
8 Likes
No, itās been asked a few times and thereās an entry in the FAQ that addresses this - joplin.cozic.net/faq/
Evernote doesnāt lock or encrypt the data, itās only asking for your password to access their service. But locally, itās exactly like Joplin.
Thanks for replying back. I've read the FAQ about this and I feel disappointed at the rationale gone into not providing a way to password lock one's notes.
In the FAQ, the reasoning given is the following:
If someone that you don't trust has access to the computer, they can put a keylogger anyway so any local encryption or PIN access would not be useful.
I think there's a perfectly good use case for password-locking one's notes that doesn't involve hackers. Quite simply, it's for privacy from other users of your computer. For example, I want a quick and easy way to access my notes on my computer but I have a partner who lives with me who I don't want to share my notes with. Sure, I can have her sign onto a new account whenever she wants to use the computer but that won't be done in practice.
Please reconsider this since I think anyone who uses Joplin to write sensitive notes or diary entries in (which I'd imagine to be quite a few people), a way to lock the notes away from prying eyes is important.
Thanks
7 Likes
There is some validity to what @mo1ddfsa says. Even without any additional encryption, it might be useful for the app to pop up a password prompt and simply exit if you donāt enter it correctly. It would cover plenty of cases, I think - like at work or at home, when someone might be nosy while youāre not paying attention, but wonāt have the time, will or knowledge to do anything more difficult.
That being said, I donāt see it as critically necessary - at work Iād solved this by running Joplin Portable off of an encrypted thumb drive.
Maybe you could try something like that as well, @mo1ddfsa? Create a local encrypted container with Joplin Portable inside, unlock it with a password and run Joplin.
2 Likes
I can understand there would be a use for this, but as there are other ways to do it itās relatively low priority in my list. I wouldnāt be opposed to a pull request for it though.
Yes if you want more security, the best way is indeed to use something like Truecrypt (thatās what I use for my notes or emails for instance). It would also prevent access to your data if your laptop is stolen for example.
If what youāre interested in is simply to hide the application from other users of your computer, and youāre not worry theyāll dig in the folders to find your data, there are various tricks you can use - https://www.online-tech-tips.com/computer-tips/hide-windows-desktop-screen/
1 Like
Are there any such tips for hiding the application an ipad?
I would like a better option for making my notes less convenient to read. Currently uninstalling Joplin when I loan my device to others and re-installing Joplin and re-entering all the server specifics afterwards is the workaround - this is not pleasant.
An Application key would be a way to make this kind of shared use pleasant, until IOS (or whichever poorly designed operating system you happen to be running on) offers proper support for a multi-user situation.
The protection is against casual Joplin browsing by a potentially curious, but otherwise trusted associate, not high-security protection against a malicious actor that has full access to the device (not expecting keyloggers and the like here, as you mention in the FAQ).
Furthermore, you may be interested to know that the Nextcloud app does offer an application pin that can be activated. perhaps there is a discussion about their motivation for that feature somewhere that would be worth reviewing.
2 Likes
I donāt know about ipads, but some Androids (and Windows Phones, way back when) have a āsecond spaceā feature - you could basically set up a second profile and specify which apps it can access. (Then you could activate it and hand it to your trusted associate.)
Alternatively, Android also has an āApp lockā - you can specify that certain apps that will require a password to run (different from the one that unlocks the device), very useful.
Maybe iOS has something similar?
1 Like
Lineage OS (Android) handles a guest user nicely, I believe IOS does not provide this functionality
Sadly iOS doesnāt provide a mechanism for you to choose what apps are locked. The app developer has to do it.
Personally Iād love to have the option to have Joplin locked on my iPad / iPhone. While Iām happy to let my kids / others use my iPad sometimes there are things I donāt want them to read. A passcode lock would prevent that.
Iād be happy to add it myself to the iOS app ~but I donāt see the source on Github, just the main Joplin software ā I found the code in the ReactNativeClient.
1 Like
Initially I thought Joplin ticked all the boxes, but not having a passcode to open the app is a serious deficiency. The assumption that access to the device with the app is secure at all times is questionable. All of us have given a phone to someone to make call, play a game, look something up online, send some text messages etc. and have not intended for confidential information to be viewable by simply opening an app.
Iāve used TiddlyFolio (http://tiddlyfolio.tiddlyspot.com/) for a number of years but never had a version on my phone (the wiki file was synced with ā backed up to ā WebDAV storage and readable online via the web, given a password and access to the storage). Itās based on what is now an old version of TiddlyWiki, so I thought Iād look for alternatives. TiddlyFolio optionally encrypts individual notes with a global password requested when the app is opened. If the wiki file is copied the encrypted note contents are unreadable.
Iād like to endorse the request to add an optional passcode to open the app.
3 Likes
I would like to have this feature too. I used a app on my android phone for locking joplin. But this was really worse. To much spam in the system.
1 Like
As a workaround, there are a number of applock apps on the play store. This might not be exactly what you need but it might be useful until such a time they this feature is implemented in Joplin.
1 Like
It turns out that TiddlyWiki now includes an encryption module as part of the core functionality. This means that an entire wiki full of notes can be encrypted and decrypted with a single password. The current version is v5.1.7, dating from May 2018. The next release, v5.1.8, due quite soon, will include the ability to use https, which means that a password can be used securely to open and save a file remotely.
I set up Joplin for my wife but abandoned it after a couple of days in favour of TiddlyWiki v5 because of the better security. Iāll futz with Joplin a bit longer as it seems quite good apart from this weakness, which I hope will be temporary.
Glad you found a solution that suits you needs. Stick around with Joplin though, I see great things happening
I also would like this feature. I see there is a feature request for this:
1 Like
I sort of faked this on macOS.
I created an encrypted RW sparse bundle disk image and moved the contents of ~/.config/joplin-desktop into it. I also moved the actual Joplin.app there, then created an Applescript app that mounts the disk image at the path where Joplin expects it to be. Itās encrypted so it requires a password, then launches the app from the mounted image; If you donāt get the password right, all the data is secure inside the sparse bundle disk image.
Applescript code:
do shell script "hdiutil attach -nobrowse ~/.config/moJoplinRW.sparsebundle -mountpoint ~/.config/joplin-desktop"
do shell script "open ~/.config/joplin-desktop/Joplin.app"
I realize there is still some residual Joplin related data elsewhere on the Mac, but I donāt believe it includes any sensitive data. (correct me if Iām wrong please!) I couldnāt seem to get WebDAV syncing working so I finally ended up making a Dropbox account just for this use. I enabled E2EE andI figured if its encrypted client side before uploading, it is secure from Dropbox employees snooping with their master key.
I agree it would be nice to add a passcode or fingerprint activation for iOS or Android, but I hope this helps other Mac users.
I would like to request this be moved to a higher priority than it is now. Github has an issue for this that has been locked https://github.com/laurent22/joplin/issues/289
I use Joplin religiously to get my day-to-day tasks and notes in one central location and is essential to my daily workflow and do have my personal notes and private work related notes that I do not want anyone looking, i.e my boss who can remote into my machine and view my computer at anytime, or my colleagues when I leave my desk.
A simple pin or password would be ideal to password protect personal notebooks. I am by no means a developer and love Joplin. I would request that this be moved above any new features being developed for Joplin.
1 Like
Hello, and welcome to the forum!
As has been said many time s here already, no, simply adding a pin would not help; in fact, it might hurt you. Itās been explained here a few times, but Iāll try again.
The fact of the matter is, if your boss can access your computer remotely anytime, it will take him all of 15 minutes to google where Joplin stores data and read them directly from disk.
In a non-developerās terminology, look, I googled that the default location ofr Joplinās data in the folder <username>\.config\joplin-desktop\database.sqlite.
After that, it takes all of 5 minutes (or less, if you have the free viewer already installed) to open the database directly.
Like this.
See that notes thing there? Double-click that, and you can view all the notes, you donāt even need to have Joplin installed. One could just copy this one file and steal all your data in seconds, pin or no pin.
Adding a pin to the app would not fix that in any way, it would only give you a false sense of security at best, and then give you a reason to come here and complain once you found out someone just took your data despite the pin. So it is not a āsimple pinā, if itās supposed to actually work.
If you really insist on having your private data on your work computer, there are some ways to make it work. (I use Joplin like that myself.)
You would have found them, had you searched this forum. You could use the portable app from a USB stick or an encrypted container (in Cryptomator or VeraCrypt or something), for example.
2 Likes
I also like to have this feature and Iāam more than happy just to have one simple login dialog box. donāt even need to syn across device.
All I need is asking for password upon opening the app. [ password: ________ ]. thatās all.
Pls pls laurent
Thanks for Joplin
we donāt meant to protect from hacker. just from prying co-worker.
1 Like