New feature : request password at startup

@bikefly welcome to the forum.

This is a topic that comes up very often :slight_smile:

Firstly, I would have to disagree with validity of that argument.

Sensitive data must be stored in a manner commensurate with that sensitivity. Encryption on its own cannot solve that. The data owner must risk assess the environment in which the data is being stored along with access to that environment.

For instance, if, as you suggest, the computer is public then no app level encryption is going to properly protect you. If a system is public and open enough that one user can install Joplin (even a version of Joplin with state-of-the-art at-rest encryption) another user can install a keylogger or some other sneaky tool.

Secondly, if you read the other posts on this forum about this subject you will see that the project owner has decided on a particular design limit when it comes to the question of Joplin and at-rest encryption. I guess that the decision may also have taken into consideration the time and engineering required not only to implement it, but also to certify and maintain it.

I can see why so many people raise this question of encryption. People who raise these issues are, obviously, aware of the importance of data security and that is a good thing. I certainly wouldn't complain if it was added. But I can also see why Laurent has "drawn a line". For every app there will be a design limit after which you should ask yourself if you are using the right tool for the circumstances, based on the sensitivity of the data to be stored.

3 Likes