[RESOLVED] Joplin leaks private info despite end-to-end-encryption enabled

People that use Joplin to store sensitive information will seek out how to enable encryption as soon as they hit install.

For others, is a nice bonus at best. In the early days I ended up with a few encryption keys myself because I hadn't RTFM. In those days you couldn't even delete your keys, it was a mess.

Things have improved no end since then and I'm sure they will continue to improve. Meanwhile, Joplin offers a solid encryption environment for those who need/want it. I personally don't need it, but I still use it "because I can".

That said I too like the hint in the sync wizard.

1 Like

I'd argue that the free-of-cost aspect of Joplin isn't something to ignore either.

OneNote has a "free" version, but it doesn't really offer that much. The proper desktop version is indeed very feature rich, but it also costs a lot of money as it can only be bought as a part of the full MS Office.

Evernote also requires you to pay a monthly fee if you want to sync between more than 2 devices and/or require more than the very limited amount of space they provide for free accounts.

1 Like

True, I know they aren't the same (free as in blah blah) but I kind of lump it all together, most of the time FOSS is free in both senses unless paying for the service (i.e. Cloud) and honestly it was probably googling "best free Evernote alternative" that led me to Joplin in the first place.

I think both versions are free its just confusing as all hell and having an office licence just gives you access to stuff like local notebooks (only in the proper desktop app, not the universal thing).
I'm still a heavy OneNote user (for work where it suits my needs better and we have 365) so I don't really have to worry about the restrictions but the licence change for free accounts in Evernote is absolutely what drove me out.

1 Like

Actually it seems my information was outdated, and as of today, the full desktop version is indeed free and it does claim support for local notebooks too (see https://support.microsoft.com/office/what-s-the-difference-between-the-onenote-versions-a624e692-b78b-4c09-b07f-46181958118f). I myself had switched from Evernote to OneNote first, and then from OneNote to Joplin later. The main reason for choosing Joplin eventually was that I wanted a FOSS solution that could be used locally and offline. I use full disk encryption everywhere, so the in-app encryption wasn't really important in my use case.

Out of the points discussed here, a potential increase in disk space is something that I'd personally worry about when considering turning on encryption though, and especially on mobile devices, as notes with the default 90-day history can take quite a lot of space already.

This shouldn't be an issue unless you are using a local file sync though, the space taken locally (minus the few bytes to store the keys themselves) will be the same as it is decrypted during the sync process, only the sync target data is encrypted.

Yeah, local file sync is the only type of sync that I've been personally interested in. I actually think it's a major advantage of Joplin that it offers this kind of synchronisation.

If it is enabled, will it normally or sometimes increase the size of the storage required and the sync time? Will sync be smart enough to look at a large encrypted database of which a few items were changed, and know somehow what was changed and only upload that? Many programs I've worked with are unable to do that.

I believe it will always increase the required storage of the sync target, but not locally. Even once it's enabled by default you'll still have the option to disable it (I think).

It's already smart enough to do that :slight_smile: . I use encryption on my notes and rarely see sync time take more than 1s.

1 Like