* org-mobile-use-encryption
@ 2010-10-13 0:23 Greg Troxel
2010-10-13 8:59 ` org-mobile-use-encryption Carsten Dominik
0 siblings, 1 reply; 7+ messages in thread
From: Greg Troxel @ 2010-10-13 0:23 UTC (permalink / raw)
To: emacs-orgmode
[-- Attachment #1.1: Type: text/plain, Size: 1077 bytes --]
I am trying to test encryption for MobileOrg via a beta from Richard.
(We're still playing the 'convince itunes to let you run code on your
own phone game', so this report is preliminary about what Org itself is
doing.)
I have in .emacs-local.el:
(setq org-mobile-use-encryption t)
(setq org-mobile-encryption-password "mypasswd")
and I did org-mobile-push. I found that there was an old agendas.org
that was not encrypted, and it seems that org-mobile-push omits
agendas.org if org-mobile-use-encryption is t, but still creates it when
nil.
checksums.dat is in cleartext. This seems ok, but could be a missed
opportunity for some integrity protection.
index.org is in cleartext. The list of file names is of course in the
webdav area, and that seems not a big deal, but it also contains the
TODO keyword plan, priority tag list, etc.
I'm not sure this level of paranoia is warranted, but typical encrypting
filesystems also encrypt the filenames. It probably suffices to just
warn the user that the filenames of org files will still be exposed in
the DAV area.
[-- Attachment #1.2: Type: application/pgp-signature, Size: 194 bytes --]
[-- Attachment #2: Type: text/plain, Size: 201 bytes --]
_______________________________________________
Emacs-orgmode mailing list
Please use `Reply All' to send replies to the list.
Emacs-orgmode@gnu.org
http://lists.gnu.org/mailman/listinfo/emacs-orgmode
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: org-mobile-use-encryption
2010-10-13 0:23 org-mobile-use-encryption Greg Troxel
@ 2010-10-13 8:59 ` Carsten Dominik
2010-10-13 12:48 ` org-mobile-use-encryption Greg Troxel
2010-10-13 14:02 ` org-mobile-use-encryption Andreas Röhler
0 siblings, 2 replies; 7+ messages in thread
From: Carsten Dominik @ 2010-10-13 8:59 UTC (permalink / raw)
To: Greg Troxel; +Cc: emacs-orgmode
On Oct 13, 2010, at 2:23 AM, Greg Troxel wrote:
>
> I am trying to test encryption for MobileOrg via a beta from Richard.
> (We're still playing the 'convince itunes to let you run code on your
> own phone game', so this report is preliminary about what Org itself
> is
> doing.)
>
> I have in .emacs-local.el:
>
> (setq org-mobile-use-encryption t)
> (setq org-mobile-encryption-password "mypasswd")
>
> and I did org-mobile-push. I found that there was an old agendas.org
> that was not encrypted, and it seems that org-mobile-push omits
> agendas.org if org-mobile-use-encryption is t, but still creates it
> when
> nil.
I have not been able to reproduce this.
>
> checksums.dat is in cleartext. This seems ok, but could be a missed
> opportunity for some integrity protection.
I have a technical reason to not encrypt it - so unless there is
someone who really needs it encrypted, I want to keep it like this.
> index.org is in cleartext. The list of file names is of course in the
> webdav area, and that seems not a big deal, but it also contains the
> TODO keyword plan, priority tag list, etc.
This is a good observation. And who knows what other information we
will eventually put into that file. So I am switching to encrypting
this file as well.
>
> I'm not sure this level of paranoia is warranted, but typical
> encrypting
> filesystems also encrypt the filenames. It probably suffices to just
> warn the user that the filenames of org files will still be exposed in
> the DAV area.
I have just put this information into the manual.
Thanks
- Carsten
>
>
>
> _______________________________________________
> Emacs-orgmode mailing list
> Please use `Reply All' to send replies to the list.
> Emacs-orgmode@gnu.org
> http://lists.gnu.org/mailman/listinfo/emacs-orgmode
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: org-mobile-use-encryption
2010-10-13 8:59 ` org-mobile-use-encryption Carsten Dominik
@ 2010-10-13 12:48 ` Greg Troxel
2010-10-14 6:31 ` org-mobile-use-encryption Carsten Dominik
2010-10-13 14:02 ` org-mobile-use-encryption Andreas Röhler
1 sibling, 1 reply; 7+ messages in thread
From: Greg Troxel @ 2010-10-13 12:48 UTC (permalink / raw)
To: Carsten Dominik; +Cc: emacs-orgmode
[-- Attachment #1.1: Type: text/plain, Size: 3309 bytes --]
Carsten Dominik <carsten.dominik@gmail.com> writes:
> On Oct 13, 2010, at 2:23 AM, Greg Troxel wrote:
>
>> I am trying to test encryption for MobileOrg via a beta from Richard.
>> (We're still playing the 'convince itunes to let you run code on your
>> own phone game', so this report is preliminary about what Org itself
>> is doing.)
I have successfully viewed my org files and retrieved a captured note
From the phone into emacs.
This note is about release_7.01h-672-g7e29685, so I have
your commit 9755e09bbcd630b6d0e20dbf6342bf1c1e66c819.
>> I have in .emacs-local.el:
>>
>> (setq org-mobile-use-encryption t)
>> (setq org-mobile-encryption-password "mypasswd")
>>
>> and I did org-mobile-push. I found that there was an old agendas.org
>> that was not encrypted, and it seems that org-mobile-push omits
>> agendas.org if org-mobile-use-encryption is t, but still creates it
>> when
>> nil.
>
> I have not been able to reproduce this.
Apparently when in encryption mode the copy of the encrypted version
agendas.org fails because it's trying to go to a file named by the tramp
syntax instead of interpreting it as remote:
Agenda written to Org file /home/gdt/orgtmpcrypt
/ssh:foo.example.com:/usr/home/gdt/ORG/agendas.org: No such file or directory
3148034372:error:02001002:system library:fopen:No such file or directory:/n0/gdt/NetBSD-5/src/crypto/dist/openssl/crypto/bio/bss_file.c:355:fopen('/ssh:foo.example.com:/usr/home/gdt/ORG/agendas.org','w')
I read the code and I don't follow how the invocation of copy-file is
different in the encrypted case.
>> checksums.dat is in cleartext. This seems ok, but could be a missed
>> opportunity for some integrity protection.
>
> I have a technical reason to not encrypt it - so unless there is
> someone who really needs it encrypted, I want to keep it like this.
That seems fine - the filenames are staying cleartext. My point, not
well made, was that encryption does not give you integrity protection.
It seems the concern motivating this work is confidentiality, but in
cryptography it's considered good practice to also provide integrity,
via HMAC-SHA1 or a combined confidentiality/integrity mode. But for org
files on servers we believe are not messing with them, this is probably
in the 'best is the enemy of the good' category. And if we want
integrity (I know, ENOPATCH), then it's probably best to do it outright,
so I withdraw my complaint about checksums.dat being in cleartext.
>> I'm not sure this level of paranoia is warranted, but typical
>> encrypting filesystems also encrypt the filenames. It probably
>> suffices to just warn the user that the filenames of org files will
>> still be exposed in the DAV area.
>
> I have just put this information into the manual.
Thanks.
minor issues:
~/orgtmpcrypt seems to not always get cleaned up when I push/pull.
After a push, I found it to contain my index.org, unencrypted and 644 in
my homedir. Probably this should go in org-directory instead which
presumably would be protected as the user wants.
During a pull that got a note, emacs asked me about visiting a buffer
whose file (orgcrypttmp) had changed contents. I'll see if I can
reproduce that.
Thanks for working on org-mobile-crypt.
[-- Attachment #1.2: Type: application/pgp-signature, Size: 194 bytes --]
[-- Attachment #2: Type: text/plain, Size: 201 bytes --]
_______________________________________________
Emacs-orgmode mailing list
Please use `Reply All' to send replies to the list.
Emacs-orgmode@gnu.org
http://lists.gnu.org/mailman/listinfo/emacs-orgmode
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: org-mobile-use-encryption
2010-10-13 8:59 ` org-mobile-use-encryption Carsten Dominik
2010-10-13 12:48 ` org-mobile-use-encryption Greg Troxel
@ 2010-10-13 14:02 ` Andreas Röhler
2010-10-14 6:40 ` org-mobile-use-encryption Carsten Dominik
1 sibling, 1 reply; 7+ messages in thread
From: Andreas Röhler @ 2010-10-13 14:02 UTC (permalink / raw)
To: emacs-orgmode; +Cc: Greg Troxel, Carsten Dominik
Am 13.10.2010 10:59, schrieb Carsten Dominik:
>
> On Oct 13, 2010, at 2:23 AM, Greg Troxel wrote:
>
>>
>> I am trying to test encryption for MobileOrg via a beta from Richard.
>> (We're still playing the 'convince itunes to let you run code on your
>> own phone game', so this report is preliminary about what Org itself is
>> doing.)
>>
>> I have in .emacs-local.el:
>>
>> (setq org-mobile-use-encryption t)
>> (setq org-mobile-encryption-password "mypasswd")
>>
>> and I did org-mobile-push. I found that there was an old agendas.org
>> that was not encrypted, and it seems that org-mobile-push omits
>> agendas.org if org-mobile-use-encryption is t, but still creates it when
>> nil.
>
> I have not been able to reproduce this.
>
>>
>> checksums.dat is in cleartext. This seems ok, but could be a missed
>> opportunity for some integrity protection.
>
> I have a technical reason to not encrypt it - so unless there is someone
> who really needs it encrypted, I want to keep it like this.
>
>> index.org is in cleartext. The list of file names is of course in the
>> webdav area, and that seems not a big deal, but it also contains the
>> TODO keyword plan, priority tag list, etc.
>
> This is a good observation. And who knows what other information we will
> eventually put into that file. So I am switching to encrypting this file
> as well.
Hi,
suggest to encrypt these kind of files by default. I.e. when org-mode
starts action, user should be prompted for a password,
be warned and informed about encryption, get a choice though.
Maybe a non-encrypted test-mode may be added, so user may try it, but be
warned not to store real data that way.
Andreas
--
https://code.launchpad.net/~a-roehler/python-mode/python-mode-components
https://code.launchpad.net/s-x-emacs-werkstatt/
>
>>
>> I'm not sure this level of paranoia is warranted, but typical encrypting
>> filesystems also encrypt the filenames. It probably suffices to just
>> warn the user that the filenames of org files will still be exposed in
>> the DAV area.
>
> I have just put this information into the manual.
>
> Thanks
>
> - Carsten
>
>
>>
>>
>>
>> _______________________________________________
>> Emacs-orgmode mailing list
>> Please use `Reply All' to send replies to the list.
>> Emacs-orgmode@gnu.org
>> http://lists.gnu.org/mailman/listinfo/emacs-orgmode
>
>
> _______________________________________________
> Emacs-orgmode mailing list
> Please use `Reply All' to send replies to the list.
> Emacs-orgmode@gnu.org
> http://lists.gnu.org/mailman/listinfo/emacs-orgmode
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: org-mobile-use-encryption
2010-10-13 12:48 ` org-mobile-use-encryption Greg Troxel
@ 2010-10-14 6:31 ` Carsten Dominik
2010-10-15 0:07 ` org-mobile-use-encryption Greg Troxel
0 siblings, 1 reply; 7+ messages in thread
From: Carsten Dominik @ 2010-10-14 6:31 UTC (permalink / raw)
To: Greg Troxel; +Cc: emacs-orgmode
Hi Greg,
thank you very much vor putting in the time to test the encryption
for MobileOrg.
On Oct 13, 2010, at 2:48 PM, Greg Troxel wrote:
>
> Carsten Dominik <carsten.dominik@gmail.com> writes:
>
>> On Oct 13, 2010, at 2:23 AM, Greg Troxel wrote:
>>
>>> I am trying to test encryption for MobileOrg via a beta from
>>> Richard.
>>> (We're still playing the 'convince itunes to let you run code on
>>> your
>>> own phone game', so this report is preliminary about what Org itself
>>> is doing.)
>
> I have successfully viewed my org files and retrieved a captured note
> From the phone into emacs.
>
> This note is about release_7.01h-672-g7e29685, so I have
> your commit 9755e09bbcd630b6d0e20dbf6342bf1c1e66c819.
>
>>> I have in .emacs-local.el:
>>>
>>> (setq org-mobile-use-encryption t)
>>> (setq org-mobile-encryption-password "mypasswd")
>>>
>>> and I did org-mobile-push. I found that there was an old
>>> agendas.org
>>> that was not encrypted, and it seems that org-mobile-push omits
>>> agendas.org if org-mobile-use-encryption is t, but still creates it
>>> when
>>> nil.
>>
>> I have not been able to reproduce this.
>
> Apparently when in encryption mode the copy of the encrypted version
> agendas.org fails because it's trying to go to a file named by the
> tramp
> syntax instead of interpreting it as remote:
>
> Agenda written to Org file /home/gdt/orgtmpcrypt
> /ssh:foo.example.com:/usr/home/gdt/ORG/agendas.org: No such file or
> directory
> 3148034372:error:02001002:system library:fopen:No such file or
> directory:/n0/gdt/NetBSD-5/src/crypto/dist/openssl/crypto/bio/
> bss_file.c:355:fopen('/ssh:foo.example.com:/usr/home/gdt/ORG/agendas.org','w')
Ah, you are using a tramp path? OK, I see from your
other message that you have actually solved this
issue. Thanks!
> I read the code and I don't follow how the invocation of copy-file is
> different in the encrypted case.
>
>>> checksums.dat is in cleartext. This seems ok, but could be a missed
>>> opportunity for some integrity protection.
>>
>> I have a technical reason to not encrypt it - so unless there is
>> someone who really needs it encrypted, I want to keep it like this.
>
> That seems fine - the filenames are staying cleartext.
OK.
> My point, not
> well made, was that encryption does not give you integrity protection.
> It seems the concern motivating this work is confidentiality, but in
> cryptography it's considered good practice to also provide integrity,
> via HMAC-SHA1 or a combined confidentiality/integrity mode.
Ah, I see what you mean now.
> But for org
> files on servers we believe are not messing with them, this is
> probably
> in the 'best is the enemy of the good' category. And if we want
> integrity (I know, ENOPATCH), then it's probably best to do it
> outright,
> so I withdraw my complaint about checksums.dat being in cleartext.
Is is also so that the file transfer is happening in two one-way street.
agendas.org and the agenda files and index.org are uploaded,
mobileorg.org is downloaded, and its contents are then applied locally.
Seems to be little room for problems here.
>
>>> I'm not sure this level of paranoia is warranted, but typical
>>> encrypting filesystems also encrypt the filenames. It probably
>>> suffices to just warn the user that the filenames of org files will
>>> still be exposed in the DAV area.
>>
>> I have just put this information into the manual.
>
> Thanks.
>
> minor issues:
>
> ~/orgtmpcrypt seems to not always get cleaned up when I push/pull.
> After a push, I found it to contain my index.org, unencrypted and
> 644 in
> my homedir. Probably this should go in org-directory instead which
> presumably would be protected as the user wants.
I did not put it into org-directory because I don't know if users have
this set to an accessible place, and I don't want the push
to fail because of that.
I have modified the code and hope that it does now in all cases
clean up the temporary file. Please let me know if you still
find a case where this is not so.
>
> During a pull that got a note, emacs asked me about visiting a buffer
> whose file (orgcrypttmp) had changed contents. I'll see if I can
> reproduce that.
This should hopefully go away with the changes I have now made.
Thanks again.
- Carsten
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: org-mobile-use-encryption
2010-10-13 14:02 ` org-mobile-use-encryption Andreas Röhler
@ 2010-10-14 6:40 ` Carsten Dominik
0 siblings, 0 replies; 7+ messages in thread
From: Carsten Dominik @ 2010-10-14 6:40 UTC (permalink / raw)
To: Andreas Röhler; +Cc: emacs-orgmode, Greg Troxel
On Oct 13, 2010, at 4:02 PM, Andreas Röhler wrote:
>
>
> Hi,
>
> suggest to encrypt these kind of files by default. I.e. when org-
> mode starts action, user should be prompted for a password,
> be warned and informed about encryption, get a choice though.
>
> Maybe a non-encrypted test-mode may be added, so user may try it,
> but be warned not to store real data that way.
No, we are not going to do this. We use openssl to do the encryption,
which may not be available on a system. And the Android Version of
MobileOrg doe not yet support encryption.
I will be more verbal about security issues in the manual.
- Carsten
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: org-mobile-use-encryption
2010-10-14 6:31 ` org-mobile-use-encryption Carsten Dominik
@ 2010-10-15 0:07 ` Greg Troxel
0 siblings, 0 replies; 7+ messages in thread
From: Greg Troxel @ 2010-10-15 0:07 UTC (permalink / raw)
To: Carsten Dominik; +Cc: emacs-orgmode
[-- Attachment #1.1: Type: text/plain, Size: 2810 bytes --]
Carsten Dominik <carsten.dominik@gmail.com> writes:
> thank you very much vor putting in the time to test the encryption
> for MobileOrg.
No problem - thank you for writing and sheparding Org.
>> But for org files on servers we believe are not messing with them,
>> this is probably in the 'best is the enemy of the good' category.
>> And if we want integrity (I know, ENOPATCH), then it's probably best
>> to do it outright, so I withdraw my complaint about checksums.dat
>> being in cleartext.
>
> Is is also so that the file transfer is happening in two one-way
> street. agendas.org and the agenda files and index.org are uploaded,
> mobileorg.org is downloaded, and its contents are then applied
> locally. Seems to be little room for problems here.
The issue is that the whole point of encryption is to use a webdav
server not under one's control, such as dropbox, or perhaps one accessed
not over SSL. Encryption prevents the server admin from reading the
bits, and that's the most important thing. But if the server admin
changes the ciphertext, they can cause the wrong plaintext to appear.
This is generally tricky, but it's a principle of cryptographic protocol
design that one can't assume that encryption provides integrity
(meaning, that just because the bits are encrypted doesn't mean it
prevents an adversary from manipulating the plaintext).
That said, the above is probably overly paranoid for most people.
>> ~/orgtmpcrypt seems to not always get cleaned up when I push/pull.
>> After a push, I found it to contain my index.org, unencrypted and 644
>> in my homedir. Probably this should go in org-directory instead
>> which presumably would be protected as the user wants.
>
> I did not put it into org-directory because I don't know if users have
> this set to an accessible place, and I don't want the push
> to fail because of that.
I think this is the classic security/convenience tradeoff. On a
multiuser system, I think Org now puts the orgtmpcrypt file with normal
umask, and that can be read by other users (albeit briefly). I
suggested org-directory because someone who wants to keep other users
From seeing his org bits will protect that approriately - mine is 0700.
I suppose there could be someone who turns on encryption and has org
files in random places but no directory matching org-directory. Getting
an error seems fair enough and better than risking exposing private bits.
(Again, I realize I'm on the paranoid side, but I do security
professionally so it comes naturally.)
> I have modified the code and hope that it does now in all cases
> clean up the temporary file. Please let me know if you still
> find a case where this is not so.
Thanks - will do. Right now all is working well.
[-- Attachment #1.2: Type: application/pgp-signature, Size: 194 bytes --]
[-- Attachment #2: Type: text/plain, Size: 201 bytes --]
_______________________________________________
Emacs-orgmode mailing list
Please use `Reply All' to send replies to the list.
Emacs-orgmode@gnu.org
http://lists.gnu.org/mailman/listinfo/emacs-orgmode
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2010-10-15 0:08 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-10-13 0:23 org-mobile-use-encryption Greg Troxel
2010-10-13 8:59 ` org-mobile-use-encryption Carsten Dominik
2010-10-13 12:48 ` org-mobile-use-encryption Greg Troxel
2010-10-14 6:31 ` org-mobile-use-encryption Carsten Dominik
2010-10-15 0:07 ` org-mobile-use-encryption Greg Troxel
2010-10-13 14:02 ` org-mobile-use-encryption Andreas Röhler
2010-10-14 6:40 ` org-mobile-use-encryption Carsten Dominik
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).