Is this app supposed to work with encryption but without an admin recovery key?

[func0der]

Hey,

since none of the images in an instance I run were indexed and instead I got a lot of theses errors "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you." in the log, I was wondering if this app actually works without an admin recovery key?

I was wondering how Nextcloud or better the cron would access images without decrypting them.
I first believed it to be a smart process that utilizes user sessions to decrypt and categorize images on the go, while the users interacts with Nextcloud, but I am currently sure that it is not working like that.

Can anybody please comment on this?

And if it is not possible to use this app on a fully user encrypted instance of Nextcloud, which means no admin recovery key, then it should be stated on the status page of this app and also in the documentation, so nobody needs to put time and effort into debugging something that is not supposed to work.

[marcelklehr]

And if it is not possible to use this app on a fully user encrypted instance of Nextcloud, which means no admin recovery key, then it should be stated on the status page of this app and also in the documentation, so nobody needs to put time and effort into debugging something that is not supposed to work.

Good point. I'm not very knowledgeable about encryption, AFAIK there are two variants in nextcloud: end-to-end encryption and server-side encryption. If the encryption does not allow the nextcloud admin to see your files (which I'm assuming based on your post), recognize will not be able to see them either.

[func0der]

If that is the case, please add a notice.

I just realized that since ~2017 Nextcloud or Nextcloud 13 [https://github.com/nextcloud/server/issues/8283#issuecomment-369244501] has been generating a master key by default, which of course makes all of those fancy new features work.
BUT everything falls apart if you user-key encryption without any recovery key or master key whatsoever.
People who want to max out privacy are left behind by implementations that require the admin/server to have permanent access to their files.
I wish Nextcloud would be generally more transparent about this.

OR (which I think would be better): the processes could happen as long as the user is logged in.
This way the web interface could trigger batch processing of files and the features would be available to anyone.
Of course this should be opt-in, because the data would be held unencrypted for a (extended) period of time.

Is Nextcloud's architecture event based in any way? For example could one hook into "a new file has been uploaded" and access the unencrypted original file in that process?

What do you think in general of this idea?

[marcelklehr]

If that is the case, please add a notice.

I'll do that. Thanks for bringing this to my attention!

People who want to max out privacy are left behind by implementations that require the admin/server to have permanent access to their files.

I'm afraid that's just the nature of the beast. In terms of privacy, the server is the admin and the admin is the server. If you encrypt your files, so the admin can't read them, you can't expect server-side features to work that require reading files.

[func0der]

Encryption of files during first login with user keys works too :D

Too bad. That locks out users for now. It is not possible as you say to make anything work if apps/processes can not read files at all, but maybe we can find a temporary but save process for this one day.

I'll do that. Thanks for bringing this to my attention!

Appreciated, thank you :)

I also opened PRs to inform the user about the way the encryption works during activation: nextcloud/server#40468
and in the documentation, specifically mentionening Recognize as an example of something that does not work if you are disabling master key encryption: nextcloud/documentation#11122

Maybe this helps future generations not to be confused about this :D

[func0der]

@marcelklehr Just for clarification purposes: Recognize probably does not work with End to End encryption either, does it?

So if you put something in your description, you might want to mention that one too.
Have not checked if it is already mentioned somewhere 😅