Shared documents password

[aliuq]

Description

Please allow shared documents to be accessed via password​

Use case

No response

Anything else?

No response

Are you willing to submit a PR?

• Yes I'd like to help by submitting a PR!

[pengx17]

I am converting this to a discussion since this more of a feature request.
This is an interesting idea. What do you think? @houjoe0829

[EclipseNow]

Hi all, many users need a notes app to have security like Onenote. Because I need all my personal admin (bank accounts, medical info and government stuff) on me at all times, I need:-

• password locking - and automatic locking after a few minutes AFK. (Users set the time.) I review my notes when sitting having fast food, or anywhere really. If a guy distracts me while his thieving mate grabs my open phone from the table with my notes app open - I’m done! If it has AFK, I might have a chance that it’s locked by the time they run away and have a look.
• store the notes in an encrypted database on my hard-drive as well as the cloud. EG: Obsidian has a password plugin - but if someone gets my computer open they could look up the Obsidian storage files - and there they are in markdown!
• Able to share certain “Notebooks” with a visitor requiring their own password for those sections - but not having access to the whole thing. EG: Trilium got so close - but it's only single user. If I share that password - it unlocks ALL NOTES to the visitor.
• This last one is optional - but I’d love there to be a Freemium model with cloud syncing as well where the first 5 to 15 Gigs cloud syncing are free. (Think Microsoft & Google). I have a lot of notes - but not that many notes. I would be content with 15 Gigs.
  I’m not alone - there are many seeking passwords & AFK & secure sharing. We’ve got used to it. It’s in Onenote - after all!
  Cheers.

[kernelb00t]

password locking - and automatic locking after a few minutes AFK. (Users set the time.) I review my notes when sitting having fast food, or anywhere really. If a guy distracts me while his thieving mate grabs my open phone from the table with my notes app open - I’m done! If it has AFK, I might have a chance that it’s locked by the time they run away and have a look.

I don't like being the Dr No guy, but I don't think that's the right way to do this. Medical info, etc.. do not have to be in a note-taking app, and I suppose it is not the purpose of this project. Yes, having some encrypted features can be useful, data at rest must be protected, but this is not the app's job to do this, unless E2E encryption is required (checkout Anytype for this).

Let's say the app is encrypting data at rest on the phone.

Then, think of data recovery. If it is encrypted, with what? The PIN? You would have a 4-number, or a 6-number PIN. With good knowledge, you can break this in little time.
The user forgot their PIN, so to recover it we store data in the server. The thief just has to go to a browser and open the AFFiNE page. You'll be probably connected, and boom the thief has access.

I want to say that this is not the app's job, more the platform job.

For your smartphone, get a fully encrypted one (kinda recent Androids or iPhones). Recent version of Google Play Services have a "Stealing protection" : accelerometers detect if the smartphone is being stolen. With iPhones, you can lock apps with FaceID. Here, nobody can acces the app, even if they are eyesdropping your PIN when you enter the app.

The only tricky part is the laptop one, but with any OS you can get fully encrypted disks (Bitlocker for Windows, HFS encryption for macOS, or LUKS for Linux). General practice is to lock your laptop to prevent unauthorized access to your data when you're away. Here, the disk is encrypted so even if they unplug the disk they cannot do anything.

Because I need all my personal admin (bank accounts, medical info and government stuff) on me at all times, I need:-

Why is it in a note taking app?? Use a password manager if you consider this important! Bank accounts credentials MUST be at least in a pw manager (iCloud Keychain, Bitwarden are great at this and Bitwarden is self hostable), if not directly in your brains memory and not stored anywhere. Medical info, in some secure vault apps, or things like this. Those are everywhere, and Paperless NGX is good at organizing everyday administrative documents.

store the notes in an encrypted database on my hard-drive as well as the cloud. EG: Obsidian has a password plugin - but if someone gets my computer open they could look up the Obsidian storage files - and there they are in markdown!

Huh, you're fucked if someone gets your computer open. They can do more harm than simply going through your notes, they can reset your Google password if you're logged in your password manager (or worse if you are using a note taking app to store your passwords). If you don't even trust the user of the computer: that's you.

Able to share certain “Notebooks” with a visitor requiring their own password for those sections - but not having access to the whole thing. EG: Trilium got so close - but it's only single user. If I share that password - it unlocks ALL NOTES to the visitor.

If you need to securely share info to someone, no password is useful. That's the same as sharing it publicly, if you don't trust the receiver (he can give everyone the password). If you trust him, the link IS the password because of the length of the identifier (the ID is even longer than the typical password you would give to the receiver). Guessing it would take ages, the Earth would already be attracted in the Sun and the bruteforce attack would still not be successful.

If you need that much security, RBAC (Role Based Access Control) is the evolution of what you are describing. You invite the guy, he creates an account, you give him a role that provides him access to specific things in the workspace (it's the same as roles in Discord servers). Nowadays, everyone is moving out of passwords so it is not very clever to implement a feature that will seem dumb in a few years. However, RBAC is a very Enterprise-grade feature so if implemented, it will surely be behind a paywall.

This last one is optional - but I’d love there to be a Freemium model with cloud syncing as well where the first 5 to 15 Gigs cloud syncing are free. (Think Microsoft & Google). I have a lot of notes - but not that many notes. I would be content with 15 Gigs.
I’m not alone - there are many seeking passwords & AFK & secure sharing. We’ve got used to it. It’s in Onenote - after all!

First, it gives me chills seeing the words "password", "secure sharing" next to "note apps". Use password managers for this, they are much more security oriented and pass certifications that is not relevant on a note taking app.

The freemium model already exists (IDK if it existed a year ago), that's AFFiNE Cloud.