Server: End-to-end-encrypt contacts

[rugk]

From https://github.com/nextcloud/contacts/issues/569 by @mejo-

Now that Nextcloud has end to end (e2e) encryption support, it would be awesome to extend that support to the Contacts and Calendar apps.

One would have to agree on a standard for delivering encrypted content via cardDAV/calDAV, implement it server-side in the Nextcloud apps and then coordinate with the cardDAV/calDAV clients (e.g. DAVdroid, Thunderbird Lightning, ...) to make them support the new e2e feature.

Do you think, that's feasible?

Certainly, the web applications no longer would work with e2e encryption, but that's an acceptable tradeoff in my opinion. It's quite common to merely use the contacts & calendars apps for syncing via cardDAV/calDAV and don’t use the web interface at all.

There's a related discussion on help.nextcloud.com: Add end-to-end encryption for contacts & calendar

[mejo-]

Thanks for copying the feature request over here, @rugk.

[GoetheG]

I second it!

[rugk]

Again here the link to the previous discussion, why this is needed, and why I think many people would use it even when they cannot search contacts in the web interface then: https://help.nextcloud.com/t/add-end-to-end-encryption-for-contacts-calendar/28879

[georgehrke]

One would have to agree on a standard for delivering encrypted content via cardDAV/calDAV, implement it server-side in the Nextcloud apps and then coordinate with the cardDAV/calDAV clients (e.g. DAVdroid, Thunderbird Lightning, ...) to make them support the new e2e feature.

What's the realistic chance of them ever adopting this feature?

Do you think, that's feasible?

To be honest, absolutely not.
E2E for files is perfectly feasible, because we provide our own clients for all major platforms, but there are already plenty of Calendar / Addressbook clients out there. We are not gonna start developing our own desktop / mobile calendar/addressbook clients for all major platforms.

[rugk]

So then we maybe need a better standard/WebDAV extension. And I guess eg. GNOME may add support for nextcloud specifically (actually it's entry I'd already present, so "only" e2e needs to be added).

Generally said, that something is hard here, is no reason not to try to accomplish it if it is a good thing. And if you first need a new standard, so may it be.😊

[e-alfred]

To bring E2EE to Caldav/Carddav in a serious manner, somebody would have to lobby at the IETF (and probably a number of big companies) to adopt this in an RFC and then push software manufacturers to implement it, otherwise it is just another proprietary "standard" nobody else adheres to.

[ajvsol]

EteSync has created the client-side (fork of DAVDroid) and server-side software for an E2EE CalDAV/CardDAV implementation.

E2E for files is perfectly feasible, because we provide our own clients for all major platforms, but there are already plenty of Calendar / Addressbook clients out there. We are not gonna start developing our own desktop / mobile calendar/addressbook clients for all major platforms.

All you need is the provider (e.g. DAVDroid fork) then the many existing calendar/addressbook etc clients out there can display that data.

[georgehrke]

All you need is the provider (e.g. DAVDroid fork) then the many existing calendar/addressbook etc clients out there can display that data.

All you need is a provider __on Android__.
iOS and macOS provide their own CalDAV implementation without the possibility to add custom providers.
And what about Thunderbird? should we fork that too? 😉

[skjnldsv]

Currently there a no plans to implement such a feature. Thus I will close this ticket for now. This does not mean we don't want this feature, but it is simply not on our roadmap for the near future. If somebody wants to implement this feature nevertheless we are happy to assist and help out.

If you wish to have this feature implemented by the Nextcloud GmbH there is the option for consulting work on top of your Nextcloud Enterprise subscription to get your features implemented.

[J0WI]

As this sounds like a nice feature, the requests for this are quite low.

When I sort all current open issues by "+1" reactions this appears to be a top 25 issue. :confused:

[skjnldsv]

Right :)
I should have removed the first sentence!
Technically, I don't see it implemented anytime soon. This is out of scope.