Will Bear get zero knowledge encryption with iCloud Advanced Data Protection?

Feedback
1

With Advanced Data Protection, Apple will offer users to get end-to-end, zero knowledge encryption on almost all their iCloud data, which is awesome.

I was wondering if it will include Bear’s database as well? This support document reads:

When you turn on Advanced Data Protection, third-party app data stored in iCloud Backup and CloudKit encrypted fields and assets are end-to-end encrypted.

If our beloved developers could make it so that our data is end-to-end encrypted when we switch on Advanced Data Protection, it would be wonderful! And it seems like it would not be too much work (design the data as encrypted, I guess?)

Thanks!

7 Likes
3

Would love to know more about this as well.

4

I have not installed iOS 16.2 yet but my understanding is the new Advanced Data Protection is not open to third-party developers. If this will be at some point made available to devs (or even better, it just works) we’ll be glad to integrate it.

Mind CloudKit already provides non-e2e encryption as some services un ADP but we do provide our own.

1 Like
5

Thanks for your answer! CloudKit is concerned as well by the blanket E2EE, is my understanding. In the same way that your files are encrypted but still available to your apps locally. I might be very mistaken on that front, but if not, it would be great if Bear could be made compatible :blush:

6

What does it mean “you provide your own”? Does it mean our databases stored on CloudKit are encrypted with keys you have but Apple doesn’t?

7

I mean password protected notes are e2e encrypted.

2 Likes
8

It seems that developers must take some kind of step so it falls under ADP.

“Advanced Data Protection also automatically protects CloudKit fields that third-party developers choose to mark as encrypted, and all CloudKit assets.”

And: " iCloud stores some data without the protection of user-specific CloudKit service keys, even when Advanced Data Protection is turned on. CloudKit Record fields must be explicitly declared as “encrypted” in the container’s schema to be protected, and reading and writing encrypted fields requires the use of dedicated APIs."

from: Advanced Data Protection for iCloud - Apple Support

I came here from reddit, where some people have asked for this privacy & security enhancement here:

http s://www.reddit.com/r/bearapp/comments/zg2ngn/bear_apples_new_end_to_end_encryption/?utm_source=reddit&utm_medium=usertext&utm_name=bearapp&utm_content=t1_j0l982h

Please do add this functionality. It would be amazing. Thank you.

2 Likes
9

Can there be clarification whether Bear uses or will use this requirement?

“CloudKit Record fields must be explicitly declared as “encrypted” in the container’s schema to be protected, and reading and writing encrypted fields requires the use of dedicated APIs .”

If so, I hope there’s some kind of update to Bear’s faq as well.

Thank you.

1 Like
10

Yes, as you can see on the API page you linked encryptedValues is available only on macOS 12+ and iOS 15+. This is a huge problem for us because B2 actually supports macOS 10.15+ and iOS 14+ so we can’t support this API without dropping a considerable portion of users currently using B1.

Usually, we can check inside the code the OS version the user is running and eventually enable a version-specific API but this is different because we are not aware of the other user devices and which OS they are running. Otherwise, we can find ourselves in situations where some user devices can’t sync.

3 Likes
11

Thanks for clarifying.

12

I would like to enable this and I am aware of the tradeoffs. This could be an opt-in setting with a disclaimer about which OSes are supported.

5 Likes
13

Yeah, so you have “Enable E2E sync” checkbox in preferences of both macOS & iOS apps, then you enable it everywhere you have Bear installed and Bear uses E2E API instead. Seems feasible.

Of course user can mess it up, but Bear may warn with red big warning when you enable it.

4 Likes
14

I would love to see E2E Encryption through iCloud ADP to come as an option, as it was one of reasons which brought me to use Bear in the first place (privacy first).

Reasoning: I don’t see myself encrypting every note individually, but I don’t want Apple to be able to read my notes in clear either.

1 Like
15

If this was implemented, this would definitely cement me in the bear ecosystem.

2 Likes
16

Would certainly be great if Bear supported this.

17

So, will Bear 2 support this? E2E us very important for my notes app. I understand that Bear has no way to access my data. But Apple does.

If Bear will not support E2E, then that limits what I can keep inside the app.

1 Like
18

Reading through this again I’m somewhat confused. In the current state of things, will the database not be E2E, but the actual notes will be?

Some clarification of what exactly is possible in the current configuration would be helpful.

19

Current state of things is everything is encrypted as it is in transit, and at rest - but Apple holds those keys. ADP, if turned on, would mean Apple didn’t hold the keys (only your devices would).

You can still use individual note encryption in the current scenario for zero knowledge encryption.

20

To adopt ADP on CloudKit we have to use the new fields available for this purpose. The problem is the APIs are available starting a specific iOS and macOS release and we if adopt it we have to drop support for a considerable half of the currently supported OSes. As @HumbleBear wrote this doesn’t mean your online date and the communication between your device and CloudKit is not encrypted but Apple holds the keys.

Single notes encrypted in Bear are already e2e on top of Apple’s encryption.

21

Is it possible to encrypt all your notes and unlock them all at once with a password?