Hi, I’m completely new to DEVONthink. I have a database which should be synced between my Mac, my iPhone and my iPad via the new CloudKit solution. Since this database contains sensitive information, it has to be E2E encrypted. I took the following steps:
-installed DEVONthink on my Mac
-created an encrypted database with password 1
-activated CloudKit sync for that database with a new password (password 2)
-installed DEVONthink to go on my iPad
-activated CloudKit sync with a new password (I reused password 2)
-now everything syncs perfectly
My question: what is the purpose of password 1 if it is only required on my Mac? I never had to type it in on my iPhone or iPad. Is this expected behaviour?
Did I do something wrong? In my understanding, I should have to type my password 1 in on each new device to unlock my encrypted database.
It would be great if you could help me with my questions…
It’s only the key for the locally encrypted database. You can add dedicated credentials to File > Database Properties which will be used by the synchronization before importing a database onto another device.
Hi, thank you for your answer. I now had time to review your answer, but it is still unclear for me how to achieve an End-to-End encrypted synching via CloudKit.
Are the credentials you mentioned sufficient for that?
If you encrypt the sync connection, then the encryption starts at your computer on the upload, stays on the Apple CloudKit in encrypted form, then when you sync down to another device, that device de-crypts. That is how I understand it.
To be specific about your concerns when you say “end-to-end”, exactly what are you defining as your “end” points? Different than explained above?
This is exactly what I want, thank you very much.
I’m just confused how I encrypt the sync process… on my Mac I had to choose a new password, which I had to type twice, which I understand.
However, after I synched my Mac database to CloudKit, I wanted to activate CloudKit on my iPad. I chose CloudKit, but I had to choose a password for CloudKit, and type it twice. This looks to me like I have to type a new password, but I simply used the one from my Mac twice. It works now but I’m confused why I had to type it in twice on my iPad, because this normally suggests that you are setting a new password and if this could lead to syncing problems in the future…
Let’s keep the terminology clear (and it’s important, not pedantic)…
There is no password on a sync location. There is an encryption key. Its function is to scramble the data when syncing and allows storing the sync data in an encrypted state.
There is no encryption key on a database. There is a password. It does not encrypt anything. A password is the same as the key to a safe or a door. Only those with a key, those using the key, can open and get into it. So applying a password in the Database Properties is only used for importing databases via sync, effectively making sure the device importing it has the “key to the door”.
Both a database password and an encryption key are optional.
on my Mac I had to choose a new password, which I had to type twice, which I understand.
Can you clarify where you had to choose a new password?
On my Mac, I opened the sync menu with cmd + , and chose “iCloud (CloudKit)”. There, I chose a new password and had to type it in twice. I use DevonThink in German, so I don’t exactly know if this is the encryption key, but it should be, because it’s called “Verschlüsselung” which means encryption.
After that, the first sync started.
I now had set up the CloudKit sync with an encryption key.
After that, I downloaded DevonThink To Go on my iPad, and opened the settings.
There I added iCloud (CloudKit), because that’s what I set up earlier.
Then, there was no single option to enter my encryption key, only two lines where I could type in my encryption key twice. I did that and it works, but it looks to me like I made a new encryption key - only that I had to choose the same one to make it work. This is what confuses me…