Password Protected Notebooks

[EvernoteLover9 160]

I love Evernote, but it's preventing me from putting in sensitive content. For example, I can't keep a personal journal notebook, because other people (i.e. girlfriend, family members, etc.) could one day be looking at those notes, especially since they know that I use Evernote often for many purposes.

 

Evernote already has the ability to encrypt single notes. This is useful for things like storing passwords or other temporary sensitive content. But it's not practical to encrypt many notes one by one.

 

I wish I could password-protect a whole notebook. This way, I can do a lot more with Evernote. If I can encrypt single notes, then why can't Evernote just allow me to encrypt entire notebooks? If reason behind this is because Evernote thinks one could lose a lot of data if a notebook password is forgotten, then perhaps Evernote can help recover the passwords through email.

 

In the meantime, I'm stuck with using other apps (i.e. Pages, Day One, etc) to password-protect my content.

 

Any insight is greatly appreciated.

 

Thanks.

[JayR613 0]

I would like to be able to store HIPAA protected information in Evernote

[ivan.dabbles 13]

On 10/20/2021 at 9:28 AM, JayR613 said:

I would like to be able to store HIPAA protected information in Evernote

This is an excellent point!

[CalS 5,292]

Encrypt it before you add it to Evernote.  Still buyer beware.

[v.tsyvina 2]

8 years in and the idea is still not implemented? Add it to premium subscription at least. Why don't you see that users need this feature? And it doesn't seem to difficult to implement.

[PinkElephant 8,291]

Personally I think it would be they way to go as well.

But „time since first posted“ is no measure that an idea is sound, neither that its likelihood of getting implemented is improving.

I doubt they are measuring the length of the beard an idea is growing since it came to the light of the world, and decide to go after the longest. Maybe they are after an entry into the Book of Records instead …

[OldManLarsson 0]

I sorely miss the feature to passwordprotect notebooks/notes. OneNote has this functionality. I cant keep track of private matters in evernote because of this. Encryption does not work on images for example. Encryption is simply too much of a hassle compared to simply passwordprotect notes/notebooks.

Im not sure why this feature has been idling for such a long time? Its one of the most upvoted features in here.

[agsteele 2,983]

If you simply want password protection then sign out rather than quit the program. That said, this has never been a feature of Evernote so I doubt it is on its way in while there are many other issues on the agenda to be fixed or restored.

[sharrison 0]

Urggm, same. I need password lock on my evernote desktop windows.

 

Why is this so darn hard to get implemented.

 

NO, I am NOT interested in locking my PC.

 

 

[PinkElephant 8,291]

Log out of EN, and you need your password to open it again. You can even let the app running.

Why is it so darn hard to use what exists ?

[PinkElephant 8,291]

On 12/17/2021 at 2:57 PM, Luke67 said:

The reason I do not prefer the approach you propose is because that most of my folders don't require special security, and therefore I don't need to enter a password. With your proposed work around I am required to type in a password every time, which I find very inconvenient. It also requires me to remember to log out, which I'm sure I would on occasion forget. Therefore the reason it is so "darn hard" to use what is there is because it doesn't provide me with the simple functionality that I and many others have been asking for forever, and which similar applications in the market possess.

I can see a logic behind encrypting whole notebooks.

But I can't see the logic behind your posting. If you forget to log out, you will forget to encrypt the notebook as well. The EN client is already protected by the login process. For your use case it makes simply no sense to add yet another layer of encryption. It will not protect anything if you forget to apply it whenever you are leaving the PC.

For this situation it really is easier to setup the PC to lock itself when you stop using it. This does not require any action by you to make if safe - it will apply the safety mode whenever you forget about it.

Probably you should get yourself a PC with a touch sensor, or Windows Hello face recognition. It makes life much easier when setting the PC to a short auto lock cycle.

[JKST 4]

This topic is not going away, people would like it (even if they don’t “need” it) and so why not provide it?  I am assuming it is costly or technically hard. 

[bencccc 0]

Are they even working on it or planning on it?

[PinkElephant 8,291]

EN only very scarcely comments on anything they are working on.

This thread is from 2013. Draw your own conclusions ...

[agsteele 2,983]

This has never been a feature of Evernote and there is no indication that it is planned...

[agsteele 2,983]

Actually, you can choose to log out and then your password is required to access your data. A very basic password feature had always been in place. Just most users don't use it.

The encryption of individual notebooks is a much more complex thing which would, I think, require a bigger piece of work since it would affect the whole structure of Evernote data. So, what we have available is whole account level or text level.

[PinkElephant 8,291]

If is beyond my comprehension why people use complex apps, but obviously do not know anything about how they work in first place.

EN relies in a lot of server side functions to perform advanced (= subscribers) features. If you really encrypt - without EN holding a master key -, these functions will stop to work. Probably this is why EN resorts to allow only selected text inside of a note to be encrypted.

This does not mean that your data is in the big wide open of the web, readily read by anybody. Search engines can’t access the user notes. The server content is encrypted, just EN bots allowed to read it to perform their magic. To protect the account, there is the usual user & password combination, plus for all accounts 2 factor authentication. It is highly recommended to enable it.

If in a situation where you do not want the creation of local data, on desktops you can decide to delete your user data on leaving the app. If you can’t install an app (work computer), you can use the web client instead.

Personally I would like to get a feature to select an entire notebook, and encrypt it. Maybe we will see something like this one day.

[PinkElephant 8,291]

You don't give a damn, you don't know how it works, and in consequence you document your ignorance here.

First principle of information processing: GIGO - Garbage in, garbage out.

So we make it easy: Just take a look at which services are executed on the EN server working on the content of your notes. You don't need to understand how, you just need to look what is processing your data there, trying to make sense of it. Now put a solid encryption on top of it - of the kind where EN does not hold a master key any longer.

Easy to understand: The services stop to perform magic.

About EN staff commenting here: They rarely do, and (up to now) they have never told why they did NOT implement A or B. They implemented C and D, for everybody to see and use, and that is it, take it or leave it.

If you want an answer from EN, ask support. I would be surprised if you come out of it with more insight than today. They just tend to be much nicer than me, because they honor this sort of support professionalism. Since I am just another user, not related to EN, I can say as I do.

[PinkElephant 8,291]

1 hour ago, JKST said:

If Evernote’s issue is that encryption would prevent their server side functionality then I would be happy to share a common key with the application or allow some admin access some how.  My desire to password protect a notebook is mainly driven by a desire to prevent casual unauthorised observers, …

 

OK, maybe some reading stuff:

https://evernote.com/intl/en/security/

Read especially the parts about transport encryption and encryption at rest. It means your data is encrypted both while transferred between client and server, and while stored on the server.

These functions work as you wish: They encrypt, with a key shared between you and EN. The key is generated when you open your account, and used from that moment on all data. It works automatically and in the background, which may be the reason may users are not aware of it.

To make sure the data on your local drive is encrypted, use the tool provided with your operating system. It is called BitLocker for Windows and FileVault for Mac. It will encrypt the data on your drive, only unlocking them when you are logged in. Encryption is usually enabled as well on mobile devices.

Conclusion: The type on encryption you want to have is already in place.

Hint: To further beef up account security, make sure you use a unique, strong password and have 2FA enabled.

 

 

 

 

[PinkElephant 8,291]

Password protected notebooks would be good, but in daily use they would be a burden. If you put everything in there for daily use, you would have to unlock and lock up again. Looks would probably serve better for less frequently used, but important stuff.

There is a much easier solution for your specific issue: Set up a second, Free account. Use a different password for it, and use it for the documents you want to pass on. Put 2FA on your main account - without a code generator it is practically impossible to break.

[sgallant 0]

This is a must have feature for me, but given the number of people that have requested it and the age of this request I can assume this feature is never coming. I really like EN, but there are some minimum requirements these days and it looks like they aren't keeping up.

[PinkElephant 8,291]

Explain why this is a minimum requirement for you ? If we don’t have use cases, the arguments have been exchanged already about it pretty much.

About whether it will arrive one day: I won’t bet against your assumption…

[gc-7p183 2]

Hello, as many others here, I use Evernote for both professional and personal content. I would need make sure that the two are not mixed, e.g. when I share the screen with colleagues. Having a notebook that can blocked and then unblocked only via password would give me peace of mind. Of course this means that locked entries do not have to appear in searches or any other visible way. 

[agsteele 2,983]

1 hour ago, gc-7p183 said:

Of course this means that locked entries do not have to appear in searches or any other visible way. 

And this is one of the challenges. One of the major strengths of Evernote is its search functions. If notebooks were locked and unsearchable then when you ask to locate a particular note it would not be available. If, instead, you want search to be accessible only when a particular notebook is unlocked then that would be a significant piece of work to implement. Feel free to suggest it. I can see the reason why you might want it. But don't expect an early answer

[PinkElephant 8,291]

No search …

No OCR …

No filtering for notes …

It makes completely no sense to drop content into EN when all these functions are crucified for a subjective feeling of security. A folder on a drive or cloud server would do when these functions are not needed.

Objectively all user data is encrypted in transport and on the server. The access happens only by bots (programs) that use the master key EN holds to perform the miracles that makes EN stand out. For me no lack of anything.

For a restricted use a encrypted notebook would be a nice addition - for a few documents, no more.

[gv3 1]

This is preventing me from buying Business. How does EverNote not have this? I'm trying to switch from OneNote to EverNote and this is one of the few things holding me back.

[SandiN 0]

My thoughts on the matter:

• It would already make me happy if I could password protect text with the web version (I'm using linux so there is no desktop version).
• Protecting entire notes would be great. I would use that on a handful of notes that contain extra private stuff (passwords etc.).
• For me it would be enough to just put a password on a note, without the note being really super encrypted or save from a person with technical knowledge. I would like the password to protect from a person happening to use my computer with evernote open and clicking around. So just superficial protection would be enough for me. 
• I'd be curious what's the difficulty in adding such a feature.

[agsteele 2,983]

The whole encryption model in Evernote is at best flakey. Far better to use an external encryption program. For the very, very few times I need to encrypt I put the content in a program such as word or a PDF and use the encryption there. That ensures that the note content never appears unencrypted inside Evernote. Remember that prior to encrypting the unencrypted text is synchronised. Using an external program works with the web version too.

For the simple solution you suggest you can simply log out of Evernote and your notes are then password protected.

[PinkElephant 8,291]

Possible ways to look at it:

• The app is still living and growing, so obviously no need for that feature.
• We now waited so long, it must have moved up on the priority list year by year. Where is it ... ?

I think we all who would like to get this extension probably underestimate the technical side of implementation, and at the same time overestimate the sales potential of such a feature.

I would like to see it coming, but I do not really expect to see it. Meanwhile, I use another solution (my password manager, having a "secure notes" section) to store that little amount of information that I don't want to entrust to my EN account.

[PinkElephant 8,291]

First anything encrypted is excluded from server based features: No search, no OCR, no thumbnails etc.

Second it’s not done by simply encrypting a notebook. Each note is like a a small website, and needs to be integrated to work. If the „surrounding“ notebook is encrypted, this gets pretty hard.

You don’t explain your use case - just telling „I need it“ says nothing. There are several ways to save encrypted content in Notes (zipped files, encrypted pdf, containers created by VeraCrypt or similar) or outside of EN.

Maybe these working alternatives are the reason why the discussion is relatively calm.

[PinkElephant 8,291]

It is simple to say „oh, this or that is soooo easy, and they are just reluctant (or incompetent).“

But maybe who says this is ignorant about the facts, or just arrogant ?

As another user I can’t tell one from the other. What I can tell: If something serves my use case, I use it, no matter if „they“ communicate with me or not. Most „communication“ is plain marketing chitchat, and I can easily do without. And if it doesn’t match my use cases, I took a wrong decision myself, and need to correct it.

Is it really so difficult to say „I took the wrong turn“, and instead always resort to blame others ?

[PinkElephant 8,291]

Personally I doubt it is technically that basic.

But always nice to have something to celebrate.

[PinkElephant 8,291]

When selecting segments of text, make sure to have only allowed formatting selected in the text chunk.

Else it happens what you see: The encryption option is gone.

About encrypting with more flexibility: Use one of the usual apps to encrypt a container (like ZIP, TAR or the like), drop the container into a note. Not really as good a a better encryption, but readily available today.

[PinkElephant 8,291]

There are technical reasons for the current encryption, with its abilities and restrictions.

Anything beyond would require a complete redevelopment of the encryption tool. I doubt this is on the agenda for now, or anytime soon.

In this thread alternatives were posted already. Among them is using file attachments with a native encryption, or a different cloud service that has natively fully encrypted upload.

[philanon 9]

I wanted this too until I really thought it through and read the other comments. As soon as you put the text in there, it's searchable. 

For the use case of not wanting someone that is using the PC to be able to click around in EN and see certain content, the solution is to close/log out of EN before turning over control and to lock it or log out when away. 

For the person that wants to avoid accidental screen sharing of personal content while keeping EN open for work content, that's a little trickier. What you could do is create a second account and share only the work notebooks with that account. Then log out of your "main" account and into your second account before doing work. I have a couple of notebooks shared with a family member and they don't see the rest of my stuff nor do they require a subscription and this works well. 

[agsteele 2,983]

I refer to my response earlier...

Apart from anything else, encrypted notebooks would break search.

If you need to lock notebooks I suggest you simply Sign Out at the end of a session and sign back in next time you want to use Evernote.

 

[PinkElephant 8,291]

For me keeping things structured and confidential is important. I am freelancing, and what belongs to project A must be kept away from client B.

What I do is running my Professional account as a hub. It is build for this, with features supporting my type of work.

When a new project starts, I usually open a new free account. I create the project structure there from a template notebook I keep in my main account. The Free accounts notebook (often one will do) is shared from my Professional account.

So everything is clean and in its own compartment. On project hardware I only use the web client and the project account. To prevent others from sneaking in, I have 2FA enabled.

The Professional account I only open on one of my own devices. I really don’t see a need for a massive encrypted substructure in EN accounts for my use cases.

[agsteele 2,983]

Yes 10 years on and this isn't on the agenda. It wasn't on the Legacy agenda and neither for v10. It seems we know the answer. Sorry.

[Existellar 0]

I can see this is a long and protracted issue, but just wanted to add my voice to this. I know I may not be adding much new, but I do want to at least 'demonstrate demand'. Big thanks to the contributing EN experts earlier in this thread who have been shepherding the discussion.

Like many many others, I use Evernote to help organise my professional life, and I would also like to use it as a personal journal. While I'm at work, I want to keep my personal stuff separate.

What I mean by separate:

• I don't want my personal notes to show up in a search (and yes, I know this could in theory be done by a tagging system and excluding a tag from search)
• I don't want my recent notes from my personal notes to show up on my home screen
• I don't want my recent notes from my personal notes to show up as suggestions when I'm doing other actions in the app 
• I want some assurance that if I step away from my computer momentarily someone can't get in (and yes, that can be prevented by remembering to lock my screen)

Overall, it's not that I need to keep my very mundane secrets away from the curious glances of colleagues or clients who I'm sure don't care... it's that I want to feel 'safe' that whatever silly thing I put in there is for my eyes only, and I want a bit of psychological separation between work and leisure.

Having multiple accounts could have been a way around this prior to free account limits. But alas, I'm just a regular joe and I don't really have the extra income for two paid accounts (or really, for paid accounts on multiple competing apps). Maybe that means I'm not the target audience for Evernote any more, which is also fair.

Encryption is a nice enough option to 'hide' notes or parts of notes, but because it is not compatible with images and markdown it doesn't work for me. If I want to include tables or media I cannot encrypt them without a lot of effort. It's also a lot of effort to un-encrypt all the cells if I want to read the table back. To me, as an end user in this use case, it's also not actually important that the text is 'encrypted', just that it is hidden.

I can see many possible solutions that would work for me. Here are some ideas:

• Allowing multiple 'workspaces' / 'desktops' within Evernote, where I can toggle which workspace shows up in searches or on home screen, and 'log' between different workspaces. This could be accessed from the accounts section, and would function very similarly to having an additional account. This would be my preferred solution though may be the least practical. 
• Have a 'Diary' area in the main menu tree on the same level as 'Notebooks'. Anything in the 'Diary' is excluded from search results, files, or the home screen. Ideally have an optional password on this section.
• Allowing a whole 'stack' to be marked as private. This should: exclude notes in that stack from being included in search results, files, or on the home screen unless the user specifically searches within that stack. The stack remains under the 'Notebooks' section.
• The ability to globally encrypt a note (e.g. I can toggle encryption and EN will try to encrypt whatever text there is, meaning I don't need to highlight every individual cell in a table in order to hide it from search). Not the best solution but would work from my perspective.
• ...and honestly many other possible ideas, but really depending on what the issue or roadblock is on a feature like this.

I've no doubt that this must be a difficult issue to work on, or that has complexities that we can't see as end users.