Jump to content
Zoomy

Encryption note cracks with double click

Recommended Posts

This is the weirdest thing ever.  I work as technology consultant, and one of the critical parts of my work in helping others is teaching people how to manage their passwords.  I have started using Evernote to store my own passwords, and now wanting to encrypt the note so that it cannot be accessed without my password.  A great idea, but it doesn't work AT ALL.

I created a note and titled it.  I then selected the text and chose "encrypte selected text".  The first time, and only the first time, I was asked to create a password.  Once all done, I see a little bar representing my encrypted text... Hoorah!  But accessing it is as easy as double clicking.  I experimented and unencrypted it, then re-encrypted again, only this time there is no password required. I checked to see if I could open on my iPhone app, and it DOES require my passcode, but also says that the file is being edited by another user, which it isn't, because I've closed my desktop app.  I also checked the online version, and it ALSO requests the passphrase, but does not insist the note is being edited elsewhere.

My final experiment was to create a brand new note and encrypt it.  Again, no passphrase asked for or given.  Encryption looks successful.  Double clicking opens it.  Checked on the iPhone, same passphrase as first note.

What is going on here?  My conclusion is that this aspect of EN is buggy at best.  No complaints otherwise, other than the rather odd and inconsistent disconnect in navigation between iPhone, desktop app, and online versions.

Share this post


Link to post

You checked "Remember passphrase until I quite Evernote"

Once you decrypt with the password, a single click will continue to open it until you exit and reopen Evernote.

Share this post


Link to post

I may have checked 'remember passphrase", I don't remember.  However, quitting and restarting changes nothing.  I also cannot remove the password, and I cannot encrypt new notes with a new password.  If I did check "remember passphrase" how do I undo that?  I am thinking this only happens to me, as there is no other mention of it in all my searches.

Share this post


Link to post

Evernote really has so much potential, but it seem really rough around the edges in many ways.  I am trying to "report a bug", as I have been advised to do elsewhere in these forums, but I simply cannot find a place to do this.  I've made it to this page, then I am abandoned, as there is no link to actually submit the bug in question: https://help.evernote.com/hc/en-us/requests/new?ticket_form_id=176617evernote link.jpg where do I go from here?  Shouldn't "submit a ticket" be a hyperlink so that I can actually do that??

Share this post


Link to post
9 minutes ago, Zoomy said:

Evernote really has so much potential, but it seem really rough around the edges in many ways.  I am trying to "report a bug", as I have been advised to do elsewhere in these forums, but I simply cannot find a place to do this.  I've made it to this page, then I am abandoned, as there is no link to actually submit the bug in question: https://help.evernote.com/hc/en-us/requests/new?ticket_form_id=176617where do I go from here?  Shouldn't "submit a ticket" be a hyperlink so that I can actually do that??

Below is what I see when submitting a bug report
The "submit ticket" may only be available for paying users

In the meantime, you have responses from your posts in this forumm
Why not continue through with that

 

 

Screen Shot 2016-11-11 at 10.33.47 AM.png

Share this post


Link to post
49 minutes ago, Zoomy said:

I may have checked 'remember passphrase", I don't remember.  However, quitting and restarting changes nothing.  I also cannot remove the password, and I cannot encrypt new notes with a new password.  If I did check "remember passphrase" how do I undo that?  I am thinking this only happens to me, as there is no other mention of it in all my searches.

OK, I finally resorted to the hopelessly outdated 1980's troubleshooting technique... reboot the OS.  I have an older laptop that takes about ten minutes to become usable after a reboot, so I try to avoid rebooting, I generally just use sleep...  Anyhow, after a reboot, I started Evernote and the database reloaded (is there a way to refresh the EN database without needing to reboot?).  All is well with encryption now.  Solved!

Share this post


Link to post
11 minutes ago, Zoomy said:

OK, I finally resorted to the hopelessly outdated 1980's troubleshooting technique... reboot the OS.  I have an older laptop that takes about ten minutes to become usable after a reboot, so I try to avoid rebooting, I generally just use sleep...  Anyhow, after a reboot, I started Evernote and the database reloaded (is there a way to refresh the EN database without needing to reboot?).  All is well with encryption now.  Solved!

Not sure what you mean by "refresh the database", but fully quitting the app is one level.  Thats a full close, not just closing the window.

The next level is a reboot of the device.

Finally, you can rebuild the database by deleting it and letting it be re-downloaded from the servers.  Note: the rebuild does not include local notebooks or unsynced notes.

Share this post


Link to post
23 minutes ago, DTLow said:

Below is what I see when submitting a bug report
The "submit ticket" may only be available for paying users

In the meantime, you have responses from your posts in this forumm
Why not continue through with that

 

 

Screen Shot 2016-11-11 at 10.33.47 AM.png

The idea that submitting a ticket is only available to paying users is pretty dumb.  Considering the largest portion of the EN user base is for the free version (I am assuming), this is also the largest pool of test users to find and report bugs.  In my case, I am positioned to introduce EN to many of my clients, and therefore would like to be able to identify and report bugs before recommending it.

Share this post


Link to post
Just now, Zoomy said:

The idea that submitting a ticket is only available to paying users is pretty dumb.

Maybe, but with something like 200 million non-paying user's, the load would be incredible.

As an alternative, many user's find these forums useful 

Share this post


Link to post
1 minute ago, DTLow said:

Not sure what you mean by "refresh the database", but fully quitting the app is one level.  Thats a full close, not just closing the window.

OK, maybe splitting hairs here, but I am not sure what YOU mean by "fully quitting the app".  I am on a windows 10 computer, and unlike the mac, fully quitting any app is done by clicking on the X in the corner.  To answer your question about refreshing the database, after I rebooted and started EN, I saw a progress bar indicating it was "loading the database", which I don't ordinarily see when starting EN.  It only happened after a reboot.  I want to know how to do it without having to reboot.

Share this post


Link to post
23 minutes ago, Zoomy said:

OK, maybe splitting hairs here, but I am not sure what YOU mean by "fully quitting the app".  I am on a windows 10 computer, and unlike the mac, fully quitting any app is done by clicking on the X in the corner.  To answer your question about refreshing the database, after I rebooted and started EN, I saw a progress bar indicating it was "loading the database", which I don't ordinarily see when starting EN.  It only happened after a reboot.  I want to know how to do it without having to reboot.

We need a Window user advising.  I'm also not an Evernote Encryption user

No ideas on the "loading the database"

Share this post


Link to post
20 minutes ago, Zoomy said:

OK, maybe splitting hairs here, but I am not sure what YOU mean by "fully quitting the app".  I am on a windows 10 computer, and unlike the mac, fully quitting any app is done by clicking on the X in the corner.  To answer your question about refreshing the database, after I rebooted and started EN, I saw a progress bar indicating it was "loading the database", which I don't ordinarily see when starting EN.  It only happened after a reboot.  I want to know how to do it without having to reboot.

CLicking "x" does not quit the app. It merely closes the window.

 You need to do File|Exit. That will completely unload the evernote.exe process from memory. Then restart it.

  • Like 2

Share this post


Link to post
43 minutes ago, EdH said:

CLicking "x" does not quit the app. It merely closes the window.

 You need to do File|Exit. That will completely unload the evernote.exe process from memory. Then restart it.

Well, after 25 years of troubleshooting windows, and becoming a widely sought-after expert on all versions of Windows, I would ordinarily disagree with you. I went and looked it up, and I concede that you MIGHT be right (it depends on the whim of the application programmer, I have just read).  I would suggest once again, that having to close any program with File/Exit is counter-intuitive to the average user who might encounter this type of problem, and would result in said user running for help or just giving up.  I know that in the Mac world, X does not close the program, and similarly in iPhone/iPad, escaping does not close the program.  But in Windows, it has always been assumed by me and most of the rest of the world that the X is the same thing as File/Exit  http://arstechnica.com/civis/viewtopic.php?f=17&t=238852

Thanks for engaging in this discussion!  Nothing like new knowledge.

  • Like 1

Share this post


Link to post

A lot of apps don't close with X. Skype, OneDrive, etc. Evernote is of the opinion users want the exe running in the background so their local data is always up to date and there is virtually no risk someone creates a note then "closes" Evernote on PC A and the discover hours or over the weekend it didn't sync so their note is essentially in a draft status on a PC they won't access again for hours or days. 

So unless you explicitly File|Exit, Evernote runs in the background and keeps everything in sync. 

  • Like 2

Share this post


Link to post

In addition, closing the application window leaves the Evernote screen clipping facilities available, which have general utility: you can clip to the clipboard, or to a file system image file, as well as to Evernote.

  • Like 1

Share this post


Link to post

Sorry if this isn't the answer you wanted, but I don't think that using Evernote as a password manager is the best thing to do, because it probably wasn't engineered for that use case, and so may not be as secure/bulletproof as a dedicated password manager app. I realise it's tempting, because Evernote is such a nice program (I use it all the time - for work and personal use) :-)

And yes, you need to quit the program with file->exit, which I find is now ingrained by habit (even when i don't need to).

HTH a bit

  • Like 2

Share this post


Link to post

It would help a lot if the box where you enter the passphrase emphasised that you should Exit Evernote by clicking File then Exit or your encryption effort may be vulnerable. Do not click "X".  Afterwards, for full Evernote functionality, relaunch it. 

Another idea could be to detect the use of encryption and prompt the user to do the above if encryption has been used.

Add to this the ability to encrypt complete Evernote notebooks or Folders (i.e. not just selected text of a notebook) and for me it would be a giant improvement for Evernote.

 

 

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...