Secure log-out option on quitting

[FrogPhotog 0]

The crux of the issue for me is that quitting is not logging out.  This is not what I expect, it's counter-intuitive (and dangerous).

 

The way Evernote seems to  work, both on my Mac and iPhone, is that if I just quit Evernote, it’s not protected.  Launching the app opens it up logged on, so anyone who gets onto my Mac or my iPhone also gets into my Evernote without having to log on.  This is too easy an error to make (from a security point of view) and one which I’ve been making unknowingly for months.  

 

So, I think you might want to add an option to your app so that when quitting Evernote one can choose to do so without logging out or with logging out.  Those who don’t want to be bothered with this prompt should be able to opt out of it in preferences, but for the rest of us, security-aware, we could have this work so that either every time we quit we also log out, or we get a choice each time we quit Evernote.

 

Please let me know if this option is already available and I just haven’t seen it, or if it can be made available.  

 

Thanks,

 

FrogPhotog

[JMichaelTX 4,117]

@FrogPhotog:

 

I understand your security concerns, and agree that it would be good for Evernote to provide an option to sign out when quitting the app.

 

However, there are two things you should be aware of:

1. Even if you sign out of EN Mac, all of your Notes are still available via a Spotlight search.
   1. All of the Notes content are stored in text files which are not encrypted.
   2. The best protection for this is to not allow anyone to log in to your Mac with your Mac User ID, and to use a strong PW that you don't share with anyone.  If other people need access to your Mac, create separate Mac accounts for them.
2. Once you have signed out of EN Mac, it will require an Internet connection to sign back in.
   1. So I think the primary reason EN Mac does not automatically sign out on quitting is so that you will have access to your Notes when offline (not connected to the Internet).

[FrogPhotog 0]

I never let anyone use my Mac, and my password is strong.  I'm worried about someone getting into my Mac anyway -- without knowing how that would be done -- and then getting access to my Evernotes.  I hadn't thought of spotlight, thanks for informing me.

 

Is there any way to encrypt the text files created by Evernote?

[JMichaelTX 4,117]

If you want to encrypt files attached to an EN Note, then you will need to do that PRIOR to attaching to Evernote.

There are a number of PDF tools that will encrypt PDFs.

 

For text, See 

How to encrypt text in a note - Evernote

[ScottLougheed 1,316]

If you want to encrypt files attached to an EN Note, then you will need to do that PRIOR to attaching to Evernote.

There are a number of PDF tools that will encrypt PDFs.

 

For text, See 

How to encrypt text in a note - Evernote

This is good advice but just to make very, very clear, this does not in any way encrypt the Evernote note itself. This will just encrypt that specific attached PDF. Any text or non-encrypted attachments other than the encrypted PDF will still be potentially accessible by navigating to the locally stored files on your device's storage. (You can encrypt individual lines of text in notes, but this can be a bit cumbersome to do with every single note). 

 

There is no way to encrypt the database that Evernote makes and stores locally on your device in a way that prevents someone logged into your user account from accessing it. 

 

(You can prevent other types of intrusion by enabling FileVault, which will prevent your Evernote database from being read, unless the intruder has your strong password in hand).

[FrogPhotog 0]

Thanks for the information.  So now the question becomes how hard is it for someone to log into someone else's mac user id?  Or is there a different, safer, way to take notes on a mac?

[JMichaelTX 4,117]

Thanks for the information.  So now the question becomes how hard is it for someone to log into someone else's mac user id?  Or is there a different, safer, way to take notes on a mac?

 

That is a Mac security question, nothing to do with Evernote.

I suggest that you Google "mac security" to learn more.

 

But, in short, if you use a strong PW for your Mac login, never share it with anyone, and take prudent security precautions (like NEVER leaving your Mac open when you're not there), then your Mac should be very secure.  

 

Arguably, Macs are more secure than PCs.  But you have to be a smart user.  Again, do some Googles on things like "how to protect my mac", "security procedures for home computer users", etc.

[MacBill 0]

I use a company Mac so like to keep my EN private, knowing that my computer could be taken at any time.

You can encrypt your data on the mac by creating an encrypted sparse bundle and pointing EN to it by symbolic link.  That works fine for me.  I have created a couple automator routines to check if the sparse bundle is mounted before opening Evernote.  This protects the clear text notes.

The problem is that if you launch EN without that sparse bundle mounted, it will just recreate the com.evernote.evernote folder in the default location automatically.  This is where logging out when you close the app would be helpful.  You can do it manually, but it would be nice if there was a preference to just make that happen when you quit.

On 5/21/2015 at 2:28 PM, JMichaelTX said:

Once you have signed out of EN Mac, it will require an Internet connection to sign back in.

1. So I think the primary reason EN Mac does not automatically sign out on quitting is so that you will have access to your Notes when offline (not connected to the Internet).

By the way, I disconnected and logged out.  I was still able to re-open EN and sign in without connecting again.  Maybe this is no longer the case.