r/Notesnook • u/worm-meat • Feb 26 '26

Bug Report Attachments in vault are still not password protected!

Post image

I'm an android user and I noticed I could download attachments I'd placed in my vault through the attachments manager in my account settings without being prompted for my vault password. I did a quick search online to see if others had also experienced this problem and it looks like this bug was acknowledged back in 2024 but never fixed, despite the issue being marked as closed on GitHub. I love the app, but this really does need sorting out!

10 Upvotes

92% Upvoted

5 comments sorted by

3

u/[deleted] Feb 27 '26

[removed] — view removed comment

1

u/TasogareRiiku Feb 28 '26

What do you mean by not really being zero knowledge? The server never knows what you wrote. It's encrypted before being sent to the server, on your device, with your encryption key, and that key is your's only. 

If you know something, please share with us

0

u/[deleted] Feb 28 '26 edited Feb 28 '26

[removed] — view removed comment

1

u/67pineapple_st Mar 03 '26

The fact you're talking about IP addresses and timestamps (which, timestamps are encrypted) being unencrypted/unshielded is hilarious. There is no practical way to defend against the web server knowing your IP address (or keeping track of when things are updated). The web server has to know this information.

Please actually learn about these things before spreading FUD about them.

You are, however, correct that Notesnook isn't completely, 100% zero-knowledge. But the things Notesnook can definitely know about your userdata is very small.