Ask HN: End-to-end encrypted online spreadsheet tool

9 points by kanjus 7 years ago | 6 comments

I'm trying to identify end-to-end encrypted alternatives to the tools used by an NGO I work with that deals with sensitive data.

Tools for cloud storage ([Tresorit](https://tresorit.com/)), email ([Protonmail](https://protonmail.com/)), instant-messaging ([Signal](https://signal.org/)), collaborative text documents ([CryptPad](https://cryptpad.fr/)), collaboration between teams ([Keybase](https://keybase.io/)), hard drive encryption ([VeraCrypt](https://veracrypt.fr/)) abound, they're free, easy to use, secure, and overall amazing.

The one obstacle I haven't been able to tackle in several days of searching is an alternative to Google Sheets, a secure online spreadsheet with end-to-end encryption and collaborative editing, like what CryptPad (https://cryptpad.fr/) does for Google Docs.

Is there a ready-made alternative, or do I need to build a custom solution?

tptacek 7 years ago |

Why are you trying to encrypt online spreadsheets? It's very unlikely that you're going to get much operational security out of the encryption features in a spreadsheet application; you will get far more security out of careful use of sharing and authorization controls, which are things you can get from Google Docs and not so much from other platforms.

Remember too, if the tool you're looking at works entirely in a browser, without an extension (sometimes even with an extension!), it's not "end-to-end encrypted"; it's as encrypted as the server wants you to be as you run it.

kanjus 7 years ago | |

I should have specified my threat model above, I'd ideally want zero-knowledge encryption on all tools, since Google is a threat in my model: assume that the NGO has a database of whistleblowers that needs protection

colejohnson66 7 years ago | |

Even if the encryption and decryption is done client side like with Mega?

ekiru 7 years ago | | |

Yes, the server can straightforwardly, any time you load the application, serve to you (including to specifically you, a single target, making it much less likely to be noticed), a modified version of the JavaScript powering that client-side encryption which will send the plaintext off to the server.

kanjus 7 years ago |

Cool, I've found a future alternative, from no one else but the CryptPad team: spreadsheets are among their [goals][1], but will require quite a lot of time and funding, I'm continuing to look for a current alternative, but this is great news

[1]: https://blog.cryptpad.fr/2018/07/13/CryptPad-Roadmap/#Goal-1...

soneca 7 years ago |

Not sure you need it (and not ready yet), but I am including e2e encryption into my 1:1 meeting note-taking app: https://www.oneonemeeting.com

I am working on the feature right now, but as it is still a side-project, it will take some time.