OmniFocus Sync Encryption: Gory Technical Details!

Congrats on shipping! This is a big deal and an example that I hope the rest of the indie software world follows.

A question now that this is out in the wild: it appears as though the database is encrypted using the sync password, yet that password is stored on the Omni Sync server. As an encryption-implementation-luddite, are there any vectors to attack the encrypted OmniFocus data by way of capturing the login info to the Omni Sync server? Wouldn’t it be safer / better to have a separate encryption key for the the database vs. the password for the sync server?

For sure! Separating the sync and encryption passphrases is on our roadmap for this reason.

OmniFocus 2.16 for iOS is now in TestFlight, with support for an encryption passphrase independent from your sync account password. (It also supports 1Password, so you can keep track of those two passwords more easily.)

3 Likes