Since the ability to store DC keys privately has been removed, is there any reason to keep years of messaged encrypted on my email server?
In the past, using a workaround a user could restore lost messages or profiles by loading their keys into a fresh DC instance, moving messages on their email server into Inbox and having DC pull decrypt and pull them down again. We no longer seem to have that ability.
So a lost phone without regular backups means all messages are lost even though they are sitting on the email server encrypted?
Backing up multiple profiles (especially old ones that are many GB) is a pain in the a$$.
My questions are:
is backup the only way to get messages back if a phone is lost? Or is there a better method?
is there any point of keeping encrypted messages on the server if they will never be able to be decrypted in the future?
I don’t think that storing encrypted messages on your server was ever recommended by DC. Multi-device already works without it and chatmail servers will also promptly erase them in a timely manner.
I know that storing on the server was never recommended, but the messages were always there. My problem is that my main DC profile (must be close to 10 yrs old) is HUGE and backing it up semi-regular is a huge waste of time, so it does not get done. I worry about losing my phone, so I have to maintain a 2nd device to keep my messages safe. In the past I could restore from the email server … but now can’t. I use my own email server and I don’t believe any messages are being erased.
Your scenario is exactly what I worry about … and in the past (before you were a user apparently) there was a way of repulling messages that were left on the email server. But that is no longer possible, so a better backup (or more appropriately called a recovery) system should be considered. Thanks for your thoughts!
Yes, the only “supported” way to keep a backup is to have a second device or export a backup. Exporting only the key, then importing it and make Delta Chat read the messages from the server by moving all the messages to another folder and back might work as a hack, but it is not even clear if it works well.
In the future with Autocrypt2 and reliable deletion (“forward secrecy”) the goal is to make it impossible to even decrypt old messages and storing old keys/backups is going to undermine security as keeping old keys around still allows to decrypt old deleted messages, e.g. “disappearing messages”.
Generally if you want a backup of the messages, having a second device or regularly making a backup of the messages themselves and not just the keys are the only options.
Then there is no point keeping encrypted messages on the server longer than enough for all your devices to receive them. If you have a single device (multi-device mode disabled), messages are deleted immediately. With multi-device mode the messages are currently not deleted at all. Chatmail relays also delete messages automatically.
Generally, having a backup and not testing that you can restore is not a good idea. I don’t have full overview of what might break if you try to restore 10 years of messages from the server in this way, there are likely some compatibility issues as old messages will not be handled by the new version in the same way.
One example of what might break is that if you import a contact from a vCard, then send two messages to the new contact and delete the first message, the server will not even have the contact key stored in any message so by “restoring” from the server you will end up with the contact for which you don’t have the key and will be unable to send another mesage.
Smarter people than me need to work on this I guess. lol. Massive backups are a problem for long time users and keeping a 2nd device laying around to provide a backup is probably the worst solution as it increases the risk of theft.
Idea: for my use, the desktop client is the system being backed up by my regular processes (restic et. al) - the data is stored in a classic filesystem method (at least on Linux) - there’s a SQlite DB and then all the referenced attachments in a subdir next to it (dc.db and dc.db-blobs/) along with a myriad of other data sitting in ~/.config/DeltaChat/. (friendly to file based backups instead of one giant enormous blob).
Spirit being, running it on my second device (laptop) fits into an existing mental model and doesn’t require any extra work beyond making sure my normal laptop backups work. The entire directory can then be restored whole-scale, etc. without needing the app to help. My chat contacts are doing the same, mobile and desktop are paired / used together so they get the benefit of laptop backups doing the work.
FWIW, Signal recently changed their on-mobile backup format as well - it used to be one monolithic export of everything every night (ugh), now it’s a DB with just msgs, all attachments are stored externally. Exactly what DC is already doing on our desktop filesystems.