For the more privacy-conscious community, cloud services like Dropbox aren’t particularly appealing. I understand though that support for alternative open-source, zero-knowledge platforms is an unrealistic request, as most users are fine using something like Dropbox and implementing integration with another cloud service would be a complicated, time intensive task.
One workaround that might be feasible though is giving users the option to protect their Scrivener projects with a password, not unlike Microsoft giving users the ability to password-protect individual Word documents, or Apple allowing you to quickly encrypt individual notes with a password - something that works in tandem with iCloud note sync (here’s a quick iCloud security overview - support.apple.com/en-us/HT202303).
As the world as a whole becomes more and more privacy-conscious and encryption becomes more commonplace across a variety of different apps and services, I think this would be an awesome feature, and would make more privacy-conscious users feel much more at ease when uploading their Scrivener projects to Dropbox
Since .scriv files on the Mac are packages, password protecting them isn’t really an effective security measure. Anyone with a little motivation and knowledge would just open the package and look at the RTF files inside without even opening Scrivener.
If you’re concerned about the security or privacy or your .scriv files, you should look into encryption. You can either encrypt entire volumes (like a thumb drive) or encrypt file-by-file. There are many apps available on Mac and Windows for either solution.
Scrivener shouldn’t be handling this. If you value your privacy enough to want password protection, you should value it enough to use software whose primary purpose is data security.
The other advantage of using outside software is that you could implement it today, and your work would be safe.
No, it’s actually not. You’d have to password protect an entire directory structure, not just an individual file, potentially including aliased research files located outside the project folder, plus all of Scrivener’s own automatic backups. But you’d have to protect the individual files in that structure, too, otherwise backups taken by other software might include unprotected copies of the individual files. And the mechanism would have to be robust enough to work (again, for the entire folder structure) across multiple computers and platforms, while not impeding Scrivener’s functionality or performance in any way.
This. The “trivial” solution might make you feel more secure, but would only guard against equally trivial attempts to access your files.
If you have a privacy concern, rather than a true security concern – for instance you don’t want family members snooping around in your diary – the best, easiest, and most immediate solution is to create a separate user account with a strong password that only you know.
Yes, Katherine and popcornflix have hit the nail on the head. We do get frequent requests to password-protect Scrivener projects, but it’s not like password-protecting a single file such as a Word document, which can be encrypted. As Katherine and popcornflix point out, a Scrivener project is not a single file but a folder full of many files. That entire directory would need encrypting, and it would need decrypting on read. That is far from simple. Would each file be decrypted as it was needed? Or would an entire (possibly huge) project directory be encrypted and have to be decrypted as a whole on project open?
Adding password-protection so that no one can easily access a project by double-clicking it wouldn’t be particularly difficult, but it would give a false sense of security, given that anyone with computer know-how could, as popcornflix says, get access to the data in your projects (and it would be no protection from Dropbox).
Note that Ulysses has the same problem - it provides a library of files, and although it provides basic password protection to keep work away from prying eyes, the Ulysses guys make it clear that this is not the same as encryption: ulyssesapp.com/kb/password-lock.
Mac users: you can create an encrypted disk image to store Scrivener projects. AFAIK, it works without problems, especially if you are only working on macOS and not syncing to iOS devices.
After reading this reply and all of the others, I think I understand now why password protecting Scrivener projects isn’t as simple as I thought. I already use third party tools to encrypt my files before putting them in the cloud for backup purposes, but the issue is that doing this with .scriv files would break Scriveners ability to sync properly with Dropbox. Do you think there’s a chance that other more privacy-conscious cloud platforms (or self-hosted platforms) besides Dropbox will be supported in the near-ish future? I would love to be able to use Scrivener on my iPad, but as it stands right now, I simply do not feel comfortable doing so. Dropbox isn’t a very good option for cloud storage if you care about privacy. There are other cloud platforms, like Sync, that claim to function almost identically to Dropbox but in a zero knowledge way, and even iCloud seems to be more private than Dropbox.
That could be an option, although I’ve heard that doing this can be a real headache. Does this mean no other cloud platforms besides Dropbox will be supported in the foreseeable future though?
This may be worth some more research, as I think this could be easier than you surmise. Pages has the same multi-file package structure as Scrivener and provides transparent encryption by simply packaging as an encrypted ZIP archive.
Files in an encrypted ZIP archive can be listed without the need to decrypt every file, so there is no barrier to Scrivener’s existing functionality. Scrivener can ask for the password to an encrypted project upon open, then decrypt individual documents on the fly as they are accessed, fitting with its existing memory management model.
Basically if Scrivener reads its folder structure as a ZIP archive you get encryption for free, and smaller disk footprint. This may also solve your issues with iCloud sync.
A zipped package would not work for Scrivener at all. Programs that use zip file - such as Pages and Word - are able to do so because they read the entire file into memory and load and write the entire file out to disk on save. Scrivener does not do this, but instead reads each file as it needs it and writes each file inside the package without affecting any other files. This reduces the change of corruption and allows for large projects.
The code you link to is very old and uses deprecated APIs; even so, it could only show the contents of a zip file, not manipulate them on the fly. There are no frameworks or technology on the Mac that allows you to work with files inside a zip file directly. The only way would be to extract a file to a temporary location and write it back into the zip file occasionally, which is not optimal and would break many things in Scrivener. It would also increase the risk of corrupted projects, because a bad write to the zip file could result in a corrupt zip file and thus a lost project, something that could never happen with the current folder structure approach.
Using a zip package is something we have thoroughly explored (the above is just a snapshot of a couple of the problems involved - it goes much deeper) but I’m afraid it is just not a viable option for Scrivener.
How about password protect the whole application? Like, use a Master password for the Scrivener application instead of password protect individual projects. I would also like the password protect feature. It is a little difficult when someone shares their laptop with someone else. For ex. a friend or even family member.
I haven’t tried it specifically with Scrivener, but with the Mac APFS file system (High Sierra and later) it’s easy to generate an additional volume on a disk (disk utility). Beauty is it can be individually password protected and unlocked either at boot, or by mounting. It Co-exists with the normal Mac volume and size adjusts as needed. No need to mess around adding partitions. I use this feature to lock specific work related confidential info on the encrypted volume. The apps are all in the usual place, just the data folders reside on that volume. Due to the confidentiality and corporate rules on handling data on non company owned equipment I mount the volume to work on those files, then unmount on close.
Not aware of same functionality built in to Win, though do recall using a 3rd party program to dynamically manage partitions. Way back in the Win dark ages.
Don’t quote me, but in 40+ years in computers I don’t recall a password protect for launching an app
