Ente Locker – end-to-end encrypted vault with digital inheritance

General Project Showcase
1

Hi everyone,

I’m part of the team at Ente, the people behind Ente Photos and Ente Auth. I’m excited to introduce our newest product, Ente Locker.

What’s Ente Locker?
Ente Locker is an end-to-end encrypted vault for your important documents and sensitive information - IDs, financial and insurance records, medical paperwork, recovery codes, and the kind of “in case something happens to me” information a family needs but shouldn’t have to keep in plaintext on Google Drive.

What can it do?

  • Store documents and files, plus encrypted notes, audio files, and structured fields for text-based secrets
  • Sync across Android, iOS, web, and desktop, with client-side encryption everywhere, organize into collections, and share via links
  • Create Legacy Kits, and designate contacts who can recover your vault in case you are incapacitated, via a time-delayed request and a Shamir Secret Share mechanism

How does it work?
Everything is encrypted on your device before it reaches our servers. We store only ciphertext and an encrypted master key; the key that unlocks it is derived from your password, which never leaves your device and never reaches us. When you create a Legacy Kit, Ente generates a random secret and splits it into 3 shares using Shamir Secret Share. Any 2 shares can rebuild the secret, but one is not enough. Your designated contacts can initiate recovery, but access is granted only after a delay you set - and you can cancel any request during that window - so recovery can’t be triggered silently against you.

Is it secure?
Ente is fully open source (apps and server) under AGPLv3, on our GitHub. The cryptography - libsodium, XChaCha20-Poly1305 for data, Argon2id for key derivation - is shared with Ente Photos, whose architecture was independently audited by Cure53. For the Legacy Kit feature, the server never sees the kit secret, the shares, or your decrypted recovery key.

Who is behind the project?
Ente is a small, independent team building privacy-focused software. We’re bootstrapped - no VC and no institutional funding. We build products, people pay us for them, and that’s the whole model - we don’t monetize data or serve ads. Our products, Ente Photos and Ente Auth, are already recommended on Privacy Guides.

How much does it cost?
Ente Locker is free up to 100 items and 1GB total storage. You can increase this limit to 1000 items and 10GB total storage with any Ente paid plan. So Locker’s paid limits are included with any Ente Photos subscription, but Locker storage is separate from Photos storage.

How can I get started?
You can download Ente Locker from our website and the app stores, and everything is on our GitHub if you’d rather read the code first.

This is a young product and we’d genuinely value the feedback of this community - on the Legacy Kit design especially. Happy to answer questions on the crypto, the recovery flow, jurisdiction etc. Thanks!

8 Likes
2

Can you add private payments with Monero?

1 Like
3

I think Ente locker has a real opportunity to serve as a way to display documents digitally.

For example, in the US it is common for drivers to store their insurance cards on their phone for display to law enforcement. It would be bad practice to hand your (now) insecure device to another person. I don’t know if technically feasible but a method that would allow display of an electronic document with the phone in a locked state would be great.

There are a few other examples of this, but felt car insurance is the most notable.

As an aside, I still think searching of the content text of a pdf with OCR is long overdue in locker.

I feel these features would allow Locker to distinguish itself beyond password managers.

2 Likes
4

Relevant earlier discussion: Ente Locker - New app from Ente

2 Likes
5

This is an interesting use case (display Locker file in locked state), and one that we hadn’t actually considered to be honest. This functionality already exists within Ente Photos, so should be possible for Locker as well. We will have to assess the scale of the problem this solves. But really appreciate the suggestion!

searching of the content text of a pdf with OCR

This is on the product roadmap :slight_smile:

2 Likes
6

Adding crypto as a payment option is something we want to do for the Ente ecoystem as a whole. Just haven’t gotten to it yet.

4 Likes
7

On Android you can “Pin” an app to lock use of the rest of the system, but it’s not the most secure way. You could have Ente Locker in a separate empty profile with nothing more than the app, but it would still allow user to inspect other content within the app.

1 Like
8

Yes and having open access to an app that is intended to contain your life’s secrets is not really the intent.

9

Great to know you. I frequently land into troubles trying to log into my ente account. The last time was from my duckduckgo privacy browser. The problem has been resolved now.

10

So ente locker is something like the digi locker ?

11

By Digi locker I assume you mean the service provided by the Indian government?

If so, the difference would be that in Digi locker your ID documents are pulled from government databases, while in Ente Locker all the files are uploaded by you. And obviously Digi locker doesn’t have end to end encyrption, because its whole point is for the content to be viewable by the government and approved partners.

All in all, I would suggest they serve completely different use cases.

2 Likes
12

Thanks for being explicit about the fundamental differences. I don’t trust governments/authorities regarding the safety of my personal data. I didn’t even fill up the SIR form, and I would be very choosy when the census people visit my house.

13

Adding to this:

Besides the Android system function to pin the (whole) app, some apps utilize a different function, namely a function to only overlay one screen of a single app.

I don’t know how secure that is, but once you tap the back button, the lock screen comes up, not the app’s previous screen, effectively ending the overlay.

This screen also is persistent across display power off/on until dismissed once.

Öffi/Oeffi, a public transit app, pins only the screen with your transit details when you have said screen open.

Same goes for Catima, a (loyalty) card and codes app, it pins only the screen with the currently displayed code.

@lwb03dc

Maybe worth looking into, if general pinning was considered.

1 Like
14

Noted, cheers!

1 Like
20

Hi,

Ive seen your announcement, but I don’t find a use case for me. Perhaps you could suggest your vision for people like myself ?

I already use a password manager (bitwarden) which has has a account recovery using an emergency contact. The contact can request access to my vault and I have 1 week to cancel it. If I am unable to, they get to access my vault. Bitwarden can allows me to save password, but also notes and attachments to those notes. I can keep any important digital document in those notes.

When I need to share a document securely with a third party, I save it it bitwarden send, which is used to ad-hoc sharing with external contact. I can set a password, expiration time, and maximum number of views to control the reach. 1password has something similar, but while anyone can assess bitwarden link (with optionnal password), 1pass enforce the sharing to a specific email address by sending a code to this email when accessing the note. I use my password manager sharing feature as sending document by email is less secure, document is retained by all email and cache server, while PM (password manager) keep the document e2e encrypted with an expiration date.

I could also share document with other e2e storage server like proton drive, tresorit, peergos. Proton support emergency access, not sure the rest.

In this landscape, where do you place yourself ?

Some thought: Not everyone has a password manager, but those that do might not require this tool. Those that don’t … they might be as hard to convince to use your tool than the PM, and this tool has much less visibility and usefulness on a day to day basis that an PM.

Bitwarden send and 1pass sharing is for ad-hoc but your solution seems to be more about permanent storage until someone is invalid. This is still supported with the PM, but perhaps less document first, and instead notes / registry first. Is your solution document first, ie directly send the attachment/word/pdf asd keep it as a first class member ?
Other thought, having important document available easily on a day to day in the PM might lower the overall security of those document - I do handle this by having 2 PM accounts.

As for the current limit, 100 items and 10gb seems very big. I don’t see anyone using more than this and requiring the paid offering. I’ll let you test if it can be sold.
If someone decide to pay, and they become invalid and can’t renew, what happen to their data ?
While the emergency contact might be activated to get access to this account, will the new owner have access to all documents, even those >100 items and >10gb of a previously paid account that failed to renew (access within reasonable time frame of 1-2 years) ? If your product is mostly for emergency access once invalid, how do you sell a yearly subscription ? I might think I still have a lot of years before passing, and I absolutely do not want an additionnal pay-until-death subscription if the only use is for emergency.

There are other offering than use shamir secret sharing to offer a way to retrieve digital document after death. For example Sun Knudsen offered Superbacked a while ago. I think it was a paid offering (1 time purchase) but he might have changed this in his latest release. I haven’t checked the youtube explanation video recently but if I remember correctly, The idea was to have the key in your will to enable everyone to access your digital documents upon death. Technology was paper first, to give password and other keys to other accounts - so not exactly like your cloud offering. Someone also released an open-source offering similar to Sun called Hyperbacked, as they did not agree with the initial cost, being a deterrent for adoption in their eyes.

Well… this is a long post - sharing similar software and thought but those are only supposition of your goal / offering - perhaps you could clarify how you plan to position yourself between PM and other solutions ?

21

It is, but with some good points raised. In particular:

There are some great products out there - Ente being one of them - but I can’t help but feel NONE of them have taken the best features from each and made it into one offering.

You’ve highlighted the lengths you have to go to in order to achieve what could be a simple task. Ente is getting there and has some great products with some great features. But I can’t help but feel I am still using other products that do the same thing because they have neat features.

1 Like
22

Ive seen your announcement, but I don’t find a use case for me.

That makes sense. If you are already a power user of password managers, you are probably not the target audience. Ente Locker is for those without PMs or for those who feel intimidated by PMs.

In this landscape, where do you place yourself ?

This started off as a digital inheritance product. But to do that, we needed the storage aspect. That’s how Ente Locker came into being. We still need to weigh these two use cases of ‘storage’ and ‘inheritance’ to figure out the correct positioning. Any suggestion?

Those that don’t … they might be as hard to convince to use your tool than the PM

There would be two groups of people who don’t use PMs. One, that doesn’t care about privacy. Two, that finds PMs complicated. That first group won’t use Ente Locker either. But we are hopeful that the second group will. To this end, if you check out the product, you will find that (we think) it appears as deceptively simple.

Loved this post, and really appreciate the thought and effort you put into this!

2 Likes
23

I find this odd to read, really. As the marketing lead I would think you would be asking “what features are not present in a PW manager today, and what features of a PW manager can we do better?”

I don’t think you should resign to having lost the 3rd group, all PW manager users. I would like to keep my passwords in my PW manager and I would like to keep my documents in Ente locker. I just need some features (discussed above) beyond attaching a pdf to an entry.

24

what features are not present in a PW manager today, and what features of a PW manager can we do better

I should clarify that my position is just based on what the product is currently.

There is, indeed, continuous interrogation from the team as to how we can improve Ente Locker, and with improvements I am sure that we will appeal to more different audiences.

1 Like