Security
What mdbase stores and can read for each kind of collection, who holds the keys, how access is granted and removed, and the limits that apply.
In every synced collection
Each change is encrypted and signed on the device that made it before it leaves. Changes are encrypted with the collection key using ChaCha20-Poly1305 and signed with the device’s Ed25519 key. mdbase stores the encrypted changes, snapshots and attachments, puts changes in order, and passes them to the other devices. The service that stores them never holds the collection key, and every device checks each change’s signature and permissions for itself.
Apps connect to a copy of the collection over an encrypted session (Noise) that ends at that copy. When the session passes through mdbase’s relay, the relay forwards encrypted traffic and sees who connects to which device, along with sizes and timing.
Cloud copy and Private
| Question | Cloud copy | Private |
|---|---|---|
| Who holds the collection key | Your devices, plus mdbase’s hosted service and key escrow. Their keys are wrapped by a key management service and unwrapped only in memory. | Only your devices, and your account key if you use one (below) |
| Record contents, paths, field names and attachments | Readable by mdbase’s hosted service, which serves apps from its copy | Never readable by mdbase |
| Where apps connect | mdbase’s hosted copy | One of your devices, through the relay |
| A new app permission takes effect | When you approve it in Connect | When you approve it in Connect and one of your signed-in devices records it |
| A new device of yours gets the key | After you sign in; mdbase delivers the key once your account approves the device | After you enter your encryption password or recovery key, or approve it from another device in strict mode |
In both, mdbase can see your account, a collection’s members and their roles, its devices, app permissions, the number and padded sizes of changes and attachments, when they were made, and connection details such as IP addresses. If an app sets reminders, mdbase stores each reminder’s time and a random ID. For a Private collection, it stores no reminder content.
Private collection keys
When you first choose Private, your device generates an account key that your devices share. It shows the key to you once as a recovery key, and mdbase stores a copy locked with your encryption password using Argon2id. mdbase never sees the password or the recovery key. A new device that you sign in gets the collection keys once you enter either one.
Strict mode removes that stored copy. Each new device is then approved from a device you already have, by checking that both show the same six-digit code. The code mixes a random value from each device, and the new device commits to its value first, so a device substituted by someone else would match only by chance, about one in a million per attempt. An owner or editor approves a new member’s first device the same way.
Removing access
Removing a device or member changes the collection key. Changes made after that are encrypted with a key the removed device never receives. A removed device or member keeps whatever it already had, including its copy of the files.
Revoking an app permission ends its sessions. Every copy of the collection stops accepting the app’s requests once it sees the revocation.
Collections with sync off
You can turn sync off for a collection in the desktop app. mdbase then stores none of its contents. Apps reach it through mdbase’s relay to the computer that holds it, while that computer is running.
For these collections, the background service on your computer trusts the
app permissions that mdbase issues. It notifies you when a new app gains
access and keeps a list of apps you can review and revoke. To require your
approval on the computer as well, run
mdbase settings --require-approval on.
Known limits
- mdbase can’t read a Private collection, but it does deliver its changes. Devices assume that mdbase delivers changes in order and hides none. A compromised service that withheld a device removal could keep that device receiving new changes. Devices don’t yet detect this.
- If a Cloud copy collection is changed to Private, content stored before the change stays readable with the keys mdbase held until it is re-encrypted.
- The web apps that mdbase publishes see what they show you. Private protects what mdbase stores and relays, and relies on the app you run being the one you expect.
- If the copy of your account key that mdbase stores were stolen, a weak encryption password could be guessed offline. Choose a strong one, or use strict mode.
- Obsidian plugins run in the same process as the mdbase plugin and have full access to the vault and its collections.
Report a security issue
Use GitHub’s private vulnerability reporting on the mdbase-connect repository. Don’t open a public issue. Include the affected component and version, the steps to reproduce, and the impact, with credentials, paths and record contents removed. Developers building apps should also read the SDK security guidance.