Encrypted Sync Service

Overview

• The Encrypted Sync Service (ESS) is the easiest way to sync your Everdo data across multiple devices.
• Each device still maintains a full local database of the data and is capable of working offline for any period of time.
• When online, each device sends data updates to the Sync Service, which keeps track of them and passes changes to other devices.
• The transmitted data gets encrypted on the client side and the encryption key is never shared with the Sync Service. See what data is encrypted and how to learn more.

Creating a sync account

To connect your devices to ESS, you will need a user account that will store the encrypted data. To create an account, go to sync.everdo.net/signup and complete the sign up process.

Make sure to verify your email address by clicking a verification link in your email inbox. You should see the Active status in your ESS account before trying to configure your devices.

Configuring sync in the desktop app - automatic setup

1. Run Everdo and click Setup Sync at the top of the application window.
2. Choose Encrypted Sync Service and proceed to sign in with your ESS username and password.
3. Once signed in, follow the rest of the steps until you see a confirmation message saying that configuration is complete.
4. If you need to setup a mobile device, press Pair Mobile Device and follow further instructions on then screen.

You can always pair another mobile device from Settings->Sync->Pair Device.

Configuring sync in the desktop app - manual setup

The following manual steps are equivalent to the automatic setup described earlier.

First, sign in.

1. Open Everdo, go to Settings->Sync.
2. In Mode, select Encrypted Sync.
3. Enter your ESS account credentials to sign in.
4. Optional: In Device Name, enter a label for this computer that will make sense to you later on.
5. Click Sign In.

Once you have signed in, the next step is to set up an encryption key for your data.

When in Sync Settings, notice that an encryption key (passphrase) has already been generated for you. You can see it in the Encryption Key textbox. This key was chosen randomly, so it is safe to use. However you can also modify it if needed.

Setting your own encryption key is possible as well. You must create a 16-word passphrase using the Niceware list. If you use a word that is not in the list, or a different number of words, then the key will not pass validation, because a 256-bit key is required.

Once you have set the encryption key, click Sync to initiate sync. You should then see the Status label change to Synced in a few seconds. Finally, press Apply to save the configuration.

Quick pairing of mobile devices

Once your desktop computer is syncing successfully, you can use it to easily configure your mobile devices.

1. In the desktop app, go to Settings -> Sync -> Pair Device -> Begin.
2. Follow the instructions until you see a QR code.
3. In the mobile app, go to Settings, change Sync Mode to Encrypted Service or ESS Integration, press Quick Pairing.
4. Scan the QR code, confirm the pairing request and wait until you see a success message in the mobile app.

After the pairing process your device will be syncing automatically.

Configuring ESS sync on a second/third computer

To configure a second computer you need to bring the encryption key from your first computer, as opposed to generating a new one.

1. Sign in to ESS, as described earlier on this page.
2. Enter the Encryption Key.
3. Press Sync and make sure that the Synced status appears.
4. Press Apply to apply and save the configuration.

Configuring ESS sync in the Android app - manual setup

1. Go to Settings
2. Tap Sync Type, select Encrypted Service
3. Tap Encrypted Service: Manual Setup, then Sign in to sync
4. Use your ESS username and password to sign in.
5. Tap Encryption Key and enter the correct encryption key.
6. Exit settings and try to trigger sync by swiping down the view.

Once you have have verified that sync is working, you can enable Auto Sync in settings.

Configuring ESS sync in the iOS app - manual setup

1. Go to Settings
2. In Sync Mode, select ESS Integration
3. Tap Manual Setup->Connect
4. Use your ESS username and password to sign in.
5. Tap Update Key and enter the correct encryption key.
6. Tap Sync Once and observe the status.

Once you have have verified that sync is working, you can enable Auto Sync.

Manual sync actions

In some cases it may be necessary to manually trigger a sync action to fix a data discrepancy between devices, particularly when transitioning between local network sync and ESS sync, or when switching to a different ESS account.

The manual actions described below are available in sync settings.

Push

Copy all items and tags from the device to ESS, making ESS data completely match the local data.

Force Push

Same as Push, but also forces ESS to accept data encrypted with a different encryption key. This is necessary after changing the encryption key, otherwise ESS will reject the sync request and report a key mismatch error.

Pull

Copy all items and tags from ESS to the device, overwriting any conflicts. A pull does not remove any items on the device, unless they have been explicitly removed on another device. This means that a pull does not necessarily bring the state of your device to exactly match the ESS data.

Clean Pull

Re-create the local database from scratch and pull all data from ESS. This action is useful to make the state on the device exactly match ESS data.

Proxy server settings

In order to specify an HTTP proxy for ESS connections, add the following line to config.json, which is located in the home directory. Replace user and password with correct values.

{
  ...,
  "proxy": "http://user:password@1.2.3.4:12345",
}

Troubleshooting

The encryption key mismatch error

This means the device is not configured with the same encryption key that has been previously used to sync with ESS. ESS detects a change in encryption key and rejects such requests because they cannot be merged with existing data.

1. Open Everdo on one of your computers that has complete data.
2. Go to Settings->Sync, press Sync and notice the status.
3. If the status indicates encryption key mismatch, then press Force Push to override all data in ESS.
4. Press Show Key and transfer the key to your other devices.

SSL errors when trying to sync

If you are behind an SSL proxy on a trusted network, you may need to use the Ignore SSL Errors switch in the sync settings dialog.

Sync removes tags from items

ESS is missing some of the tags that you have on your device. This is probably because you have migrated from local network sync to the ESS sync. You need to perform a manual Push in order to fix this data discrepancy.

ESS sync FAQ

Q: Once I start using ESS, can I go back to local network sync?

Yes, it’s just a matter of re-configuring your devices. See local network sync guide.

Q: How does ESS know which encryption key is used or when it changes?

ESS never actually sees your encryption key. Instead, your devices compute a cryptographic hash of your key and send it with each sync request. This provides enough information for the Sync Service to tell one key from another. However such hash does not reveal the key itself and cannot be used to reconstruct the key.

Q: Which parts of the data get encrypted and how?

The title and description of all items and tags are encrypted with AES256-CBC. This is what an action’s title looks like when encrypted:

1.EoCd6AP5LeGP937S3Mi31g==.kFdPOGCP7e+Z8sAl4wcesADJY54TQULqmmUETq2QWHY=

The metadata properties such as modification timestamps, parent-child references and item types are not encrypted. These properties are necessary for conflict resolution and optimizing the syncing algorithm.

A 16-word random passphrase from a 65536-word list is generated on your computer and is used to represent a 256-bit encryption key. The passphrase is stored on each synced device so that it can work the encrypted data. The passphrase is never sent to ESS, but a cryptographic hash of the passphrase is tracked by ESS to avoid data corruption caused by mismatched keys on different devices.

Q: Is data stored in encrypted form on my devices?

Using ESS sync doesn’t change the way Everdo stores data locally. That is, the data only gets encrypted immediately before being sent to ESS. It does not make sense to store encrypted data on your own device since the encryption key is stored right next to it anyway.

Q: What happens if I lose the encryption key?

The encryption key is stored in the encryption-key file located in Everdo home directory. Even if you lose it somehow, it’s not a problem, as long as you still have the local Everdo database available. You can then generate a new encryption key on your computer, update all devices to use it and use the “Force Push” action to tell ESS to accept the new key.