The Encrypt project page says, "The module is bundled with three encryption methods," but on a fresh install of the 8.x-3.x version, on the "Add encryption profile" page, the "Encryption Method" dropdown is empty. I see a EncryptionMethodPluginFormInterface and base class in the code, but no implementations. The readme.md recommends the separate Real AES project, which seems to suggest that there are not intended to be any encryption methods included. Supposing that to be the case, I see two issues:

  • There is disagreement in the documentation about what to expect in the core module in the way of encryption methods. I'm guessing that the project page reflects the way things used to work in Drupal 7 and just needs to be expanded.
  • The UI provides no help in the (very probable) scenario where a user's initial setup is not sufficient to actually start using the module. As it stands, there's just a required SELECT field with no values, preventing the user from submitting the encryption profile form but offering no indication of the problem or how to fix it. It seems like there should be some kind of warning message on the configuration screen that informs the user they need to provide an encryption method and informs them of their options for doing so (i.e., downloading another module or writing their own plugin). From a UX perspective, it would probably be best if the "Add encryption method" page were not exposed until it could be successfully used.
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

TravisCarden created an issue. See original summary.

rlhawk’s picture

You're correct about the documentation being out-of-date for Encrypt 8.x-3.x. It was decided to not package any encryption methods with the module, which does certainly pose a UX issue. Your suggestion of displaying alert text and instructions, instead of the profile edit form, when there are no encryption methods available, is a good one. Another option that I have considered is to include the None encryption method from the D7 version, so at least the select field isn't confusingly empty. The former option is probably better though.

geerlingguy’s picture

Agreed on the idea to add some documentation for users who run into this issue—it took me a while to find this issue, and in addition, the Real AES module is currently in an interesting state of 'sorta works if you do some special jiggery-pokery'.

jsobers1331’s picture

Yes I also ran into this issue with no solution so far...

colan’s picture

Status: Active » Closed (duplicate)

Looks like a duplicate of #2811909: Update project page description for 8.x modules. Please reopen if I'm missing something.

This issue is older, but that one already has a list.

bogdan.dinu’s picture

Status: Closed (duplicate) » Active

I would reopen this issue because it is not a project page description problem, it is about the plugin not being usable without a separate encryption provider.
I think the module should provide a default "No encryption" method for testing/development purposes.

terminator727’s picture

same problem, i have installed Encrypt & Key but Encryption Methods are not included... solution?

Cellar Door’s picture

We do not include encryption methods on purpose as their maintenance etc. would cause this module to have to go through unnecessary updates. The recommended module to provide an encryption method is: https://www.drupal.org/project/real_aes as it implements a standards based AES encryption method.

This issue I think is more of a documentation around that decision and providing a warning to the user in the event there is no providers available and point them towards real_aes.

gambry’s picture

I agree with @bogdan.dinu on #6 to provide a simple "No encryption" method.

I'm happy to work on this implementation if maintainers/community are happy with this. We can then change this IS (or work in a follow-up) and close this 2 years old issue.

rlhawk’s picture

Category: Bug report » Task

Including a No Encryption method sounds fine to me.

gambry’s picture

Status: Active » Needs review
Issue tags: +Needs tests
FileSize
1.28 KB

Attached an example of Encryption Method. I'm doing a Prefix other than No encryption because:

  • No encryption would be too simple and not explaining the encrypt/decrypt methods, as they will just return the text
  • Testing a No encryption method may results in false positives, i.e. the method/plugin is not called -> the original text is returned -> test passes anyway.

The only weirdness I see is because the plugin MUST have a key type, but the only out-of-the-box Key contrib key types are Authentication and Encryption. There should be there as well a "None" or "Empty" key type as well, but this is a conversation for the Key issues queue and in short I ended up using 'encryption' as a key type for my encryption method.

Tests are still to be implemented but wondering what your thoughts are.

Manuel Garcia’s picture

Since this is security related, in my opinion we should not provide an encryption method that does not encrypt, unaware users, or users that are not tech-savy might just use it without realizing the consequences.

Furthermore, even if the user knows not to use it, he/she will still be frustrated until they figure out that they need to install real_aes module for example.

Let's fix the underlying UX issue instead. Let's prompt the user to install a module providing an encryption method when there are no encryption methods available.

Manuel Garcia’s picture

Status: Needs review » Fixed

Documentation on the project page has been updated, so this issue itself is fixed.

Regarding the usability issue discuss in #12, please feel free to open a feature request to improve the site builder experience.

colan’s picture

Status: Fixed » Needs work

Some of the items listed in #2811909: Update project page description for 8.x modules are still missing. Can those be added as well?

gambry’s picture

Status: Needs work » Fixed

@colan this issue was about Project Description page mentioning encryption methods available out-of-the-box on D8, while actually there weren't any. It was also proposing one, but the Project Description page has been updated in the meanwhile with the mention to install other contrib to have encryption methods, so technically this is fixed.

I'm with you about #2811909: Update project page description for 8.x modules, but that is another issue?

So closing again.

colan’s picture

Fair enough (that's another issue), but that issue is almost 2 years old, and we're just asking for some minor additions to the project page. If the maintainers don't want to take the time (also fair enough), could they at least add one or more of us as co-maintainers so that we could do it ourselves? I don't believe this is too much to ask. I'm happy to volunteer, by the way. Thanks.

Cellar Door’s picture

So just to confirm the discussion here:

1. The update to the main page where we state that there needs to be an encryption method like Real AES implemented is "ok" but it'd be good to get more language explaining that in greater detail.

2. Updating the list from https://www.drupal.org/project/encrypt/issues/2811909 will help explain more of the modules that implement Encrypt but that doesn't have anything to do with the usability around the module for site builders, which will be in a new task to implement a prompt.

If that's the case, I'm going to open a new ticket to track the UX, and I'll also go in and update the module page for the tasks in the other issue mentioned above. Let me know if there's anything else folks would like to see happen on this topic to make it as easy as possible.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.