That’s complicated to do correctly. Normally, for the server to verify the user has the correct password, it needs to know or receive the password, at which point it could decrypt all the user’s files. They’d need to implement something like SRP.

What I proposed is that the server does not know the password (of course), but that it knows a thing derived from it (lets call it the loginSecret) which the client can send to obtain the encryptedMasterKey. This can be derived in a similar fashion to the keyEncryptionKey (eg, they could be different outputs of an HKDF). The downside to the server knowing something derived from the passphrase is that it enables the server to do an offline brute force of it, but in any system like this where the server is storing something encrypted using [something derived from] the passphrase the server already has that ability.

Is there any downside to what I suggested, vs the current design?

And is there some reason I’m missing which would justify adding the complexity of SRP, vs what I proposed above?

The only reason I can think of would be to protect against a scenario where an attacker has somehow obtained the user’s loginSecret from the server but has not obtained their encryptedMasterKey: in that case they could use it to request the encryptedMasterKey, and then could make offline guesses at the passphrase using that. But, they could also just use the loginSecret for their offline brute-force. And, using SRP, the server still must also store something the user has derived from the password (which is equivalent to the loginSecret in my simpler scheme) and obtaining that thing still gives the adversary an offline brute-force opportunity. So, I don’t think SRP provides any benefit here.

They’d need to implement something like SRP.

Update: I contacted the developers to bring my comment to their attention and it turns out they have already implemented SRP to address this problem (but they haven’t updated their architecture document about it yet).

Yes, but not really. You can have multiple users but not multiple libraries.

I think if you pay them like 80€ per year or something.

If you need/want a robust multi-user experience, specifically with private personal library support, then Photoprism isn’t going to work, unfortunately.

• Free:
  • You can create multiple Admin users in the free version, but they all can see and delete everything (unless you don’t give Photoprism delete access)
• Paid (Essentials or Plus)
  • you can create “User” users who can upload photos - but they still have access to your full library
  • you can create “Viewer” users who can’t see private photos (but they also can’t upload photos).
  • you can share links to albums that are viewable by anyone with the link

I’ve been using it single user and it’s been great, though I should add the caveat that I upload my photos to my server using Photosync and don’t give Photoprism write/delete access to my library, so no uploads come from it. I had been using Photosync for years before even hearing about Photoprism so it just fit very neatly into my existing process.

Multi user features are effectively paywalled and not technically FOSS due to not allowing commercial use, but roles are documented at https://docs.photoprism.app/user-guide/users/roles/ and there’s more info at https://docs.photoprism.app/user-guide/users/libraries/

If Photoprism Plus/Essentials features could work for you, but the ongoing subscription is an issue, then you should know that - unless this has changed - you can sub for one month on Patreon or Github, use the info they provide to upgrade to using the Essentials or Plus features, and then cancel the subscription. I still have an ongoing one but I didn’t connect it to my Patreon account or anything so I don’t think anything would change (except for me no longer getting support, if I needed it) if I canceled it.

oh ok. Haven’t thought about it like that. Makes sense

That’s to launch the docs…

lol I want some of them served publicly. And at some point I want to do other processing of the contents of photos.

I have absolutely no opposition to the existence of an end to end encrypted photo service. If the process of adding new devices is easy enough, it’s what I’d want from someone else hosting. But it’s not what I need for personal hosting.

Which, again, is fine. There’s absolutely a place for it. But the dude we’re responding to is acting like not doing it is a liability when there’s very good reason not to. (I think it’s because of platforms trying to muddy the water of what end to end encryption means to pretend they do it and confusing him.)