Nice features, pretty but expensive, not as private as Boostnote and with a recalcitrant developer

Written: 2018-05-23

Purpose and pricing

Inkdrop is an attractive-looking, multi-platform note-taking app primarily aimed at software developers, although suitable for others as well. It's closed source and costs USD $60/year (although you get 60 days free at the start). Students get a 60% discount for 12 months, but this entails sending your ID to a complete stranger (not advisable!).

Security and privacy

I have previously written positively about Inkdrop, primarily because the market is desperately short of note-taking apps that use end-to-end encryption for protecting people's data. (Standard Notes and Turtl perhaps the only other viable contenders.)

My correspondence with the developer led me to believe that he was implementing end-to-end encryption, but this turns out not to be the case. At the very least, information in Inkdrop's website is inconsistent. On the Security page, we are told:

All your notes stored on disk in the Inkdrop database will be encrypted with a common key which is a 256-bit AES key generated when you sign up to Inkdrop. We use this key, along with an initialization vector, to encrypt your data in GCM (Galois/Counter Mode). The key is also encrypted while stored on disk, with a 256-bit AES key derived with PBKDF2 from your login password... We never store a copy of this common key without encryption and don't use any escrow mechanism to recover your encrypted data. This means that if you forget your login password, we cannot recover your data and we can't even reset your password.

But, then, this on the Inkdrop forum forum:

The data encryption & decryption always happen[sic] on the Inkdrop servers. So when encrypting/decrypting, the servers have to look into your data in plaintext.

All this amounts to no end-to-end encryption, and contradicts what the developer described to me by email. He isn't able to look at your data, but the servers that are used are. This means your data is not fully secure from prying eyes; encryption does not happen locally on your computer. And therefore, I withdraw my recommendation to use Inkdrop as a privacy-conscious note-taking app. Server-side encryption is better by a long way than what Evernote "offer", but it's no better than something like Dropbox. In the same sense that locking your house and leaving the key under the doormat is better than nothing but not as secure as taking the key with you.

Lack of clarity about Inkdrop's privacy practices have attracted questions on their forum. This is not acceptable. If you are in the business of storing or syncing people's data you should be crystal clear what they can expect. Some of the confusion appears to come from the developer failing to explain himself in layman's terms. For example, he assumes non-technical users will understand how an encryption key is encrypted with a password.

Also, as we learn here, data is stored on US servers. Given that Inkdrop admits the data touches the servers in an unencrypted format, it means that user data spends at least some time on US servers, unencrypted. That's very, very bad for privacy, not least because of the US legal system, which is able to sequester that kind of data for use by the NSA and other three-letter agencies.

Features

Inkdrop's primary advantage are:

• genuine multiplatform support (Win, Mac, Linux (.deb only though), iOS and Android)
• it claims to store your data end-to-end encrypted (which is infinitely better than anything like Evernote or OneNote do for your privacy and security)
• smooth markdown support, including shortcuts (e.g. "Ctrl + 4" = ####).
• extensible via a handful of plugins
• instant search and note tagging
• notes can be published online (a public link is created so outsiders can view - but note edit - the note online)

Inkdrop has made some progress in the past 12 months. However, on closer inspection, I think there are some considerable deficiencies that make its $60/year price tag difficult to swallow (the encryption concerns notwithstanding):

• Editing in the mobile (Android) version is inconvenient and under-developed. By contrast Boostnote which is also open source and free (as in beer), has a much better mobile interface for writing notes.
• It is impossible to attach non-image files to notes. Many users would find this hugely useful and have asked for it on Inkdrop's forums (e.g. here and here ). The developer is adamantly opposed to this. His argument is that allowing, e.g., pdf file attachments will then lead to a sort of 'mission creep', where users then will ask for pdf editing tools to be built in. And so on, until the app is bloated, like Evernote. In my opinion, this is an inconsistent argument. Clearly, the developer thought allowing images is ok without worrying that users will subsequently demand image editing tools until the thing looks like Photoshop. A note taking app should, ultimately, be versatile for things related to notes. Notes for a meeting, for example, might require an attachment (like calendar events might have). It's not so much to ask for. The developer additionally says that Inkdrop is a note-management app, not a file-management app. Online calendars are also not file-management apps, but they do allow attachments. So the resistance to this feature is just silly and it limits the prospects of Inkdrop becoming more useful. Boostnote, by contrast, already allows non-image attachments. In the long-run, you can expect Boostnote to win the usefulnes race with Inkdrop, not least because its open source nature is already allowing many developers to contribute.
• The Inkdrop roadmap for 2018 seems meek.
• The developer seems quite iOS/MacOS oriented, and I'm not sure Linux is his priority. I advise him to make a flatpak, snap or AppImage version of InkDrop to minimize the effort in making sure as many Linux distros as possible can use the app. However, given the privacy/security shortcomings, I don't really know if I would encourage the widespread dissemination of Inkdrop. I think Boostnote is more likely to be the future.

Advice to Inkdrop

Don't want to lose to Boostnote? Do this:

• implement end-to-end encryption for proper privacy and security
• enable non-image attachments (we all know that doesn't mean adding features to bloat the app)
• Distribute Inkdrop via Flatpak for Linux
• Add a usable editor to the mobile versions

Without this, it's not worth $60/year. It's just not.

The search for the perfect note-taking app is finally over. It's elegant, well designed, simple, and functional.

• beautiful interface
• markdown is formatted as you type
• backup to your local computer
• sync between your devices
• export notes to files
• tags and multiple notebooks
• advanced search filters
• privacy: transport and data at rest encryption
• extensible with user provided plugins
• use your own servers!
• good documentation

Cool UI, developer very quick to respond to bugfix and fix them.
Only downside is the lack of a web version.

This is what I have been looking for - Markdown note-taking app which can (almost) replace Evernote. Enthusiastic, committed developer with a realistic approach to the business model: charging a reasonable fee means higher probability this product will survive (and evolve). It's an Electron app, so a little slow to start. Would like to be able to access/edit notes in Chrome browser, but overall this is a great product.

Needed a dedicated place for code snippets / Math based notes / install guidelines, etc. The most important thing for me is that it followed githubs conventions for markdown. So I can copy paste my notes straight to a .md file.

It is a much better alternative than boostnote in my opinion. Boostnote feels disjointed since its made as an open source community. Inkdrop right off the bat felt intuitive and easy to use. You can tell its made by one developer just by using it. All the native hotkeys are well thought out. I find myself agreeing to all the decisions and choices the solo developer of this app has made.

[Edited by Kagerjay, May 14]