After some pondering, procrastinating, planning, and development, LiberaForms now comes with End-to-end encryption built in. Yeah!
This means that form answers are only known by the participating parties. No leaks!
Everything E2EE happens on the client and to achieve that LiberaForms imports OpenPGP.js, a library that fits our needs very well indeed.
As expected, private keys never leave the client and users must take responsibility for the safe keeping their key.
Because the server cannot read a form's encrypted answers, some form features are disabled, like sending confirmation via emails. But a part from that, E2EE integration is seamless. :)
Encryption is enabled on a form to form basis. SysAdmins set the E2EE_MODE to make E2EE either optional, required, or disabled.
We are publishing this release candidate in the hope you may evaluate it before the definitive release.
LiberaForms 4 will come with end-to-end encryption built in using OpenPGP.js. :D
Before releasing we would like to test our implementation of OpenPGP.js in general and especially test using different browsers (Safari, Edge, etc).
If you would like to help, we kindly invite you to create an account at dev.liberaforms.org and use the new E2EE features, starting with your PGP key pair.