3 ms·

I'd love to start using Syncthing, but the absence of storage encryption is absolutely a deal breaker. As I understand, it was a planned feature quite a while a

by krick 8y ago

I'd love to start using Syncthing, but the absence of storage encryption is absolutely a deal breaker. As I understand, it was a planned feature quite a while ago, but now it isn't even in the backlog anymore. A pity, really.

mkl 8y ago
It runs on your own devices, which should either be trusted or have their own encryption (it's built into every major OS). Why would additional encryption be useful?
- zorked 8y ago
  The point is exactly running on untrusted devices - get a el cheapo server at some VPS provider and have it backup all your data + serve it from a always-on decent datacenter connection. I've also been waiting for that one feature :/
  - mkl 8y ago
    I see. So it would intentionally not be a live usable copy. I've been using Duplicity going to Wasabi for that purpose - encryption, versioning, etc. One of my Syncthing nodes is an always-on PC at home, so the files sync with other devices whenever/wherever they have a network connection, which is what your encrypted node would do.
2ion 8y ago
That problem is easily solved at other places in the FS stack. Use an crypto overlay like EncFS and sync only encrypted data. Alternatively, even stream encrypted updates to a directory via a gpg job and sync the encrypted blobs. Another layer, but the script would be so simple it'd essentially write itself. While it would be convenient to have configurable encryption on endpoints, syncthing is composable, and thus this issue can be worked around. If you have a platform that doesn't allow you to compose tools easily like Android, that's limited technology.
anotherevan 8y ago
https://github.com/syncthing/syncthing/issues/109 https://github.com/syncthing/syncthing/issues/109 is probably the issue you want to follow. Yes there hasn't been any activity on it for some time unfortunately.
Sir_Substance 8y ago
I wrap my cloud storage with encfs by default: https://en.wikipedia.org/wiki/EncFS https://en.wikipedia.org/wiki/EncFS EncFS is not perfect in that if your adversary has the opportunity to watch your encrypted files updating on the regular they can (allegedly) break the encryption, but they can't do it from a single snapshot. It's a decent protection against an airport sniffing your phone traffic while you're on the public wifi, it's not going to stop the NSA if they decide you're a person of interest. In other words, if this is a concern for you EncFS is an acceptable baseline protection.

by krick 8y ago

mkl 8y ago

It runs on your own devices, which should either be trusted or have their own encryption (it's built into every major OS). Why would additional encryption be useful?

zorked 8y ago
The point is exactly running on untrusted devices - get a el cheapo server at some VPS provider and have it backup all your data + serve it from a always-on decent datacenter connection. I've also been waiting for that one feature :/
- mkl 8y ago
  I see. So it would intentionally not be a live usable copy. I've been using Duplicity going to Wasabi for that purpose - encryption, versioning, etc. One of my Syncthing nodes is an always-on PC at home, so the files sync with other devices whenever/wherever they have a network connection, which is what your encrypted node would do.

2ion 8y ago

That problem is easily solved at other places in the FS stack. Use an crypto overlay like EncFS and sync only encrypted data. Alternatively, even stream encrypted updates to a directory via a gpg job and sync the encrypted blobs. Another layer, but the script would be so simple it'd essentially write itself. While it would be convenient to have configurable encryption on endpoints, syncthing is composable, and thus this issue can be worked around. If you have a platform that doesn't allow you to compose tools easily like Android, that's limited technology.

anotherevan 8y ago

https://github.com/syncthing/syncthing/issues/109 https://github.com/syncthing/syncthing/issues/109 is probably the issue you want to follow. Yes there hasn't been any activity on it for some time unfortunately.

Sir_Substance 8y ago

I wrap my cloud storage with encfs by default: https://en.wikipedia.org/wiki/EncFS https://en.wikipedia.org/wiki/EncFS EncFS is not perfect in that if your adversary has the opportunity to watch your encrypted files updating on the regular they can (allegedly) break the encryption, but they can't do it from a single snapshot. It's a decent protection against an airport sniffing your phone traffic while you're on the public wifi, it's not going to stop the NSA if they decide you're a person of interest. In other words, if this is a concern for you EncFS is an acceptable baseline protection.