4 ms·
Sure, but the tried and true way to encrypt your NAS would probably be using full-disk-encryption, not something specific only to syncthing.
by hamandcheese 3y ago
Sure, but the tried and true way to encrypt your NAS would probably be using full-disk-encryption, not something specific only to syncthing.
- ephbit 3y agoIf someone manages to access the running raspberry pi though, FDE doesn't protect against that, while the Syncthing's untrusted device encryption does.
- hamandcheese 3y agoIf your threat model includes someone willing to break into your house, then, well, good luck. [0] [0]: https://xkcd.com/538/ https://xkcd.com/538/
- jsiepkes 3y agoThe threat model described by the post above you is actually not about physical access. It's about the PI getting hacked remotely. If you use Syncthing's encryption then at no point is the decrypted content available to the PI. It gets decrypted locally by other Syncthing peers after they have downloaded it.
- hiq 3y agoBesides, there's still a difference between physical accesses: plain and non-targeted (besides how profitable they're expected) burglaries are way more common than violent targeted attacks meant to extract a secret from an individual.
- hamandcheese 3y agoAre you aware of any non-targeted burglaries where the burglar extracted secrets from a running computers memory?
- hamandcheese 3y agoAn attacker with a wrench will get the information they want from you, regardless of where it's located.
- grotorea 3y agoMaybe a better example might be wanting to use a smartphone as the always on sync endpoint. The phone can easily be stolen but with this feature it won't contain the valuable data.
- kevincox 3y agoIncluding if some other service on your Pi gets compromised. They still won't get access to your synced data.
- plagiarist 3y agoHow do I start the NAS up, SSH in and type the password?
- yjftsjthsd-h 3y agoYou send it a WoL packet[0], use key-based SSH to log in to the initramfs environment[1], and type in your password. Or if you have a TPM you can just stick encryption keys there. Do note that if the device lacks secure boot or such, this is vulnerable to an attack where the initramfs is modified to steal your password; how bad this is depends on your threat model. [0] https://en.wikipedia.org/wiki/Wake-on-LAN https://en.wikipedia.org/wiki/Wake-on-LAN [1] https://askubuntu.com/questions/1269981/unattended-headless-ubuntu-server-with-disk-encryption-how-to-set-it-up https://askubuntu.com/questions/1269981/unattended-headless-...