Hacker News Reader

Comment by StavrosK | Hacker News Reader

Given how rock-solid Syncthing has been, I wonder how hard it would be to bolt encryption onto it so anything that some specific nodes receive is always encrypted.

View on HN

It has been requested since at least 2014 [0] and it just sounds like it isn't going to ever be a feature of Syncthing.

The ability to have untrusted nodes is the one feature that has kept me using Resilio Sync.

[0] - https://github.com/syncthing/syncthing/issues/109

It wouldn't be only specific nodes, but would something like encfs[1] work?

[1] https://github.com/vgough/encfs

Unfortunately that's harder than just always leaving a Raspberry Pi on at home, especially given that I want to be able to sync files to my phone, where EncFS probably doesn't work at all (or easily).

I'm unfamiliar with syncthing, but could you run two daemons, one that does encrypted sync to e.g. dropbox, and one that does plain sync to your phone and such? Or would the two instances stomp on each other or get into an infinite loop? e.g.:

    plain <-> syncthing <-> phone
      ^
      |
      V
    encfs <-> syncthing <-> dropbox

That might be doable, but then I'd need an always-on trusted computer to do the decryption, and if I have that I don't need the VPS...

Apparently syncthing uses fairly strong crypto in transit, or at least that's what I read recently

That's not what StavrosK is asking for.

Some syncthing nodes could host only the encrypted data, without the keys to decrypt them. This adds the benefit of having some nodes host the data, without being able to access it. Think: VPS, etc. that have very good availability track record, but some doubts about whether your hosting company can spy/might be coerced into spying.

Exactly. If I could be sure that the VPS couldn't read or mess with my files without me knowing, I'd definitely add a SyncThing node on my VPS and have increased availability along with security without any hassle.

I think it has been considered:

https://github.com/syncthing/syncthing/issues/109

https://www.bountysource.com/issues/1474343-support-for-file...

https://forum.syncthing.net/t/encryption-for-remote-syncthin...

Unfortunately there doesn't seem to have been much movement towards making it a feature.

Reply on news.ycombinator.com