Hacker News Reader

Comment by tarruda | Hacker News Reader

A cheap and nice self hosted alternative way to have an "always on" sync endpoint is with a raspberry pi 4 with SSD (don't try this with an SD card).

My current setup is running a wireguard server, syncthing and DuckDNS on the pi. I also port forward the wireguard port from my ISP's router.

With this, my devices are always connected to the VPN, and sync always works (and is fast!) like everything is on a LAN.

View on HN

There’s nothing wrong with using an SD card. I use Syncthing on rpi with a 1TB SD card and it works great.

I think you are missing the point. If you fully control the hardware, then you probably don't need Untrusted Device Encryption.

It's also a poor solution for an "always on" solution since it's dependent on your home Internet/VPN/power working, which is probably true for your other clients too.

If I'm running Syncthing on a desktop computer at home and a laptop with me on the go, adding a Raspberry Pi to the same home network doesn't really improve resiliency of the sync service. But if I have a server in a completely different location, it actually will.

Who on earth leaves their desktop running when leaving the house? Why?

That's not entirely true. For example your Raspberry PI can get stolen.

I would definitely encrypt the stuff on my NAS if it was sitting in my garage.

Sure, but the tried and true way to encrypt your NAS would probably be using full-disk-encryption, not something specific only to syncthing.

If someone manages to access the running raspberry pi though, FDE doesn't protect against that, while the Syncthing's untrusted device encryption does.

Including if some other service on your Pi gets compromised. They still won't get access to your synced data.

If your threat model includes someone willing to break into your house, then, well, good luck. [0]

[0]: https://xkcd.com/538/

The threat model described by the post above you is actually not about physical access. It's about the PI getting hacked remotely.

If you use Syncthing's encryption then at no point is the decrypted content available to the PI. It gets decrypted locally by other Syncthing peers after they have downloaded it.

Besides, there's still a difference between physical accesses: plain and non-targeted (besides how profitable they're expected) burglaries are way more common than violent targeted attacks meant to extract a secret from an individual.

Are you aware of any non-targeted burglaries where the burglar extracted secrets from a running computers memory?

An attacker with a wrench will get the information they want from you, regardless of where it's located.

Maybe a better example might be wanting to use a smartphone as the always on sync endpoint. The phone can easily be stolen but with this feature it won't contain the valuable data.

How do I start the NAS up, SSH in and type the password?

You send it a WoL packet[0], use key-based SSH to log in to the initramfs environment[1], and type in your password. Or if you have a TPM you can just stick encryption keys there. Do note that if the device lacks secure boot or such, this is vulnerable to an attack where the initramfs is modified to steal your password; how bad this is depends on your threat model.

[0] https://en.wikipedia.org/wiki/Wake-on-LAN

[1] https://askubuntu.com/questions/1269981/unattended-headless-...

Depends on the setup, disk encryption has disadvantages such as needing to decrypt each time you reboot (and if that's the root partition, you can't really boot unattended). It can be advantageous to not have to trust the server and have a non-encrypted zfs dataset for this.

I've used dropbear-initramfs on both Debian and Ubuntu to remote-unlock hosts with encrypted root filesystems successfully. It'd be nice if it were better supported though.

https://www.cyberciti.biz/security/how-to-unlock-luks-using-...

You could also have a Raspberry to backup in another place, such as a friend's house.

I understood that point. The raspberry pi would still serve as an always on endpoint regardless of the untrusted device encryption feature.

In my case I don't use this feature on the pi, but I do use it on my phone which has 256gb storage. I have configured syncthing to only run when charging the phone, so it is not always on.

Yes you do. Any device that doesn't support good enough fde should have syncthing encrypted. Because usually you want the device to boot and start operating unattended - it is quite vulnerable.

I agree with this. FDE for semi-autonomous network devices is just so you can more safely dispose of the drive at end of life.

I would like FDE + untrusted device encryption for a NAS. I am glad Syncthing is working on this.

Not necessarily. Lets say I have a node at my in-laws house. I would use untrusted device encryption in case anyone decided to take the drive and have a look.

Reply on news.ycombinator.com