Hacker News Reader

Comment by hamandcheese | Hacker News Reader

Sure, but the tried and true way to encrypt your NAS would probably be using full-disk-encryption, not something specific only to syncthing.

View on HN

If someone manages to access the running raspberry pi though, FDE doesn't protect against that, while the Syncthing's untrusted device encryption does.

Including if some other service on your Pi gets compromised. They still won't get access to your synced data.

If your threat model includes someone willing to break into your house, then, well, good luck. [0]

[0]: https://xkcd.com/538/

The threat model described by the post above you is actually not about physical access. It's about the PI getting hacked remotely.

If you use Syncthing's encryption then at no point is the decrypted content available to the PI. It gets decrypted locally by other Syncthing peers after they have downloaded it.

Besides, there's still a difference between physical accesses: plain and non-targeted (besides how profitable they're expected) burglaries are way more common than violent targeted attacks meant to extract a secret from an individual.

Are you aware of any non-targeted burglaries where the burglar extracted secrets from a running computers memory?

An attacker with a wrench will get the information they want from you, regardless of where it's located.

Maybe a better example might be wanting to use a smartphone as the always on sync endpoint. The phone can easily be stolen but with this feature it won't contain the valuable data.

How do I start the NAS up, SSH in and type the password?

You send it a WoL packet[0], use key-based SSH to log in to the initramfs environment[1], and type in your password. Or if you have a TPM you can just stick encryption keys there. Do note that if the device lacks secure boot or such, this is vulnerable to an attack where the initramfs is modified to steal your password; how bad this is depends on your threat model.

[0] https://en.wikipedia.org/wiki/Wake-on-LAN

[1] https://askubuntu.com/questions/1269981/unattended-headless-...

Reply on news.ycombinator.com