That device ID you have to send to someone is not nominally private; it is in fact explicitly the public key of a key pair. If you use the public discovery servers (which is the default), that key is sent there so people who'd want to connect to you can look up your IP address with it.
https://docs.syncthing.net/users/security.html#global-discov...
https://docs.syncthing.net/users/faq.html#should-i-keep-my-d...
> Should I keep my device IDs secret?
> No. The IDs are not sensitive. Given a device ID it’s possible to find the IP address for that device, if global discovery is enabled on it. Knowing the device ID doesn’t help you actually establish a connection to that device or get a list of files, etc.
> For a connection to be established, both devices need to know about the other’s device ID. It’s not possible (in practice) to forge a device ID. (To forge a device ID you need to create a TLS certificate with that specific SHA-256 hash. If you can do that, you can spoof any TLS certificate. The world is your oyster!)
Additionally, I don't necessarily want a key sitting out there that will let any random person who finds it a dynamic way to look up my current IP address. It's not the worst thing in the world, but it's definitely not something I'd publish publicly.
That's not all it is. It's your cryptographic public key.
> Additionally, I don't necessarily want a key sitting out there that will let any random person who finds it a dynamic way to look up my current IP address.
Sure, that makes sense. How else would you propose that it work?
Just to mention, you can use a private, self-hosted discovery server.
I stick with Resilio for this reason. For over a decade now it had been a 100% reliable fire and forget tool.
You don't have to do that with Syncthing. See https://docs.syncthing.net/users/introducer.html
> The introducer feature lets a device automatically add new devices. When two devices connect they exchange a list of mutually shared folders and the devices connected to those shares. In the following example:
> Local device L sets remote device R as an introducer. They share the folder “Pictures.” Device R is also sharing the folder with A and B, but L only shares with R.
> Once L and R connect, L will add A and B automatically, as if R “introduced” A and B to L.
> Remote device R also shares “Videos” with device C, but not with our local L. Device C will not be added to L as it is not connected to any folders that L and R share.
So then I could make all my devices introducers, which is really the same amount of work, plus adviced against because then no device can ever leave your network (remove it from one then all others will re-introduce).
Dealing with devices is really not what I want. I understand that Resilio is a bit too basic on security, because the share key is the deencryption key (in most cases), but Syncthing isnt quite it either. I think it's suited for few devices and a knowledgeable person, but not my use cases.
In short, it's a great tool, it works well in general, but the initial setup is pretty cumbersome if all I want to do is send a couple files to someone.
Additionally, I've had a couple time where even just syncing between my own devices broke. I think it was something where files were changed on both sides and the reconciliation algorithm got confused, but it was hard enough to debug for me, with direct access to both devices, and decades of experience running and programming computers, that I'd never want to try to debug that over the phone with a friend.
tldr: They're not private keys, or sensitive.