felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

Sync with latest Wiki content, syncthing -> Syncthing

Browse Source
This commit is contained in:
Jakob Borg
2015-05-29 09:10:37 +02:00
parent cbf0766e86
commit 567d3dd0f5
27 changed files with 241 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
users/security.rst
+12 -12
View File
@@ -27,7 +27,7 @@ Information Leakage
Global Discovery
----------------
When global discovery is enabled, syncthing sends an announcement packet
When global discovery is enabled, Syncthing sends an announcement packet
every 30 minutes to the global discovery server, so that it can keep a
mapping between your device ID and external IP. Also, when connecting to
other devices that have not been seen on the local network, a query is
@@ -44,13 +44,13 @@ the default global discovery server.
Local Discovery
---------------
When local discovery is enabled, syncthing sends broadcast (IPv4) and
When local discovery is enabled, Syncthing sends broadcast (IPv4) and
multicast (IPv6) packets to the local network every 30 seconds. The
packets contain the device ID and listening port. Local discovery
defaults to **on**.
An eavesdropper on the local network can deduce which machines are
running syncthing with local discovery enabled, and what their device
running Syncthing with local discovery enabled, and what their device
IDs are.
When turned off, devices with dynamic addresses on the local network
@@ -59,10 +59,10 @@ cannot be found and connected to.
Upgrade Checks
--------------
When automatic upgrades are enabled, syncthing checks for a new version
When automatic upgrades are enabled, Syncthing checks for a new version
at startup and then once every twelve hours. This is by an HTTPS request
to the download site for releases, currently **hosted at GitHub**.
Automatic upgrades default to **on** (unless syncthing was compiled with
Automatic upgrades default to **on** (unless Syncthing was compiled with
upgrades disabled).
Even when automatic upgrades are disabled in the configuration, an
@@ -70,17 +70,17 @@ upgrade check as above is done when the GUI is loaded, in order to show
the "Upgrade to ..." button when necessary. This can be disabled only by
compiling syncthing with upgrades disabled.
In effect this exposes the majority of the syncthing population to
In effect this exposes the majority of the Syncthing population to
tracking by the operator of the download site (currently GitHub). That
data is not available to outside parties (including @calmh etc), except
that download counts per release binary are available in the GitHub API.
The upgrade check (or download) requests *do not* contain any
identifiable information about the user, device, syncthing version, etc.
identifiable information about the user, device, Syncthing version, etc.
Usage Reporting
---------------
When usage reporting is enabled, syncthing reports usage data at startup
When usage reporting is enabled, Syncthing reports usage data at startup
and then every 24 hours. The report is sent as an HTTPS POST to the
usage reporting server, currently **hosted by @calmh**. The contents of
the usage report can be seen behind the "Preview" link in settings.
@@ -89,7 +89,7 @@ enabling it, shortly after the first install.
The reported data is protected from eavesdroppers, but the connection to
the usage reporting server itself may expose the client as running
syncthing.
Syncthing.
Sync Connections (BEP)
----------------------
@@ -99,7 +99,7 @@ address is possible to resolve. The sync connection is based on TLS 1.2.
The TLS certificates are sent in clear text (as in HTTPS etc), meaning
that the certificate Common Name (by default ``syncthing``) is visible.
An eavesdropper can deduce that this is a syncthing connection and
An eavesdropper can deduce that this is a Syncthing connection and
calculate the device ID:s involved based on the hashes of the sent
certificates.
@@ -112,14 +112,14 @@ Web GUI
-------
If the web GUI is accessible, it exposes the device as running
syncthing. The web GUI defaults to being reachable from the **local host
Syncthing. The web GUI defaults to being reachable from the **local host
only**.
In Short
========
Parties doing surveillance on your network (whether that be corporate
IT, the NSA or someone else) will be able to see that you use syncthing,
IT, the NSA or someone else) will be able to see that you use Syncthing,
and your device ID's `are OK to share
anyway <http://docs.syncthing.net/users/faq.html#should-i-keep-my-device-ids-secret>`__,
but the actual transmitted data is protected as well as we can. Knowing