ChrisH

Members
  • Posts

    247
  • Joined

  • Last visited

  • Days Won

    12

Posts posted by ChrisH

  1. It doesn't control it, but it does designate the type of key.

    Right. So the letter scheme only relates to secrets generated by BTSync itself, and generating secrets by some other means and then just adding letters to it in the hope of making them read-only-secrets (as Shagaroo suggested) won't work and is not necessary either, which was my point.

  2. Simple folders added by very same secrets, reachable by web client, mobile app and if desired - public link.

    As soon as you want web clients or public links the server has to have your secret (either permanently or transmitted on request) in order to decrypt your files, so the only advantage of BTSync is gone and you can just use Dropbox or whatever.

    Also I would never use BTSync storage provided by any third party as long as there is no option to give storage providers a read-encrypted-only secret. What would be the point?

  3. Well, yes. That's exactly what a tracker does - how did you expect the devices should find each other?

    In my understanding the tracker has a hash of the secret plus the IP/Port of devices with folders for that secret, and that's it.

    With that information alone you cannot access the shared data (but you do know where to reach the devices for additional attacks - which is why it's so important BTSync and its protocol become open source at some point...).

  4. Please add an option to store the configuration files in a custom folder. The fact that settings - and thus the secrets! - are stored in %APPDATA% (on Windows) is a huge security problem.

    You can just move the files from the Appdata folder. BTSync.exe looks first in its own folder for the configuration files, and only if it finds nothing there it looks in the Appdata folder.

    My laptop has an SSD and thus I can't encrypt the system folder with TrueCrypt.

    I don't follow - my computers all have SSDs as system drives and they all are encrypted with Truecrypt.

  5. however you have to understand that root cause of the issue - you upgrade machines in the middle of sync. I.e. two upgraded machines perform some changes and then you bring third machine that cannot be aware of these changes due to an incompatible protocol.

    I don't think that's the root cause, but okay. Like someone else already said in this thread, if you have to centrally synchronise and manage updates on all clients then a decentralized sync solution kinda loses its value.