#Syncthing security code#

The discovery serversĪre currently hosted by Global discovery defaults to on. Private between the device and the discovery server. The discovery server is encrypted using TLS and the discovery serverĬertificate is verified, so the contents of the query should be considered Servers containing the device ID of the requested device. Not been seen on the local network, a query is sent to the global discovery Also, when connecting to other devices that have Minutes to the global discovery servers so that they can keep a mappingīetween your device ID and external IP. When global discovery is enabled, Syncthing sends an announcement every 30

#Syncthing security code#

Incoming requests for file data are verified to the extent that the requestedįile name must exist in the local index and the global model.įor information about ensuring you are running the code you think you are andįor reporting security vulnerabilities, please see the official security page. In a human-friendly encoding, called Device ID. Theįingerprint is computed as the SHA-256 hash of the certificate and displayed To a preset list of acceptable devices at connection establishment. To prevent uninvited devicesįrom joining a cluster, the certificate fingerprint of each device is compared

Currently thisĪll device to device traffic is protected by TLS. Possible to extract private information from intercepted traffic. Possible for an attacker to join a cluster uninvited, and it should not be Security is one of the primary project goals.