How secure is Syncthing+Tailscale on public wifi?
reddit / selfhosted

----------------------------------------------------------------------
AbstractContract · 2023-09-29 08:52

I'm honestly not very well versed in networking and confused every
time I get into it. If I have a yunohost server running syncthing and
tailscale to sync files, is there any attack surface if I use it for
access when connected to public wifi? Assuming no manually exposed
ports. The way I understand it, tailscale should form its own network
layer and syncthing should only be accessible by whitelisted devices.
And a bonus question, what about SSHFS mounted networks on tailscale?

----------------------------------------------------------------------
ElevenNotes · 2023-09-29 08:56

The connection goes via wireguard, not via public internet, so no
credentials snooping or anything. You are as secure as you are on any
other foreign network. As long as the client is not compromised
nothing can happen by default. Same goes for SSHFS.

----------------------------------------------------------------------
AbstractContract · 2023-09-29 09:10

So I should be relatively fine if I add another VPN layer?

----------------------------------------------------------------------
ElevenNotes · 2023-09-29 09:10

You don't need to add another layer, Tailscale is using wireguard.

----------------------------------------------------------------------
cloudswithflaire · 2023-09-29 09:12

All the traffic is end-to-end encrypted. So there’s nothing relative
about it lol.

----------------------------------------------------------------------
Azuras33 · 2023-09-29 09:49

Syncthing already encrypt data, so with a tailscale you already
encrypt the data 2 times, it's more than enough

----------------------------------------------------------------------
ScribeOfGoD · 2023-09-29 11:32

But..but… more VPNs mean more decried right? Right? Totally doesn’t
add another point of failure or another point to troubleshoot lol

----------------------------------------------------------------------
quidome · 2023-09-29 17:03

The only “issue” I can think of is if your Tailscale connection isn’t
up (yet) , since syncthing will probably just do it’s thing in the
background.

But I read in another reply that syncthing uses encryption too, so
that should be fine still. I would not want to leak any connectivity
info so keep that Tailscale up!

----------------------------------------------------------------------
dRaidon · 2023-09-29 17:41

Fully, you're going via a vpn.

----------------------------------------------------------------------
dRaidon · 2023-09-29 17:42

I wouldn't be worried, syncthing need an answering key to provide
anything.

But if worried, could always add some custom firewall rules.

----------------------------------------------------------------------
CeeMX · 2023-09-29 21:28

My cryptography professor had some good point once: if you need to
encrypt twice, that means you don’t trust the first encryption, so why
bother to use it if you don’t trust it?