Mention the possibility of geotracking someone based on their IP address
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 35/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Stale
- Domain
- documentation, networking, security
Research direction
Read the FAQ section “Should I keep my device IDs secret?” and the “In short” section of security.html, then verify the claims about public discovery servers and IP-based geolocation. Done means documenting any confirmed privacy implications and updating the linked guidance to accurately qualify device ID sensitivity.
Written by the indexing model from the issue text.
Description
Knowing someone's IP address, one can infer information about someone's geolocation using public services like https://whatismyipaddress.com. You can usually determine exactly in what city the IP address is based.
As I understand it (I'm not sure about this one), public discovery servers basically provide a public service for mapping device IDs to IP addresses. No prior pairing is required (again, I'm not sure about this one).
That would mean that if some device uses public discovery servers (which are currently configured + enabled by default), anyone who knows that device's device ID is able to track the device's geolocation. In case the device is a laptop or phone, and is often carried by the same person when travelling (which is probably a common scenario for many syncthing users), this means that one can create a (more or less detailed) location profile for that person, anonymously and from anywhere in the world.
If this is true, it is probably not a good idea to post one's device ID publicly in the internet (at least not using a real name or a pseudonym), as it would compromise privacy to a certain degree and can also affect security in some sense.
Thus, if this is true, I would suggest to reflect this somewhere in the docs, specifically in:
- https://docs.syncthing.net/users/faq.html#should-i-keep-my-device-ids-secret
- https://docs.syncthing.net/users/security.html#in-short
- maybe somewhere else in https://docs.syncthing.net/users/security.html
Currently, the FAQ (see link above) says "The IDs are not sensitive." While they are in no way as sensitive as e.g. a private encryption key, I'd still say their are (or at least can be for some individuals) sensitive information.
What do you think about this?
- Dominant language
- Python
- Stars
- 327
- Forks
- 653
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from syncthing/docs
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Dark theme Open
Difficulty 5/5 Over a week Newbie friendliness 30/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
Similar issues
-
bug ci good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
documentation
Difficulty 2/5 Half a day Newbie friendliness 62/100
inmanta/inmanta-core#10835 ·
-
sponsored
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
Diaoul/subliminal#1382 ·