A compromised relay server can't access the data because it's encrypted.
A meaningful vulnerability would have to be in either the software itself or in the coordination server. That attack surface is the same whether or not you have relays.
You can reduce the attack surface to just the software if there's a way for users to verify keys manually. But again, same attack surface whether or not you have relays.
That's right. We actively manage load across our relay network to ensure good performance, but we'll prioritize business transfers during peak times. We don't artificially limit the client, but P2P connection speeds can sometimes be affected by router configurations and ISP routing. For example, some ISPs route P2P traffic through slower paths, which can introduce variability.
Comments
Interesting that it says "Internet sending may be slower during peak times to keep things fair" even though it's supposed to be P2P?
Maybe they just mean if you end up with a relayed connection due to NAT issues? Because lower down it says "Send as fast as your connection"
I figured, it's just explained in an odd way.
That's what actually made it a hard pass for me.
Why's that, given that files are encrypted?
With whose key? I am not saying the service is not trust worthy, just that there is trust involved.
Trust not only they are not malicious, but also they won't have some kind of vulnerability.
Plus if it's encrypted how is the other party going to read the file? The key will have to take the same path.
Wouldn't that still be the case if relay servers didn't exist? A hacked version can send your file to the wrong person.
There is more attack surface with a server.
The vulnerability doesn't even have to be in their software, but in any piece of software they use, ssh, nginx, etc.
A compromised relay server can't access the data because it's encrypted.
A meaningful vulnerability would have to be in either the software itself or in the coordination server. That attack surface is the same whether or not you have relays.
You can reduce the attack surface to just the software if there's a way for users to verify keys manually. But again, same attack surface whether or not you have relays.
Hopefully it's a privpub negotiation. But yes, you have to trust the code.
That's right. We actively manage load across our relay network to ensure good performance, but we'll prioritize business transfers during peak times. We don't artificially limit the client, but P2P connection speeds can sometimes be affected by router configurations and ISP routing. For example, some ISPs route P2P traffic through slower paths, which can introduce variability.