Threat model in plain words

This page says whom easysync trusts, whom it does not, and what it does about each kind of attacker. It is a summary in plain words; it does not describe every detail of the handshake or of how secrets are stored. easysync has not had an independent security review.

Whom you trust #

You trust your own paired devices. "Paired" means: you compared the six digits on both screens and both of you confirmed. A paired device is authenticated, which does not mean that everything it sends is harmless. A device can be lost, infected or misused, and easysync treats what it sends as input that needs a policy.

You do not have to trust the network, a relay or the place that hosts a relay with the content of what you send. You do trust a relay operator with the information described in What the relay sees, and not to block your connections.

What an attacker can and cannot do #

Who	What they can do	What stops them
Someone who watches the network	See that your devices connect, when and how much. They cannot read the content.	Encryption between the two devices.
Someone who controls the network	Block or delay connections, or sit between two devices during a pairing.	Every later connection is authenticated by the keys of the paired devices. During a pairing, the six digits expose a man in the middle.
The operator of a relay	See IP addresses, timing and volume, and which addresses talk to each other through the relay. They cannot read or change content undetected.	Encryption and authentication between the devices. They can still break connections or shut the relay off. What the relay sees lists it.
Someone who finds a pairing link	Try to use it before you do.	The link is valid for three minutes and works once. Nobody is paired until both of you confirm the six digits.
Someone who learns the link and sits in the middle of the pairing	Get one guess at the six digits.	The digits are committed in advance, so the chance is one in a million per attempt, and a joining device never retries with the same link.
Someone on your local network	See that easysync is announcing itself and on which port. Try to occupy the direct pairing slots and delay a pairing.	The announcement contains no name and a value that changes hourly. The relay path is not affected by this and serves as a fallback.
A stranger who finds your relay	Try to use it.	The access token. Without it a stranger can only join an existing pairing, and only a small amount of data can pass that way. The token keeps strangers out; it does not protect the content, which is protected between the devices.
A paired device that has been compromised	Send you clipboard text that you may paste somewhere harmful, flood you with files, or announce a false name.	You allow receiving text per device. Every offer of a file is subject to your policy, a size limit and a quota. Names are only labels; the fingerprint is the identity. Revoke the device.
Someone who steals or finds one of your devices	Use the device as you can, including to send you files and text.	The lock of the device and its key store are the protection. Revoke the device on your other devices.
Malware on your device	Whatever your account can do.	easysync cannot protect against it. It limits damage by switching off core dumps (not done on Windows in this version) and by refusing other users on its local interface.
The host of the web app	Send code to your browser that leaks your identity key.	Not preventable by the app alone; see The web app and its limits.

What easysync does not try to do #

It does not hide that you use it or where your devices are. It is not anonymous.
It does not protect text that you have already pasted, or files that you have already saved.
It does not clean received text. A text with a hidden command is still a text with a hidden command.
It does not protect a device that an attacker controls.
A revocation is local. If a device is compromised, revoke it on every device it was paired with.

Sources: security policy.