The NAS.
Anything that shares folders over SMB: a NAS box, a Windows server, a Linux machine running Samba. Loft doesn't change it and doesn't install anything on it.
How it works
A gateway at home, an app in your pocket.
Loft has two parts. A gateway runs next to your NAS, and the app runs on your device. The app only ever talks to your gateway, and the gateway only ever talks to your NAS.
The parts
The Loft gateway.
A small service on a Linux machine at home. It signs in to the NAS as you, so the NAS's own permissions apply. It is the only thing your apps connect to.
The apps.
Loft for iPhone and iPad, Mac, Android, Windows and Linux. They put the shared folders in the system's own file app and fetch files when you open them.
Pairing
loft-gateway pair prints a QR code and a link. Both carry the gateway's name, its addresses and the fingerprints of its keys. Your app checks those fingerprints on every connection, so it can't be tricked into talking to another machine. That's also why there's no “type the server address” box. A typed address is how a fake gateway would collect passwords. (If you need it anyway, Set up manually is on the app's pairing screen.)
The link looks like https://loft.incremental.no/pair#…. Everything after the # stays on your device. Browsers never send that part to our website.
Each device pairs with one gateway at a time.
What's encrypted on each route
| At home | Away, through a tunnel | Away, direct | |
|---|---|---|---|
| App ↔ gateway | Encrypted, pinned to your gateway's key | Encrypted to the tunnel provider, who can read the traffic, then through the provider's tunnel to your gateway | Encrypted, pinned to your gateway's key, end to end |
| Signing in with your password | Yes | No. Sign in at home first | Yes, the connection is pinned |
| Gateway ↔ NAS | SMB 3, encryption required (can be relaxed for an older NAS) | same | same |
Which should I choose? A tunnel is the easy option. Nothing is opened on your router, but you trust the tunnel provider with your traffic. Direct mode means forwarding a port to the gateway. Nobody in between can read anything, but the gateway is reachable from the internet, so it limits sign-in attempts. Many NAS boxes don't lock an account after failed passwords, so the gateway does it for them. You can also use neither and reach Loft only at home.
Your password. It is sent only over a pinned connection to your gateway. The gateway stores it encrypted with two keys, one held by the gateway and one held only by your device, so a copy of the gateway's database is not enough to read it. Each signed-in device has its own encrypted copy, and removing the device from the gateway deletes it.
What we can't protect against, said plainly. While the gateway is running and you're using it, it has to use your password to talk to the NAS. Someone who takes control of the running gateway could capture the passwords of the people using it at that moment. That's true of any gateway that signs in to SMB as you. So run the gateway on a machine that does nothing else, and keep it updated.
Updates. The gateway never updates itself. You install the new .deb or pull a new container image, after reading the release notes.
→ Found a security problem? Security (hello@incremental.no)