sync through sftp

jc_vignoli
Hi there,
Is there a way to sync Zotero through sftp, instead of webdav? Been checking all options, can't find any for sftp.
Thanks!
  • adamsmith
    No.
  • jc_vignoli
    Thanks for your reply. Is that planed? Webdav is a unsecure way to sync.
  • adamsmith
    I don't think so, no.
    Core devs would be able to say in detail, but I don't think sftp gives them what they'd need for sync. As long as you run it over https, there's nothing insecure about WebDAV, though.
  • jc_vignoli
    Nowadays, any tool protected by user/password only is insecure, unfortunately.
    I don't feel very confortable with using a webdav connection, it's quite obsolete.
  • dstillman
    edited June 26, 2023
    No, you're confused about this. WebDAV operates over HTTPS, which is how every secure website in the world transfers data. It's in no way obsolete. You seem to be thinking of something like FTP, which uses an unencrypted connection and transmits your password in the clear.
  • jc_vignoli
    edited June 26, 2023
    I'm not confused.
    SSH uses ed25519 keys instead of passwords. That's what modern security looks like.
    HTTPS prevents the middle man attack, it doesn't protect you against a hacker finding your password.
    FTP is worse than webdav, it doesn't make webdav more secure.
  • dstillman
    Obviously there are benefits to SSH keys, but it's absurd to call HTTPS "insecure" and "obsolete". It's as secure as literally any website that uses HTTPS and lets you log in with a username and password, which is the vast majority of websites. Set a long password and store it in a password manager.

    We plan to support 2FA for Zotero logins, but there's no chance we're ever going to support SFTP for syncing.
  • jc_vignoli
    2FA is already an improvement (a nice improvement, I must say)
    But since ssh is standard on linux machines, may I ask you why "there's no chance" to support SFTP? What is the reason?
  • dstillman
    We support WebDAV as an alternative to Zotero Storage because it's a common file protocol that many people have access to. Almost no one has access to a server with SSH/SFTP access. You're the first person to ask about it in 15 years.

    And in any case, we can't do it on a technical level. Zotero is based on Firefox, and the Mozilla platform doesn't support SSH.
  • jc_vignoli
    Please, be more careful how you engage with people. First I was "confused", now I'm the "first person to ask" such a feature.
    A quick search showed me people trying to use ssh, wanting to sync through ssh, but I must be confused again, I guess:
    https://forums.zotero.org/discussion/75670/ssh-y-show-file-window-opens-on-remote
    https://forums.zotero.org/discussion/7082/ssh-file-transfer-support-for-attachment-sync
    https://forums.zotero.org/discussion/4795/sync-ftp
    You even responded yourself to the last post.

    I find your replies veyxing and in bad faith, the conversation went wild for no reason.
  • dstillman
    edited June 27, 2023
    Huh? I said you're the first person to ask about it in 15 years. That first thread has nothing to do with SFTP or file syncing. The other two are from 2008–2009 — i.e., "15 years" ago. Those are the previous threads I was referring to. If you're going to post here, you'll need to accept when we tell you that something you're asking for is a niche request.

    And, yes, calling WebDAV "obsolete" and "insecure" does suggest confusion. As I say, it's as current and secure as every HTTPS website that uses a username and password.

    Anyhow, we've answered your question in quite a lot of detail, and I can't spend more time on this.
Sign In or Register to comment.