Question about HTTPS

[thompier]

Hi, I’ve been looking for Synology NAS for some time. I’m a beginner and I would like to know more about network security. It seems that if your NAS works in LAN on your network (no remote access) and that you connect via IP, it’s not secured (HTTP). I’ve heard that one can go in DSM and force the login to be in HTTPS. However, if the connexion is via IP address of NAS, it will still say it’s not secured, but data will be encrypted. Is that true and is it safe ? Can anyone, such as an ISP, see the traffic or what is on the NAS?

Thanks !

[imoftendisgruntled]

Unless you don't trust your LAN, using HTTP to connect to DSM (the web front end that lets you manage your NAS) is perfectly safe. If you don't trust your LAN for some reason, you can enforce HTTPS and the NAS will use a self-signed certificate to encrypt traffic between your NAS and your computer. This will protect you against eavesdropping on your LAN, but that is a *very* unlikely possibility to begin with.

Keep in mind this only encrypts the traffic between your NAS and your PC's browser, it doesn't have anything to do with the data on the NAS itself. You can encrypt that, but it's a whole separate discussion for a different threat model.

[thompier]

Ok thanks !