Add time synchronization requirement option

[govpn.git] / doc / faq.texi

diff --git a/doc/faq.texi b/doc/faq.texi
index e6986cdeaaf56c3886687470101c41f4fd95d8d7..021cc552163f25bc90a09f49d0c716f308682d0a 100644 (file)
--- a/doc/faq.texi
+++ b/doc/faq.texi
@@ -75,10 +75,7 @@ at the traffic (transport and handshake).
 
 @cindex Censorship
 @cindex Censorship resistance
-@cindex Censorship resistant
-@cindex DPI resistant
 @cindex DPI resistance
-@cindex DPI
 @item What do you mean by censorship resistance?
 Unability to distinguish either is it GoVPN-traffic is passing by, or
 just @code{cat /dev/urandom | nc somehost}. If you can not differentiate
@@ -95,6 +92,12 @@ provides confidentiality and authenticity of transmitted data! But pay
 attention that this mode is traffic and resource hungry and currently
 operate only in TCP mode.
 
+@item Do you think encryptionless mode with all those random data helps in court?
+If anything that can not be read by anyone is considered encryption,
+then no, encryptionless mode won't help you. Imagine that either you are
+talking on another foreign language, or just use another date encoding
+scheme.
+
 @item When should I use @ref{Noise, noise} option?
 In most cases you won't need it without @ref{CPR, constant packer rate}
 turned on. Without CPR and noise options GoVPN traffic (like TLS, IPsec,
@@ -103,6 +106,16 @@ timestamps and sizes. You can run traffic analysis and predict what is
 going on in the network. With CPR option enabled you can tell either
 somebody is online, or not -- nothing less, nothing more.
 
+@item When should I use @ref{Timesync, time synchronization} option?
+Without that option, if someone captured initial handshake packet from
+the valid client, then it could repeat it and receive a handshake packet
+as an answer from server. This can be used to detect if some user's
+identity is known to server and that it is exactly GoVPN server.
+Timesync option forces adding timestamps to each handshake packet
+allowing only specified time window of packet validness. If you have got
+more or less synchronized clocks between your clients and server, then
+you can use always use this option.
+
 @cindex DoS
 @item Can I DoS (denial of service) the daemon?
 Each transport packet is authenticated first with the very fast UMAC
@@ -111,4 +124,12 @@ be higher then UMAC verifying. Each handshake message is processed only
 when an encrypted client's @ref{Identity, identity} is found: it uses
 fast PRP without any entropy usage.
 
+@cindex Why YAML
+@item Why YAML for configuration?
+There are not so many well-known formats that allow commenting, easy
+editing by human (XML is not human friendly at all, JSON is more or
+less). Probably the most useful feature is YAML's templates: it is very
+convenient for storing many clients sharing the same options in the
+configuration file.
+
 @end table