Security of F@H

[neostapler91]

Hi all,
Okay, I happen to know the IT guy for my high school pretty well and I finally built up the courage to ask him about installing F@H on the school's computers to run in the background. I explained to him all of the great things going on with this program and by the end he was very willing to keep an open mind about it, but there was one reason he had to refuse me for now. Basically, his concern is the risks/liabilities of data being transmitted to and from the school that he can't control. Since it is a government institution, they would be responsible if someone somehow gained access to a student's information and would cause a huge set of problems. Basically the job he gave me was to prove to him that F@H is safe to put on the school computers. Unfortunately, I don't have a huge wealth of knowledge about the details of internet security and while I did find a couple posts relating to the F@H's security features, they were all pretty brief and I know would not be enough to convince him. My question is could anyone give me a more thorough explanation of how F@H stays secure? Or better yet, is there any way that the data flowing to and from the school could somehow be monitored? I realize there is no way that F@H could be perfectly secure, simply because of it's nature, but I know he will not let me move forward with this plan until I give him more information.
Thanks!

[John Naylor]

Good to see someone else trying to bring a stack of machines into the fold

The shortened version is the first answer on this thread.

Then I suggest you read the pages from the project FAQ on FaHWiki under the header "what about security". Some of the links are out of date but all the information is still relevant.

If you only get your clients from the download page, then there are no leakages possible in terms of security unless someone can modify packets in transit across the internet, which is a problem if you're browsing google or using F@H lol...

To protect against modified packets all data transferred across the internet by the client has a 2048-bit key on the end, and if the checksums don't match at both ends then the data is discarded whether it is coming to the client or leaving from the client.

[neostapler91]

Thank you!