[kuschku]

I mean that there is no password between desktop client and the open source cloud engine – anyone can log in to it just like that.

The tokens to auth are world-readable under /accounts or /n

[kentonv]

This sounds like a job for Sandstorm.io...

[grinich]

Or like any firewall, Nginx config, VPN, etc. Everyone picks a different way to do it, so it's not included in the default sync engine.