While I’m an avid advocate of privacy and anonymity, I don’ think syncthing is or should be designed to be used as a tool to sync files in perfect anonymity.
That is because it’s incredibly difficult to reach at least ok anonymity as you can see with all the bugs the TOR project has to fix. Most of those problems are with hidden services, because those have to be accessible from a fixed address/ID over a long time. Which is basically the same requirement we have when we want to find other ST devices. If even a project with several million dollars in funding and many highly skilled coders with experience in anonymity projects can’t reliably make this work, its impossible for us.
Oh and if your threat model includes an adversary with global passive listening skills (as it should for perfect anonymity, but even the TOR Project doesn’t do this), you have to protect agains traffic correllation attacks like Adam Langleys Pond. This might be kinda usable for the messaging usecase Pond has. But you’ll never be able to get any usable transfer speeds for file sync. At least not if you want normal people to use it, because Dropbox will always be several orders of magnitude faster than any truly anonymous file sync/sharing tool.
Because of all those problems the usecase of anonymous file sync can only ever be appropriately addressed by tools based on anonymity networks like I2P, GnuNet and partly TOR.
That’s why a DHT or a blockchain-based discovery would be nice in the long run. But building either with the privacy and usability on mobile devices provided by the current and especially the upcoming 0.12 release is next to impossible.
DHTs aren’t easily encrypted because of the way they work. Blockchain-based technology could fix the problem that the social graph of our devices is exposed, because everybody downloads EVERY IP-ID pairing and just uses the ones it’s looking for. It can’t fix the fact that hash-IP pairs are publicly accessible.
But downloading a huge blockchain and staying connected to a swarm is not viable on mobile devices because their storage and energy resources are rather limited.
There are things like “light” clients but they generally just trust the answer of a node with the whole blockchain. Light clients using snapshots of trusted points of time in a blockchain could also work but are still experimental.
If you are interested in those blockchain-based solutions, you should take a look at DNSChain by okTurtles.
But to be honest, I think Syncthing has bigger fish to fry at this point like selective sync and diff-based index exchanges.
As soon as the cost of hosting the discovery server(s) gets too high or ST gets popular enough to be attacked via DDOSing them, we can take another look at those options.
As for the anonymity requirement, this is basically impossible to do on our budget of financial, community and developer resources. And because the government can easily surveil everything connected to your official identity you would have to use a near-perfect anonymity network. Which brings us back to the first point.
The blockchain-based solution I described above would fix this, but it’s A LOT of work and I’d consider this technology to still be experimental.