How devices trust each other
What decides whether a connection is allowed, and the extra code check you can switch on.
Your account is the gate. Both computers sign in, the coordinator only introduces devices that belong to the same account, and every install carries its own key that it proves on each connection.
So in the shipping default, a first connection just opens. There is no code to compare and nobody has to be at the far computer.
What actually protects a session today
| Layer | What it does |
|---|---|
| Your account | Only your devices are ever introduced to each other |
| Device key | Each install proves its own identity on every connection |
| Coordinator vouching | The far computer accepts a connection the coordinator vouched for |
| End-to-end encryption | Keys agreed between the two computers, so relays carry sealed data |
That is strong against the network and against the relay. It leans on your account password, which is why account safety matters more here than anywhere else.
The extra check: a 6-digit code
The protocol can also do a short code check, the thing other tools call pairing. Both ends work out the same 6 digits from the key they just agreed. A stranger in the middle would have to agree one key with each side, so the two sides would show different digits.
It is off by default. Turn it on by setting the pairing mode to sas on
both the far computer and the app you connect from, then restart both. The
exact setting is in the
settings reference.
With it on:
- The app you are sitting at shows the digits and waits for you to accept or reject. Rejecting stops the connection and remembers nothing.
- Accepting pins the far computer's identity, so later connections are silent.
- The far computer accepts and pins your app automatically. It does not ask anybody, because there is no wired approval screen on that side yet.
What that means in practice
Switching the code check on protects the app you are sitting at: you get to see, and reject, a far computer whose identity does not match. It does not yet give the far computer a way to refuse you by hand.
Pinned identities
Once pinned, each side remembers the other:
| Side | Remembers | Where |
|---|---|---|
| The app you connect from | Far computers it has accepted | ~/.skylight/known_hosts |
| The computer being shared | Apps it has admitted | ~/.skylight/authorized_viewers |
A reinstall makes a new identity, so a pinned pair asks again. See trusted viewers.
What to do instead of a code check
Until host-side approval ships, the controls that actually limit access are:
- Keep the account tight. Long unique password, and remove people who leave. See users and teams.
- Prune devices. Removing one in Devices kills its token immediately.
- Watch Activity for connections you cannot explain.