Who you have to trust
And who you do not. Stated against what the shipping build actually does.
You have to trust
- Your account login. It is the gate. Anyone who can sign in as you can add computers and reach the ones you have.
- The two computers themselves. Malware on either one can read that screen. No protocol fixes that.
- The coordinator, for admission. It decides which devices get introduced. It cannot read a session, but in the default setup it is what vouches for a connection.
You do not have to trust
- The relay. It carries sealed data and has no key.
- The network in between. Wi-Fi, your ISP, everything along the way: sealed traffic only.
- The coordinator, for content. It never holds a session key, so it cannot see a frame, a keystroke, or anything copied.
What each attacker gets
| Attacker | Gets |
|---|---|
| Someone sniffing your Wi-Fi | Sealed packets |
| Someone who takes over a relay | Sealed packets, plus the fact a session exists |
| Someone with your password | Your account, until you change it and remove devices |
| Someone standing at the computer | That computer, completely |
| Someone who takes over the coordinator | Metadata, and the ability to introduce a device that should not be introduced |
That last row is the one the optional code check exists for, and it is off by default. With it on, the app you are sitting at shows 6 digits derived from the session key and lets you reject a far computer whose digits do not match.
Where the weight sits
In the shipping default, the strength of a session comes down to your account. That is a real design position, and it is the same one most remote-access products take, but it is worth naming rather than dressing up:
- A strong unique password matters more than anything else on this page.
- Removing a device in Devices is the action that cuts it out of your fleet: no listing, no slot, no brokered connection.
- Activity is where an unexpected connection shows up.
Automatic admission on the shared side
The computer being shared does not ask a person before admitting a device your account vouches for. There is no approve-or-deny screen wired up on that side yet.
If you need a machine that nobody can reach without a human saying yes, keep it off your shared account until that ships.