telemotely
Security

A remote-control tool has to earn it.

telemotely can see a screen and move a mouse, which is exactly what malicious software does too. The difference has to be in who decides, who can see it happening, and what we're willing to say plainly. This is all of it.

Nobody connects without permission

telemotely only opens somebody else's device when the person at that device has allowed it, from that device: by giving you the code shown on its screen, by approving you on its own screen, or by switching on access for you there themselves. There is no way to reach another person's device without one of these. Your own devices, signed in to your own account, are the only ones that open for you without asking.

The person at the device always knows

For as long as anybody is connected, a red notice says so on that device's screen. It can't be switched off. It has a Disconnect button of its own, and it can be dragged out of the way but not dismissed.

Who can reach a device

  • Its code. A device shows an ID and an eight-character code. The code changes every five minutes, and repeated wrong guesses are locked out.
  • Its owner. A device signed in to your account opens for you without a code.
  • People it trusts. Saving somebody else's device gives you a bookmark and nothing else: no presence, no readings. It shows more only when the device's owner agrees, and a request nobody answers runs out as a refusal.
  • Without anybody at it. Opening a trusted device without its code needs a separate switch on that device, off unless somebody at it turns it on.
  • One at a time. A device takes one viewer. A second is told it's in use.

These rules are enforced by our service, not by each app, so an app that forgot one couldn't give away more than the service allows.

On Windows, when somebody asks to be trusted, the device asks its owner on its own screen. That question is hidden from the viewer's picture and refuses the viewer's mouse and keyboard, so it can only be answered by the person sitting there. If it can't be hidden, it isn't shown, and the request is refused.

Encrypted, end to end, with open standards

telemotely doesn't invent its own cryptography. It uses the well-tested open standards that video calls in every major browser rely on.

  • Every session is encrypted between the two devices. The screen, keyboard and mouse travel over WebRTC, secured with DTLS and SRTP using AES-GCM encryption. The keys are created on the two devices for each session, and a new session means new keys.
  • Nobody in between can read it. The connection goes straight between the two devices when it can, over the local network first. When a relay is needed, it passes along encrypted data it can't read.
  • We never see your screen. Our service introduces the two devices, then steps aside: the picture, keyboard and mouse never pass through it, and nothing from a session's screen is recorded anywhere.
  • The apps talk to our service over HTTPS. Sign-in, devices and settings travel encrypted with TLS, and the telemotely.com domain is protected with DNSSEC.
  • Passwords are never stored. Only a salted hash is kept (PBKDF2-HMAC-SHA512, 100,000 rounds), and the credentials that devices use are stored only as hashes too.

What isn't done yet

  • The Windows program isn't code-signed yet, so Windows warns that the publisher is unknown. When builds are published on the download page, each will come with its SHA-256 checksum.
  • A session carries on when a Windows PC is locked, and you see its lock screen, but you can't yet sign in to a locked PC remotely.
  • There's no independent audit or certification yet, and we don't claim any.

Found a problem?

Write to [email protected]. Every report is read. The same address is in our security.txt.