The essentials at a glance
Nobody is listening in
Screen, input, files, clipboard, audio and chat are end-to-end encrypted. The server only relays the connection – it sees no content.
Nothing without consent
Without a password for unattended access, nobody gets onto the computer unless the user accepts the connection. The user must allow every file that is to be copied to the computer individually.
Authenticity verified
Security code, device key and supporter certificates show that the right people are on both ends. Programs and updates are signed by the manufacturer.
The connection
End-to-end encrypted
For every session, the supporter and the computer negotiate their own key (ECDH with P-256). Everything that is transmitted afterwards is encrypted with AES-256-GCM – with a separate key and a running counter for each direction, so that messages can be neither altered nor replayed.
The server only relays
It brings the supporter and the computer together and passes on the encrypted data. It cannot read it – and neither can whoever operates the server or might have taken it over.
No open ports
Both sides connect outwards to the server via HTTPS (TLS). Nothing needs to be opened on the router or firewall; the computer cannot be reached directly from the internet.
Fixed server keys (optional)
The programs can be tied to the key of a specific server (pinning). They will then accept no other certificates, not even valid ones.
Who is at the other end?
Security code
When connecting, the supporter and the customer see a six-digit code. If it matches on both sides, nobody is sitting in between. The computer commits to its key before it knows the supporter's – so even a tampered server cannot make the codes match by trial and error. On first contact, it is worth comparing the code over the phone.
Device key
Every computer has its own long-lived key and uses it to sign every connection setup. The supporter remembers the key on the first connection (like SSH) and is warned as soon as a known computer identifies itself differently – checked before any password is used.
Supporter certificates
Companies issue their own certificates to their supporters. The accept dialog then shows the verified name and the company that confirmed it, instead of an arbitrary display name. Computers can be set to admit only supporters with a valid certificate – for all connections or only for unattended access. Certificates can be restricted to specific customers; the company revokes staff who have left centrally, and the computers fetch the signed revocation list themselves.
Warning about unknown addresses
If a list of your own supporters' addresses is maintained, the accept dialog clearly marks requests from other addresses in red – a good indication of scam calls.
The customer stays in control
Accept or decline
The user must confirm every connection without a password in the accept dialog. The dialog shows name, address and security code. The Enter key declines, and “Accept” only becomes clickable after a short pause – so a keystroke that was meant for somewhere else cannot accept anything by accident. Without a response, the request is declined after one minute.
Choose the permissions
Mouse and keyboard, clipboard, files, audio and restart can each be allowed individually – when accepting and during the session. The computer checks every permission itself, not just the user interface.
Always visible, end at any time
As long as someone is connected, a bar on the screen shows who has access. One click ends the session.
Confirm every file
If the supporter wants to copy a file to the computer, the program asks every time – with name, size and destination folder, defaulting to “Decline”. While the question is open, the supporter's mouse and keyboard are locked; they cannot answer it themselves.
Only the user's own rights
Even if the program is installed as a service with system rights: in a confirmed session, the supporter sees and writes files only with the rights of the signed-in user. Network drives and shares on the company network are blocked for file transfer.
Settings stay as they are
Password, unattended access, server and permissions cannot be changed while a session is running – so a supporter cannot set up permanent access for themselves during the session. When the program is installed, the settings require administrator rights; on Android, the screen lock.
Unattended access
Only on request
Access without confirmation is only possible if a password for it has been explicitly set up on the computer. What is then permitted is defined there; file upload and the console are off by default and can only be switched on after a warning.
The password stays secret
The password is never transmitted and never stored in plain text. It is fed (PBKDF2, at least 100,000 iterations) into the connection key; a wrong password simply produces no readable connection.
Guessing is slowed down
After five wrong passwords from one address, that address is blocked – first for one minute, then for increasingly longer periods, up to one hour. After 20 failed attempts in total, access is temporarily closed for everyone.
Office only, certificate only
Optionally, unattended access is only possible from specific addresses (office, VPN) and/or only with a valid supporter certificate – a password that has been passed on is then not enough on its own.
Programs and updates
Signed programs
The Windows programs carry a valid code signature from the manufacturer. Windows shows the publisher before anything is installed.
Doubly verified updates
An update is only installed if it is signed with the manufacturer's key – in addition to the checksum and code signature. This key is not stored on the server: even a compromised server cannot distribute a third-party program.
Genuine partner editions
The name, logo and contact details of a partner edition are signed as well. Nobody can take the genuine program and pass it off as someone else's “support” – the program does not use unsigned details. Remote support under your own name →
Protected installation
The program and settings are stored in folders that only administrators can change. Secrets such as the device secret and keys are additionally stored in protected form.
Server and data
What the server knows
Device ID, device name, operating system and – per session – the supporter's name and address, time and data volume. No screen content, no input, no files, no passwords.
Address book encrypted only
If you use your address book on several devices via a profile, it is stored on the server in encrypted form only. Password and key never leave your devices.
Protection against abuse
The server throttles connection attempts, status queries and sign-ins per address and per device, and limits how many requests can reach a computer at the same time. The computers' device secret is never transmitted in URLs that could end up in logs.
Limits – and what you can do yourself
Don't let strangers in
The best technology is of no help if someone you don't know asks for access over the phone – supposedly “from Microsoft” or “from your bank”, for example. Only accept connections you are expecting yourself.
Compare the code on first contact
For a computer the supporter has never seen before, there is no known device key yet. In that case, only comparing the security code (or a supporter certificate) shows that nobody is sitting in between.
Strong passwords
For unattended access, let the program generate the password (16 characters) and only share it with people who need it. Where possible, additionally require a certificate or an address list.
Addresses are reported by the server
The address list protects well against a password that has been passed on. However, the supporter's address comes from the server; against a tampered server, only the supporter certificate helps.
Found a security vulnerability?
Please report it to us confidentially – we will deal with it straight away.