Safety

A remote-access tool hands someone else your computer. Everything below exists to make sure that only happens when you meant it to.

Read this first, before anything technical.

If somebody phoned, emailed or messaged you and asked you to install this app and read them a number — stop. That is the shape of almost every remote-access fraud there has ever been. No bank, no courier, no tax office, no "Microsoft technician" and no cryptocurrency exchange will ever ask for remote access to your computer. Whoever is on the other end will be able to do everything you can do, including open your online banking while you watch and while it looks like nothing is happening.

Close the app. Hang up. Call the organisation back on a number you looked up yourself.

1. Nobody gets in by knowing your number

Your DuoDesk-ID is an address, not a key. Someone who has it can make your computer ask you a question, and nothing else. Every incoming request produces a dialog that:

names the caller, their ID and their platform;
lists exactly what they are asking for, each one a checkbox you can turn off before accepting;
starts on Reject, and counts down to a rejection — an unanswered dialog is a refusal, never an acceptance;
warns you in plain words when the caller is an ID this computer has never let in before.

2. The unattended password

Set a password and the machine can answer when nobody is sitting at it. This is the one setting that genuinely opens a door, so it is worth understanding how it is handled.

The password never travels. Your computer stores a salt and scrypt(password, salt) — never the password itself. A caller proves they know it by returning HMAC(verifier, nonce) for a nonce that exists only for that one session. Recording the connection gains an eavesdropper nothing, and replaying it later gains them nothing either.
Eight characters minimum, and the app refuses the handful of passwords everyone tries first. Twelve or more, mixed, is the real advice — anyone with your password and your ID has your computer.
Three wrong attempts from an ID and that ID is refused for fifteen minutes.
Changing the password revokes every reconnect token, which is the only thing "I changed the password" can honestly mean.
Ask me anyway. A setting that keeps the accept dialog even for callers with the correct password — for a machine other people also use.
Password only. The opposite setting: refuse every interactive request outright. Nothing to click means nothing anybody can talk you into clicking.

3. Two-factor

A standard TOTP secret you add to any authenticator app. When it is on, the password alone is not enough: the six-digit code is checked on your own machine, with one step of clock drift allowed either way, and a wrong code counts as a failed attempt.

4. Deciding in advance

Under Security → Who may connect, a machine can be switched from "anyone who knows my ID, and I decide each time" to only these IDs. On that setting an unknown ID is refused before anything appears on your screen — nothing pops up, nothing rings, there is nothing to misclick. There is a block list for the reverse case.

5. What a session is allowed to do

Permissions are granted per session and enforced on the machine being controlled, not requested politely by the machine doing the controlling. A viewer that sends a keystroke it was not granted has that keystroke dropped on arrival. You can revoke any of them mid-session from the Sessions list, and the change takes effect immediately:

control of mouse and keyboard (off = watch only);
clipboard sharing;
file transfer — and incoming files can only ever land in Downloads, under a name stripped of anything that could point somewhere else;
audio;
the privacy screen, which blanks your display for anyone standing next to it while the session runs.

6. On the wire

Media and data ride WebRTC: DTLS 1.2 handshake, SRTP with AES-128-GCM for the picture, SCTP over DTLS for input and files. That is the same transport your video calls use.
Signalling runs over TLS to duodesk.io.
Registration is an Ed25519 signature over a server nonce, so an ID cannot be claimed by anyone who does not hold the private key that machine generated.
TURN credentials, when a relay is needed, are ephemeral — an HMAC valid for twelve hours, never a shared password baked into the app.

7. What the server knows

The rendezvous server introduces two machines and then forwards opaque blobs between them. It stores three things: which ID belongs to which public key, a line per session saying which two IDs talked and for how long, and a ban list. It never sees your screen, your keystrokes, your clipboard, your files, your file names or your password — the first two because the media path is end-to-end encrypted between the peers, and the rest because they are checked on your own computer before anything is sent.

Your own session log lives on your machine, in the app, under Sessions.

8. What the operating system still controls

On macOS, DuoDesk cannot show your screen without Screen Recording and cannot be controlled without Accessibility, both granted by hand in System Settings → Privacy & Security. The app says so on its front page when either is missing, and a caller trying to connect to a machine that cannot capture is refused with that exact reason rather than left staring at a black rectangle. On Wayland, capture goes through the desktop portal and may ask each time.

9. If you think someone is in your computer right now

Open DuoDesk and press Disconnect on the live session, or quit DuoDesk from the tray — either ends it instantly.
Disconnect the network cable or turn off Wi-Fi if you cannot reach the app.
Change the unattended password. That revokes every reconnect token that was ever issued.
Add their ID to the block list; it is written in your Sessions log next to the time they connected.
If they touched anything financial, call your bank from a different device.

The honest summary. DuoDesk's transport is as strong as a video call's and its defaults are cautious, but no amount of cryptography helps against a person who is talked into pressing Accept. The accept dialog, the stranger warning and the allow list exist for that reason, and they are the parts worth actually using.

Found a security problem in DuoDesk? Say so before you say it anywhere else — the app and this site are maintained by one person and a real bug will be fixed rather than argued with.