RudyDesk Security: What Is Protected and What Is Up to You

What we do not have

We do not keep your sessions, do not record the screen and have no access to your files. The server exists so two devices can find each other; after that they talk directly.

Encryption

Screen, sound and data — WebRTC protects them with DTLS-SRTP. The keys live on the devices; the server never holds them.

Remote command line — a shared key is derived with ECDH, commands and replies are encrypted with AES-256-GCM. Every session gets fresh keys.

Passwords — stored as a bcrypt hash. The original password cannot be recovered from storage.

Against password guessing

The lockout grows with the number of failed attempts:

• 5 attempts — a 5 minute pause
• 15 attempts — one hour
• 30 attempts — access closed; only the machine itself can lift it

Two-factor login

TOTP is supported: Google Authenticator, 1Password, Aegis — any app that follows the standard. Turning it on gives you five recovery codes; write them down, they are what saves you if the phone is lost.

Who may connect

Set a list of allowed numbers and every other call is refused without asking you. There is a blocking list too, for those you would rather never see.

What is up to you

• Use a password longer than four characters, and not the one you use everywhere
• Turn on two-factor login on a machine that is reached while you are away
• Check the number of whoever asks for access before you press "Allow"