Security technical details

This page is for those who need to evaluate Walkie Desk from a technical point of view. For an overview, see Security.

It describes the service as it is today, in beta: when something changes we update it.

Overview

Walkie Desk has four parts: the program on the PC to be reached, the browser of whoever connects, the coordination server at walkiedesk.app and a relay server (TURN), used only when the two devices cannot connect directly.

1. Browser and walkiedesk.app: HTTPS and secure WebSocket (TLS). Used to sign in to the account and to exchange the session parameters, signed by the devices.
2. PC and walkiedesk.app: secure WebSocket (TLS) opened by the Windows service, which always verifies the server certificate and name, including revocation checks.
3. PC and browser: the session itself (video, keyboard, mouse, clipboard), over WebRTC and end-to-end encrypted. The coordination server is not on this path.
4. Relay: if a direct connection is not possible, the same encrypted packets go through the relay server, which does not have the keys to read them.

Encryption

The session uses WebRTC. Video travels over SRTP, with keys negotiated through DTLS (DTLS-SRTP); keyboard, mouse, clipboard and commands travel in data channels, that is SCTP inside DTLS. Keys are negotiated between the PC and the browser and stay there: neither the coordination server nor the relay server knows them.

In the DTLS handshake each device presents a certificate whose fingerprint is written in the session parameters (SDP). Those parameters are signed by the devices (below): so the browser knows it is talking to the right PC, and the PC to the right browser.

Between the devices and walkiedesk.app everything goes over HTTPS and secure WebSocket (TLS), with HSTS.

Video

SRTP with DTLS keys (DTLS-SRTP)

Keyboard, mouse, clipboard

WebRTC data channels: SCTP over DTLS

Device signatures

ECDSA P-256

Hash of the signed parameters

SHA-256

Pairing and QuickSupport

CPace, password-authenticated key exchange

Account passwords

Argon2id

Second factor

TOTP or WebAuthn (security key or passkey)

Components on the PC

libdatachannel, OpenSSL, libsrtp

Components in the browser

the WebRTC implementation of Chrome, Edge or Firefox

We use widely adopted open source components that we keep up to date; the full list (SBOM) is available on request from the authorities.

Device identity and session signing

Every PC with Walkie Desk and every trusted browser has its own ECDSA P-256 key pair:

• on the PC the private key is created in the TPM chip, non-exportable, when the PC has one; otherwise in the Windows key store, also non-exportable;
• in the browser it is a non-extractable WebCrypto key, kept in IndexedDB: the page can use it to sign, but not read it.

A person’s trusted browsers form a signed chain: the first one creates it, and every later browser joins only with the approval of an already trusted browser (with a one-time code) or with the account recovery key. The server stores the chain but cannot add a browser to it, because it does not have the keys to sign it.

Before each session the PC signs its connection proposal and the browser signs its answer, including the DTLS fingerprints. Each side verifies the other’s signature with a key it already knows, before using the parameters.

What this protects: if anyone on the coordination path, the server included, replaced a DTLS fingerprint to get in between the PC and the browser, the signature would no longer be valid and the session would be refused. The server puts the devices in touch, but cannot impersonate them. What this does not cover is explained under Known limitations.

What the server sees and does not see

The servers are in Italy; data and backups stay in the European Union. What we keep, for how long and with which providers: privacy notice.

Account

• Passwords from 12 to 128 characters, with no composition rules, stored only as an Argon2id hash.
• A second factor is mandatory for every account from sign-up: an authenticator app (TOTP) or a security key or passkey (WebAuthn). No SMS.
• Ten recovery codes, stored only as hashes.
• Repeated failed sign-in attempts are blocked; sign-ins and changes of password or second factor are logged as security events.
• Coming soon: passwordless sign-in with a passkey only.

Unattended access

• A PC with Walkie Desk cannot be reached until you pair it with an account.
• To pair it you generate a 9-character code in the user area and enter it on the PC. The code expires after a few minutes and accepts very few attempts. Part of the code is a secret created in your browser that never reaches the server: PC and browser use it with CPace to recognise each other and exchange public keys, so the server cannot pair a PC in your place.
• You can remove a PC from your account in the user area, and whoever administers the PC can revoke an account’s access from the Walkie Desk app on the PC.
• During every session the PC shows, by default, a red frame around the monitor with the name of whoever is connected and an End button. Whoever administers the PC can hide the frame in account sessions.

QuickSupport

• It runs without installation and with the user’s own rights; the person being helped does not need an account.
• It shows a 9-digit ID and a 6-character password. The password is never sent to the server: the computer and the technician’s browser use it with CPace to recognise each other. It is valid for one session only and changes after a few wrong attempts.
• The computer’s key is created at every start and stays only in the program’s memory: it disappears when you close it.
• Before each session a window shows who wants to connect: the session starts only if you press Allow; if nobody answers, the request is refused shortly after.
• During the session a red frame surrounds the screen and the End button closes it at any time. The frame cannot be hidden.
• When it closes, the program deletes the temporary folder it had created.

Against fake tech support scams: Protection against scams.

Signed programs and the OpenH264 codec

The Walkie Desk setup for Windows, its programs and QuickSupport are signed with Authenticode by the publisher iDev srl, with a timestamp: the signature remains verifiable even after the certificate expires. The third-party libraries included are not signed by us.

The OpenH264 codec is not included: the program downloads it from Cisco’s website and uses it only if its SHA-256 hash is the expected one.

How to check the publisher and the hash of a downloaded file: Security.

Updates and support period

• Walkie Desk for Windows shows a notice in its tray app when a new version is available. Automatic updates are coming soon.
• QuickSupport is not updated: it is downloaded from the website every time, so it is always the latest version.
• Support period: during the beta only the latest version receives fixes. From the launch, each version receives security fixes until 12 months after the next version is released, and the product is supported for at least 5 years from the launch.
• Fixed vulnerabilities are published in the security advisories, with the affected versions and the version that fixes them.
• The software bill of materials (SBOM) is available on request from the authorities.

Known limitations

The code of the web app, that is the user area and the viewer the technician connects from, is delivered by the walkiedesk.app server on every visit. Signing the parameters protects sessions from anyone altering the coordination messages, but not from a compromised server that delivered modified code to the browser.

Current mitigation: a strict Content Security Policy, which allows only scripts from the same domain and no third-party resources, except Stripe’s payment component on the Subscription page only. A signed viewer, verifiable without trusting the server, is a planned improvement.

Reporting a problem

• Disclosure policy: how to report a vulnerability and what to expect.
• Security advisories, also as an Atom feed.
• Report an issue: vulnerabilities, abuse, other security or privacy problems.
• Email: security@walkiedesk.app.