How Polpo Desk keeps you secure
What you need to know about end-to-end encryption (WebRTC DTLS-SRTP), connection approval, one-time passwords, brute-force protection and account security.
Last updated:
Remote support means handing control of your computer to someone else. That's why Polpo Desk is built on three principles: session content is end-to-end encrypted, you decide who connects, and passwords are protected so they can't be guessed.
End-to-end encryption
The screen image, keyboard and mouse control, chat messages and transferred files of a remote session are transmitted end-to-end encrypted (WebRTC DTLS-SRTP).
- Whenever possible, the picture and data flow directly between the two devices.
- If your network doesn't allow a direct connection, the traffic goes through a relay (TURN) server; the content stays encrypted there too.
- Our servers only introduce the two sides to each other. They don't see or store session content.
Who decides on a connection?
An operator can connect to your computer in one of three ways:
| What the operator knows | What happens |
|---|---|
| Only Your Connection ID | The Incoming connection request window opens on your screen. No connection is made until you click Allow Connection. |
| ID + the one-time Session Password | The connection is accepted without asking. Sharing the password means you allow it. |
| ID + a permanent access password | Unattended access: the operator connects without asking. It only works if you turn it on. |
The approval window shows the name, company and profile photo of the person who wants to connect. The server sends this information from the operator's Polpo Desk account. If you see a name you don't know, press Reject.
During a connection, click the client's status line to see the Connected operators list, and end any operator's connection at any time with Disconnect.
You also stay informed and in control during the session:
- If an operator records the session, the client shows a red This session is being recorded by the operator banner for as long as the recording runs. The recording is saved only on the operator's computer, never on our servers.
- With Allow file transfer and Allow clipboard sharing in the client settings, you decide whether files and clipboard content may be exchanged. See Client security settings.
One-time session password
- The Session Password in the client has 6 digits.
- A new password is generated every time the client registers with the server (when it starts, or when it reconnects after losing the connection).
- The Renew Password button makes the old password invalid immediately.
- It isn't a permanent key; after a support session, just renew it to make it useless.
Brute-force (password guessing) protection
Connecting by guessing the password is practically impossible, because the server limits wrong attempts:
- If 5 wrong passwords are entered for a device within 15 minutes, password connections to that device are locked for 15 minutes and the session password is renewed automatically.
- If an operator account makes 20 wrong attempts within 15 minutes, that account's password connection attempts are paused for 15 minutes.
- A password can be entered at most 3 times for a pending request; after that the request is dropped.
Unattended access
To connect to your own computers or to servers you manage while nobody is there, you can set a permanent password. This feature is off by default and only works if you turn it on in the client. The permanent password isn't stored on the server as plain text, but as a one-way hash. If an operator lets the console remember the permanent password of a device, that copy is stored encrypted on the server, tied to the operator's account, and is never sent back to the browser; if it no longer works, the remembered copy is deleted. Details: Setting up unattended access.
Account security
- Passwords: Account passwords are stored on the server only as a one-way hash (PBKDF2) and must be at least 8 characters long.
- Session cookie: Your panel and console session is kept in a cookie that JavaScript can't read (HttpOnly), and requests that change data must carry an extra security header. This prevents other sites from sending requests on your behalf.
- Bot protection: Sign-in, sign-up and contact forms use Cloudflare Turnstile verification.
- Email verification: Accounts that don't verify their email address can't start remote connections after a short trial period.
- Encryption of stored data: Account data such as email addresses, names, billing details, support ticket messages and the IP addresses in audit records is stored encrypted in the database.
Team management and traceability
Admins can immediately suspend or delete the accounts of employees who leave, and see in the Audit Log who signed in when and which device they connected to. See Adding users and roles and Session and audit reports.
To adjust the security options in your client, see Client security settings.