Security
How the service defends itself.
The tunnel is the product; everything around it is there to keep the tunnel honest. This page is about the everything-around-it.
The gateways
Cheap to say no to.
Every handshake message carries a MAC that costs about 500 nanoseconds to check and guards a key exchange that costs about 250 microseconds. Unknown senders are rejected before any real work. Under load, cookies bound to the sender’s address are required. Replies are never larger than requests, so a gateway cannot be aimed at someone else.
Silent to scanners.
A packet without a valid MAC gets no reply. A port scan sees a closed port.
Clients cannot reach each other.
A packet from one client addressed to another client, or to the gateway itself, is dropped in software before it reaches the operating system — and again by a firewall rule if the first barrier is ever wrong. Source addresses are checked against the lease.
Keys are born on the node.
Each gateway generates its own key pair on first start. The private key is never in a provisioning file, a configuration repository or a deployment tool’s state.
Your account
Passwords are hashed with Argon2id.
Memory-hard, so a stolen database is expensive to attack. Minimum twelve characters; no other rules.
Sessions are random, stored hashed, and short-lived.
A sign-in token is 32 random bytes. The database holds only its hash. Sessions last 30 days and die when you sign out.
The portal never handles a token.
The browser session is a cookie JavaScript cannot read, scoped to the same site, sent only over HTTPS. A script injected into the page would have nothing to steal.
Two-factor authentication, the real kind.
Time-based codes from an authenticator app, encrypted at rest, with single-use recovery codes. No SMS — SMS can be intercepted and a carrier can be talked into redirecting it.
Your card is not our problem to protect.
The payment form is served by the processor and confirmed with them directly. Our servers never see a card number, which is the cheapest possible way to never leak one.
The app on your device
The app never sees your password.
Sign-in happens in your browser, on the account site, with your second factor if you have one. You approve the connection there — the page names the app and its platform — and the app receives a session of its own through a one-time code bound to that app. There is no password field in the app to phish or to mishandle.
Only the background service is privileged.
It owns the network adapter and the routing table. The window you see runs unprivileged and talks to it over a local socket; a bug in the interface cannot reach the network stack.
The interface is sandboxed.
No access to the system from the rendered page, a content security policy that allows nothing remote, and no session token anywhere the page can read it.
The tunnel does not depend on the window.
Close it and the service carries on. A crash in the interface is an inconvenience, not a disconnect.
Nothing is downloaded and run at start-up.
The Windows network driver is pinned by hash and signature at build time and shipped inside the installer. There is no auto-update channel yet — which is a gap, and also means nothing can be pushed to you.
Next
- No independent audit yet. When there is one, it will be linked here.
- Installers are not code-signed. Windows SmartScreen will warn, and macOS will need Gatekeeper overridden. Check the checksum on the download page until this is fixed.
- No auto-update. You will have to download new versions yourself for now.
- The protocol has no traffic-analysis resistance and no post-quantum key exchange. The technology page lists what is missing from the protocol itself.
Found something?
Write to [email protected]