Every device has its own key
When DeskDart is installed, the device makes its own Ed25519 key, which never leaves it. Our server ties your 9-digit address to that key, so nobody else can take over your address, even with access to the server.
Security
Remote access you can trust.
A remote desktop app can see and control a computer, so it has to be built for safety from the first line of code. Here is how DeskDart does it, in plain terms.
Encrypted from one device to the other
Sessions run over WebRTC with DTLS encryption, the same technology browsers use for video calls. Before a session starts, each device signs the description of its encryption with its own key. A server in the middle cannot swap in its own keys without the other side noticing, so it can neither watch nor take part.
It notices when a device changes
DeskDart remembers the key of every device you have connected to. If the device behind an address suddenly has a different key, it stops and tells you before anything is shown. Each device also has an 8-character key code you can read out over the phone to compare.
You approve every session
Unless you set up unattended access, someone at the computer accepts each connection, and sees who is asking and whether that device has connected before. They can switch control off or end the session at any moment.
A password that never leaves your computer
Unattended access uses OPAQUE (RFC 9807), a password protocol designed so the password is never sent, not even in scrambled form. Your computer keeps only what it needs to check a login, protected with Argon2id. Our server passes the login along but learns nothing it could use to guess the password, so every guess has to go to your computer.
Two locks, and limits on guessing
You can add a 6-digit code from an authenticator app (RFC 6238). Each code works once. After three wrong tries a device has to wait 30 seconds, then longer with every miss, up to an hour, and devices that have never logged in share a small hourly allowance, so a password cannot be guessed by brute force.
Built against support scams
Scammers love remote desktop apps. DeskDart shows plainly when a new device is asking to connect, and it refuses to turn on or change unattended access while another device is connected or asking. A caller cannot talk you into handing them permanent access mid-session.
Signed updates
Update notices are signed with a Veldaron key that the app checks before it downloads anything, and the download must match the size and SHA-256 hash in the signed notice before it installs.
Before launch
Checked by people who try to break it.
DeskDart is still in development. Before it is offered to the public, we plan an independent security test of the apps and servers. Found something that worries you? Tell us at contact@veldaron.com.