Dev.to Security πŸ” Cybersecurity πŸ‘ 0 πŸ“– 1 min read

Remote access tools should be a little annoying on purpose

Think about the usual scam call. Someone pretends to be a bank, a delivery company or the police, and talks you into installing a remote tool and reading out a code. The faster the tool is, the easier that is. So a safe

Think about the usual scam call. Someone pretends to be a bank, a delivery company or the police, and talks you into installing a remote tool and reading out a code. The faster the tool is, the easier that is.

So a safer design should slow things down and make the person in control feel in control. Here is how AcrossView does it, based on what’s on its website.

  1. The person being helped starts it

They open a page in their browser, or the Windows app, and read a 9-digit ID to the helper. The helper doesn’t get in by themselves.

  1. The request shows who is asking

It also says when the person’s identity is not verified. A scam warning is shown before anything is shared.

  1. The Allow button waits five seconds

It’s a small thing, but it stops people from tapping through in a panic.

  1. Seeing the screen and controlling it are separate

A helper can look without touching anything. Mouse and keyboard control needs a second yes, and the person can stop it at any moment.

  1. Both screens show the same six-digit code

If the codes match, nobody is sitting in the middle. The site says support sessions use X25519 key agreement and AES-256 sealing, and that the keys stay on the two devices.

AcrossView: https://acrossview.com/
Safety page: https://acrossview.com/safety/
Security page: https://acrossview.com/security/

πŸ“° Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β€” full credit and traffic to the original publisher.