HCKConnect
← Legal

Security

How HCKConnect protects your sessions, its current limitations, and how to report a problem. HCKConnect is in beta.

Encryption

• End-to-end encrypted sessions. Screen video, audio, input, clipboard and files are encrypted between the two devices using an ephemeral X25519 key exchange and AES-256-GCM. Our relay passes this encrypted data along and does not record or store it.
• Transport security. Traffic between our apps and servers uses TLS.
• Fail-closed. Our apps refuse to send or accept session data in the clear if the end-to-end handshake hasn't completed.

Accounts and access

• Passwords are stored only as Argon2 hashes, never in plaintext.
• Optional two-factor sign-in, and sign-out from every browser.
• Failed sign-ins are rate limited and recorded in your activity log.
• Installed computers hold a token limited to connecting as that one computer. Removing a computer revokes it.
• Install links name the account that gains access before anything is installed, and can be turned off at any time.
• Quick Support asks the person at the computer before each connection. Codes work once and expire after 10 minutes.
• The computer is designed to show a notification and tray icon when a session is active.

Current limitations

We would rather be precise than over-claim:

• The end-to-end key exchange is not yet authenticated, so a compromised relay could in principle attempt to intercept a session. Adding a verification step is on our roadmap. HCKConnect is not "zero-knowledge."
• Encrypted messages don't yet have replay protection.
• Computer notes and other account data are stored on our servers without end-to-end encryption. Don't store passwords in notes.
• Sign-in tokens are currently sent in the connection address for live sessions, so they may appear in server logs.
• On Mac, a computer's connection token isn't yet stored in the Keychain.
• Our apps are not yet fully code-signed, so your system or antivirus may show a warning. Only download HCKConnect from hckconnect.com.

Reporting a vulnerability

We welcome responsible disclosure. Email support@hcktechnologies.com with "Security report" in the subject, details and steps to reproduce. We aim to acknowledge reports within 5 business days. Please give us a reasonable chance to fix a problem before disclosing it publicly, and don't access other people's data, disrupt the service or use social engineering. We won't pursue legal action over research that follows these guidelines.

Reporting misuse or a scam

If someone used HCKConnect to access a computer without permission, or pressured you into installing it:

1. Disconnect from the internet, and close Quick Support or uninstall HCKConnect (Settings > Apps on Windows).
2. Contact your bank if money or financial details may be involved, and report it to local police. In the US, you can also report it at reportfraud.ftc.gov.
3. Tell us at support@hcktechnologies.com with "Abuse report" in the subject, so that we can act on the account involved.