Security

Security

The design is one idea: the board is not a way in.

• It never sends a machine's token to a browser. The page is told where a machine is, never how to get into it. There is a test whose only job is to fail if that ever changes.
• The keys it holds are weak on purpose. A watcher token opens one read-only endpoint on one machine. Losing the board's config loses a list of session names.
• Its own token is compared in constant time, and it is taken out of the address bar on arrival so it is not left in the history of every phone that has opened the board.
• Referrer-Policy: no-referrer, so clicking through to a machine does not tell it where you came from.
• Two keys, two doors. Announcing cannot read; reading cannot announce.
• It refuses to start with an empty or short token, with a watcher token that equals the main one, or with a registration token that equals the board's.

What it does not protect you from

• It is plain HTTP by default. Anyone on the path sees the board's token go past once, in the address, and everything after it.
• It publishes your estate. Not a way in, but a list of every machine you run, what is on each, and how full its disks are. That is reconnaissance, handed over.
• may_run widens it. With that flag on a watcher, whoever holds the board's config can start and stop the things you listed, and stop those Argus servers if you allowed it. Still not a shell — the key gets 403 on files, sessions, ports and everything else — but it is no longer read-only.