I have used Remmina over SSH and Tailscale (and generally don’t trust remote desktop tools), which is mentioned in various places by my operating system provider.
How does RustDesk compare with that?
RustDesk now supports true unattended remote access on Wayland
61–70 of 176 posts
Re: RustDesk now supports true unattended remote access on Wayland
#62Earlier quoted context omitted.
[flagged]
> most software in the world uses a basic hash like MD5 or SHA-256 rather than a key derivation function For passwords? Where do you get that information?
Experience? Looking at codebases? The one in question does, in fact, use SHA-256. HN is a bit of a bubble because there's a large demographic of FAANG-tier employees here who work at big tech or unicorn startups, but most software in the world is not made by FAANG or unicorn startups, and the standards are way, way lower than you might think they are if you're used to living in this bubble. For software development practices in general, not just password storage. I think it's taken for granted that every single person on HN uses VCS, but even that is a luxury in many real-world working environments outside of SV.
Even if only 10% of the services you use use MD5/SHA-256 (although I certainly would expect it to be >50% if we could do a large-scale study), why accept your password being easily compromised 10% of the time?
Re: RustDesk now supports true unattended remote access on Wayland
#63RustDesk still does not support encrypted connections when self hosting: https://github.com/rustdesk/rustdesk/issues/3714
>does not support encrypted connections when self hosting
Factually incorrect. If you self host a relay/coordination server - encryption works as documented.
Re: RustDesk now supports true unattended remote access on Wayland
#64Earlier quoted context omitted.
It's open-source, so just build it yourself with the tiny change. Something this trivial could be done with a 30 second prompt at this point, so there's not even an excuse of "too much effort". I will note that the XKCD password scheme being proposed there is, in fact, completely insecure. A modern consumer GPU can crack "four random English words" in a day. You can argue that it's the user's choice to be allowed to…
Did you even check what hash they are using?
SHA-256. Did you? My point isn't constrained to this exact service, though. My point is that the XKCD-style passphrase is in general not secure. If you make a habit of using it, assuming that the service in question will take care of securing it super duper safely on your behalf, you will get bitten when a service doesn't do this.
Re: RustDesk now supports true unattended remote access on Wayland
#65Earlier quoted context omitted.
Your statement is not entirely accurate. This only applies when using Direct IP Access on local networks, which is off by default. Their justification and invitation to PRs is the final comment [1] on the issue you linked. Why are you leaving this information out of your comment? 1 - https://github.com/rustdesk/rustdesk/issues/3714#issuecommen...
It may only apply to Direct IP Access, but isn't that what many would expect (not trusting middleman to be secure?)
Have you tried reading the docs?
>RustDesk is a single open-source application (AGPL) with its own architecture. Clients connect outward to an ID/rendezvous server, which brokers a peer-to-peer or relayed session. Per the RustDesk documentation, traffic is end-to-end encrypted (built on NaCl)
Re: RustDesk now supports true unattended remote access on Wayland
#66Earlier quoted context omitted.
I disagree, modern software should make encrypted connections over something like HTTP3 or QUIC directly so true secure end to end connectivity works. This would make VPN software such as tailscale obsolete.
So I'm supposed to set up PKI before I can open a remote console connection? Please just make it work seamlessly with my existing SSH credentials. Like SFTP.
You could just make use of public oidc/oauth2 providers like Google/Github/Microsoft/Cloudflare Generic OIDC or heck, even your bluesky account via ATProto oauth
But yeah, you could also make use of your ed25519 ssh public key as client certificate and accept based on fingerprint like ssh
Re: RustDesk now supports true unattended remote access on Wayland
#67Earlier quoted context omitted.
> A modern consumer GPU can crack "four random English words" in a day. [...] but arguing that that scheme is actually secure is just wrong. Let me do just that! This is a networked service. You send your password (or a hashed form) to it, and it validates it. You don't have the local hash to bruteforce it offline. Even if we only consider the top 10k english words, it's 10000^4. It's going to take years to bruteforc…
> This is a networked service. You send your password (or a hashed form) to it Hopefully neither. But given everybody involved in VNC seems to be the same batch of clueless morons who built all those PHP web forums twenty years ago with MD5 as the password hash, who knows what they cobbled together. Maybe an expert can chime in about what actually happens here? Yes, for a sensible scheme this can't work.
I’m not an expert in RustDesk, but I did take a quick look at the code, and it’s filled with massive red flags like [1], where it appears the general mechanism is SHA256(SHA256(password++salt)++challenge). I can’t even tell if the whole thing is vulnerable to trivial MITM ([2] makes it sound like it might be; while investigating, I ran into the concerning comment [3], “fall back to non-secure connection in case pk mismatch”). I can’t find any actual documentation of the protocol and it’s a custom thing built on NaCl boxes, yikes. [4] generates a keypair on the fly for a new connection to sign the box containing the symmetric key generated at the same time…
I would recommend never using this software.
[1]: https://github.com/rustdesk/rustdesk/blob/7aa98d43cf1962a7a2... [2]: https://github.com/rustdesk/rustdesk/discussions/8392 [3]: https://github.com/rustdesk/rustdesk/blob/7aa98d43cf1962a7a2... [4]: https://github.com/rustdesk/rustdesk/blob/7aa98d43cf1962a7a2...
Re: RustDesk now supports true unattended remote access on Wayland
#68RustDesk still does not support encrypted connections when self hosting: https://github.com/rustdesk/rustdesk/issues/3714
Would be nice if they did support that, but on a LAN you can always encrypt at layer 3 with WireGuard.
Re: RustDesk now supports true unattended remote access on Wayland
#69Earlier quoted context omitted.
Tailscale, or any encrypted mesh overlay is perfect for this. Infact I prefer it that way. Rustdesk can do what it does best at its core.
I disagree, modern software should make encrypted connections over something like HTTP3 or QUIC directly so true secure end to end connectivity works. This would make VPN software such as tailscale obsolete.
so without tailscale or any other intermediary turn service how does my computer behind a NAT connect to another computer behind another NAT
Re: RustDesk now supports true unattended remote access on Wayland
#70Earlier quoted context omitted.
It may only apply to Direct IP Access, but isn't that what many would expect (not trusting middleman to be secure?)
Have you tried reading the docs? >RustDesk is a single open-source application (AGPL) with its own architecture. Clients connect outward to an ID/rendezvous server, which brokers a peer-to-peer or relayed session. Per the RustDesk documentation, traffic is end-to-end encrypted (built on NaCl)
Not yet...good to chastise me on this, but in my defense, I am at work, and am just trying to get a sense of this, as I would like to move away from VNC.