ReCon

Remote support for Windows, by EA Tech Partners.

I have an invitation

Enrolling needs a single-use invitation from an operator who is already signed in. On a fresh install the server prints a bootstrap token to its log at startup; that one stops working as soon as the first operator exists.

Development PIN sign-in is enabled on this server. A PIN is a shared secret: it can be phished, guessed and reused. Everything that makes a passkey worth having is absent. Unset DEV_PIN to remove it.

No operators are enrolled yet. The server printed a bootstrap token to its log at startup. Use it to enrol the first operator; it stops working the moment one exists.

What a passkey buys here

Your browser ties the credential to this site's address, so a convincing copy of this page gets nothing. Nothing is typed and nothing is stored that could be stolen and replayed.

It also produces the key that signs each session. That key never reaches this server — which is why somebody who took the server over could list your machines and open none of them.

Not yet independently audited. Read the project's threat model before relying on it.

—

Devices

Machines with the agent installed.

idle
Not yet audited, and no consent prompt on the endpoint. The switches chosen at install time decide for every session; nobody at the far end approves one. The session banner also lives inside the agent, so killing the agent removes it.

Endpoints

—
  • Loading…
Connect by hand

For a device that is not in the directory. The agent still refuses everything until it is shown a signed request naming it, so knowing an allocation grants nothing.

No session

Pick an endpoint and choose what to ask it for.

Choosing there only decides what is requested. What you get is what the machine at the other end grants, and it may grant less.

—
Waiting for the first frame…
— — — 0 frames 0 input

This device is not the one you verified

A device answered on this allocation with a different identity key than the one remembered here. The session was refused before any data moved.

This happens when an agent is genuinely reinstalled. It also happens when somebody is impersonating it. There is no way to tell from this screen, so do not guess: confirm out of band before forgetting the old key.

Verify this connection

Read this number to the person at the other machine. The agent prints the same one. If they differ, something is between you — do not continue.

—
Peer fingerprint
—
Granted by the host
—

Connect to an endpoint to verify it.

From the remote machine

Not granted for this session.

To the remote machine

Not granted for this session.

Reading the host's clipboard and writing to it are separate permissions, because they are different risks.

Send to the host

Not granted for this session.

Drop a file here, or click to choose

Files land in a folder the host chose. Nothing here can name a location on that machine, and an existing file is never replaced.

Offered by the host

Not granted for this session.

  • Nothing offered.

Transfers

    Install the agent on a Windows PC

    Choose what the machine will offer, then run one line on it. Everything is off unless you turn it on, and nothing here can grant administrative rights.

    Organisation key fingerprint
    —

    The installer asks whoever runs it to confirm this. Compare it against what recon-roster init printed. It came from this server, and a server that had been compromised could send a different one — that comparison is what makes this safe, and nothing else is.

    After it is installed

    1. It appears in Devices within ten seconds. If it does not, the agent is running but cannot reach the directory — its own log says which.
    2. Sign a new roster. An operator can only open a session on a machine once their key is in a roster signed by the organisation key. Export from Team, sign offline, upload.
    3. Verify on first contact. The first connection shows a number the agent prints too. Compare them once; after that the key is pinned and a substituted machine is refused automatically.

    Invite an operator

    A single-use token, good for a day. Whoever holds it can enrol a passkey under a name of their choosing, so send it the way you would send a password.

    Who may open a session

    Enrolling makes somebody an operator of this console. It does not make them an operator of any machine. That takes a roster signed with the organisation key, which is not on this server and cannot be.

    1. Export the operator list.
    2. Sign it offline with recon-roster sign, on the machine that holds the organisation key.
    3. Upload the signed roster. Agents pick it up within five minutes.

    Activity