ControlKey

Your password gets you into your account. It does not, on its own, let anybody run a command on your machines. That takes your ControlKey - which, when running in Medium or High Security mode, never leaves your PC.

What a ControlKey is

The first time you sign in to the SupportFlow Client on a PC, it asks you to create a ControlKey password. From it, together with your username, your PC works out your ControlKey: a cryptographic signing key that is never sent to us. It is a separate password from your account password, and neither one gives the other. Keep a copy of it somewhere safe - we have no way to recover it. (Under Advanced Options you can instead use Full ControlKeys - a random key kept on that PC and saved to a file - or import them from a backup.)

When a station is authorized, it keeps the public half of each key allowed to command it - enough to check a signature, never enough to make one.

How a command is protected

1. You ask your assistant to do something to a station - run a command, restart a program, move a file, reboot.
2. The SupportFlow Client on your PC signs that exact command with your ControlKey, addressed to that one station, time-stamped, and marked so it can be used only once.
3. Our server passes the signed command on. It cannot change it, and cannot make one.
4. The station checks it: is the key one it trusts, is the command addressed to it, is the signature right, is it fresh, has it been used before. If any answer is wrong, it refuses.

That applies to everything your assistant asks a station to do: running commands, starting and stopping programs, clicking and typing, listing folders and moving files, reading its configuration, taking a live screenshot, and rebooting. (What the station has already reported - its status, its last screenshot - is simply read back, and needs no signature.)

Sealed end to end, in Medium and High Security

With the SupportFlow Client in Medium or High Security (for Medium, SupportFlow Client 1.5.44 or later) and a station on Endpoint 1.0.243 or later, the commands your assistant sends that station - running commands, starting and stopping programs, clicking and typing, listing folders, live screenshots and restarts - travel encrypted so only that station can read them, and the station's answers come back encrypted so only your PC can read them. Files you copy to or from it, and its configuration file, move the same way. Each answer is checked on your PC before your assistant sees it: one that was altered on the way is not shown.

The Client also remembers each station's key. If a station is ever reported with a different one - after it was reinstalled or reset, say - the Client keeps using the key it knows, tells you, and lists the station under Options › ControlKey › Pending Station Authorizations as KEY CHANGED. Compare the fingerprint shown there with the Station key line in the station's own status window before you accept it.

To use it: keep your stations' Endpoints and your SupportFlow Client up to date (the Client's Update All updates the Endpoints). Medium and High Security both do this; they differ only in where your ControlKey comes from.

If somebody steals your password

They can sign in to the portal as you - so choose a strong password and keep your recovery phrase safe. But they cannot sign commands: the signature needs your ControlKey, and that is on your PC, encrypted for your Windows account. A SupportFlow Client they install on their own PC would make a new key, which your stations do not trust.

A new key has to be approved, and every approval is itself signed by a ControlKey - your own, from a PC you already use, or your Administrator's or a Manager's - so a password on its own can never approve one. Even then, the approved key reaches your stations only after a Manager's SupportFlow Client has asked the person at that PC, and they have said yes.

Our server cannot command your stations

In Medium and High Security our server never holds a key that your stations trust, and every station checks each command itself. It has no key to sign a command with, and it cannot make a key trusted either: approvals are signed by your own keys. A station carries out only what a key it trusts signed for it - once.

A new station can be authorized only by your organization's Administrator or a Manager. When it is installed, the station learns your managers' keys from our server, so it accepts its first authorization only from one of those keys.

A key that is withdrawn (revoked) is refused at once, and your stations are told to stop trusting it too. Revoking a key also withdraws every key it vouched for.

Keeping your organization safe

• Give every account a strong password of its own - above all your Administrator and Managers, who approve new keys.
• Keep your recovery phrase somewhere offline and safe.
• Now and then, ask your assistant to list your organization's keys, and revoke any you do not recognise.
• When somebody leaves, remove them from the organization - their keys are withdrawn at the same time.
• Keep Portal miniviewer requests on Ask if you want to approve each time somebody opens a station's screen from the portal (see Security levels).
• Lock your PC when you step away: your ControlKey works for whoever is signed in to your Windows account.

Using a second PC

There are several ways to give another PC your authority - see Managing your ControlKey for each of them, and for backing your key up.

The last word is at the station

Whatever happens elsewhere, somebody at a station can clear its trusted keys with Reset Authorization in its status window, optionally with a 48-hour lockout during which it accepts nothing at all. Then authorize it again from your SupportFlow Client. See Security levels.