How MoLock Remote keeps your screen private
A remote session carries your whole screen, every key you press and the files you move. Here is how MoLock Remote seals all of it between your browser and your PC — and the short list of things the service can still see.
Mahmoud Mohamed · 10 min read
YOUR BROWSER
Opens the picture here
- Fresh keys for every session
- Checks your PC's signature
- Shows the safety code
THE RELAY
Passes on, cannot read
- Sees: time, size, browser type
- Never sees: screen, typing, files
- Holds no key
YOUR PC
Seals the picture here
- Proves itself with its device key
- Key kept in its security chip when there is one
- A visible indicator all session
Why a remote session needs more than a padlock in the address bar
When you control your PC from a phone, a lot travels over the internet. Your PC sends a constant stream of pictures of its screen: your inbox, your bank tab, the document you are editing. Your phone sends back every tap, every key and every word you type, including passwords you enter on the PC. Add the clipboard you sync and the files you upload or download, and a session carries some of the most private data you have.
The padlock in your browser protects the connection between your browser and a server. That is useful, but it means the server itself receives everything in readable form before passing it on. For a remote desktop, that would make the service a window onto your screen. MoLock Remote is built so that this window does not exist: the service helps the two ends find each other, and then it only ever handles messages it cannot read.
The relay: a courier that carries sealed envelopes
Your phone and your PC are rarely able to connect to each other directly. Home routers, office networks and mobile carriers all stand in the way. So both sides connect to the MoLock relay, a small service that exists only for the length of your session, and the relay passes messages from one side to the other.
Think of the relay as a courier. It knows that an envelope came from your browser and must go to your PC. It can weigh the envelope and count how many it carried. It cannot open it, because the envelope was sealed before it was handed over and only the other end has what it takes to open it.
YOUR BROWSER
Opens the picture here
- Fresh keys for every session
- Checks your PC's signature
- Shows the safety code
THE RELAY
Passes on, cannot read
- Sees: time, size, browser type
- Never sees: screen, typing, files
- Holds no key
YOUR PC
Seals the picture here
- Proves itself with its device key
- Key kept in its security chip when there is one
- A visible indicator all session
That is what "end-to-end" means here. The two ends are your browser and your PC. Everything in between — your Wi-Fi, your mobile network, the relay — only sees sealed data.
A fresh pair of keys for every session
Encryption needs keys, and the obvious question is where they come from. MoLock Remote does not reuse a long-lived key for your sessions. Each time you press Connect, your browser creates a brand-new key pair, and your PC creates its own. These keys are called ephemeral: they exist only for this one session and are discarded when it ends. A key that no longer exists cannot be stolen later, so an old recording of sealed traffic stays unreadable even in the future.
Each key pair has two halves. The private half never leaves the device that made it. The public half is meant to be shared, and it is the only part that travels through the relay.
Getting the same secret without ever sending it
Here is the clever part. Your browser and your PC need the same secret to seal and open messages, yet that secret must never cross the internet. They achieve it with a technique called elliptic-curve Diffie–Hellman (ECDH), and the idea behind it fits in a kitchen analogy.
Imagine each side has a secret spice it never shows anyone. Both start from the same base sauce, which everyone may know. Your browser mixes its secret spice into the base and sends that mixture to the PC. The PC does the same with its own spice and sends its mixture back. Now each side adds its own secret spice to the mixture it received. Both end up with exactly the same final blend, but the blend itself never travelled — only the half-finished mixtures did, and nobody can work backwards from them to the secret spices.
In the mathematics, the "mixtures" are the public keys and the "final blend" is a shared secret. The relay sees both public keys pass by and still cannot compute the secret.
One key for each direction
From that shared secret, both sides derive two separate keys: one for messages from the PC to your browser, and another for messages from your browser to the PC. The keys are also tied to the unique number of your session. Using a different key in each direction means a message can never be bounced back to the side that sent it and accepted as genuine.
Every message sealed, numbered and checked
Each message — a piece of the screen, a key press, a block of a file — is sealed with authenticated encryption. "Authenticated" means the seal does two jobs at once: it hides the content, and it detects any change. If even one bit of a sealed message is altered on the way, the other end refuses to open it.
Every message also carries a counter that must always go up. Your PC and your browser each remember the last number they accepted. A message with an old number — for example, a copy of an earlier key press that someone tries to send again — is rejected. So is anything that does not open correctly. After a few such failures, the session simply ends rather than keep going in doubt.
The relay can count your messages. It cannot read a single one.
If your network drops for a moment and the PC reconnects within a minute, it starts a fresh handshake with new keys, and both counters start again. You do not have to do anything; the picture just comes back.
How your browser knows it is talking to your PC
Encryption protects a conversation, but you also need to be sure who is on the other side. Otherwise someone could pretend to be your PC and show you a fake screen, or quietly record what you type.
That is why your PC signs its part of the handshake. When you linked the PC to your account, it created a device key of its own — kept in the PC's security chip when it has one — and your account recorded the public half. When a session starts, the PC signs a short statement that includes the session number and both sides' new public keys. Your browser checks that signature against the public key your account already knows for that PC.
- If the signature matches, the browser knows the keys really came from your PC, and the session continues.
- If it does not match, the browser stops at once and shows "This PC could not prove its identity". Nothing from that connection is shown or sent.
Because the signature covers the session's new keys, it cannot be copied from an earlier session and reused.
The safety code: checking that nobody is in the middle
The signature proves the PC's identity using information stored in your account. For people who want an independent check that does not depend on the service at all, MoLock Remote also shows a safety code: six digits, such as 482 913, calculated from both sides' public keys for this session.
In your browser
482 913
Session panelOn your PC
482 913
Session indicatorSame digits? Nobody is in the middle — not even the service itself.
Your browser and your PC calculate the code separately. If anyone had replaced a key in the middle — including the service itself — the two screens would show different numbers. Comparing them is optional and takes a few seconds:
- Find the code in the viewer. It appears in the session panel of your browser as soon as the session is set up.
- Find the code on the PC. MoLock shows the same kind of code on the PC while the session is live.
- Compare them. If you are next to the PC, just look. If someone you trust is there, ask them to read it to you on a call. Same six digits: you are connected straight to your PC.
What the service can see, and what it can't
A relay that knew nothing at all could not connect anyone, keep sessions within limits or show you a history. So the service keeps a small record of each session. We prefer to list it exactly.
| The service can see | The service can never see |
|---|---|
| That a session took place, on which account and which PC | Anything on your screen |
| When it started and ended, and why it ended | What you type, including passwords |
| The browser type, and whether it was a phone or a computer | Your mouse movements and taps |
| The approximate country and a shortened network address | Your clipboard |
| How much data flowed each way, and how many frames | Your files, their names or their contents |
| Whether recording was switched on | The contents of any recording |
The public keys for each session also pass through the relay. That is by design: public keys are meant to be seen, and they are useless without the private halves, which never leave your browser and your PC.
Transparent by design: no silent sessions
Strong encryption keeps outsiders out. Transparency keeps you informed about who is in. MoLock Remote never runs quietly in the background:
- An indicator on the PC. While a session is live, the PC shows a small MoLock indicator (and, if you choose, a thin amber frame around the screen). It is excluded from the picture sent to you, so it never gets in your way. The person at the PC can end the session from the indicator or with Ctrl+Alt+Shift+X.
- A message on Telegram. The official bot tells you when a session starts — on which PC, from which browser and country — with a one-tap ⛔ End session button, and again when it ends.
- An activity log. Every session appears in your account with its start, end and duration, next to an End all sessions button.
- Off switches on both sides. The PC can turn Remote off in its settings, and your account can switch off remote control for any single PC.
- 🖥 Remote session started on «DESKTOP-MO»
Chrome on Android · Egypt⛔ End session - Session ended · 12 min · recorded in browser
The Remote page shows each of these in more detail.
The honest limits
Encryption is only one part of keeping a remote session safe. These are the edges worth knowing:
- Your account is the key to the door. Signing in to your account is enough to start a session — that was a deliberate choice, to keep Remote simple to use. It also means that anyone who has your account password and your Telegram sign-in code could start one. Use a password you use nowhere else, and treat a session alert you did not expect as a reason to press End session and change your password.
- Your phone or browser must be trustworthy. The session is sealed on the way, but your browser shows the screen in clear form, because that is its job. If the phone itself is compromised, whoever controls it sees what you see.
- A downloaded recording is an ordinary file. If you record a session and save the video to your phone or PC, it is protected only by that device. A recording you save to My files in your account is stored encrypted.
- Windows' own secure screens are not shown. The Windows sign-in screen, its lock screen and administrator prompts are deliberately protected by Windows from being captured or controlled. When one appears, the picture pauses and the viewer tells you why.
Where to go next
For the bigger picture of how MoLock encrypts your notes, photos and files, read End-to-end encryption, in plain words. To set up and use Remote from your phone, follow the complete guide. The security section of the Remote page sums all of this up on one screen, your account is where sessions start and end, and the privacy policy lists everything MoLock keeps and for how long.