Security Req. about fenix HOT 3 CLOSED

I think it's important to note that Fenix does not expose your desktop publicly. The sharing feature establishes a secure SSH tunnel to a public web server (provided by http://localtunnel.me), which proxies traffic to the desktop server. This explicitly forces SSL encryption over port 443. That is the only port localtunnel.me provides. So, localtunnel is the messenger.

Public <==> localtunnel.me <--> Desktop

People should not be running startups or side projects with Fenix, which is stated in the documentation. It is a desktop workflow tool, not a production server.

While there is obvious value in maintaining a secure desktop, I don't feel like the link contains information relevant to the users of this project. If Fenix directly exposed the user's desktop to the public internet, then I think this would be more relevant... but it is proxied over a secure and restricted channel.

from fenix.

Oh I see. I thought localtunnel.me exposed the IP :)

But also - why localtunnel? I usually avoid third party solutions like this as they can break when you least expect them to break.

from fenix.

SSH tunneling only works with a live server to tunnel through. Localtunnel.me is a free hosted solution with a node.js library (Fenix is built on node.js). That was the main reason I chose it.

That said, there are some limitations to localtunnel.me... mostly functional, not security. It's possible for people to create their own SSH tunnel, but it requires a fair amount of work. I have considered creating a Fenix localtunnel service with additional collaboration features... i.e. a turnkey "Fenix branded" solution. This would have to be a commercial offering though, and I'm not sure if there is enough community interest for this.

from fenix.