How your phone reaches it
Over your own private network, straight to the machine. Nothing you look at travels through beafk cloud.
Your machine listens on 127.0.0.1 — its own loopback, which nothing outside
the machine can reach. No port is open to the internet. So how does a phone on a
train get to it?
Your own network
Tailscale puts your devices — this machine, your phone, your laptop — on a
private network that only they are on. The machine publishes the panel there, at
an address like https://kestrel.your-tailnet.ts.net.
To your phone, that address is just a website. To everybody else it does not
exist: there is nothing to scan, nothing to brute-force, and no port to leave
open by mistake.
It works behind office firewalls, behind NAT, on mobile data, and on hotel
Wi-Fi, because Tailscale does that part.
Permission comes from us; the connection does not
You sign in to beafk cloud in your browser. That is what we do: know who you
are, and whether you are allowed near this machine.
Your browser then makes a key it cannot export, and asks us for a
certificate for it. We sign one that says: this person, this device, this
machine. It is good for five minutes, because it is spent immediately, in
one handshake, and a copy taken out of a log afterwards is worth nothing.
Your browser presents it to the machine. The machine checks the signature by
itself, without calling us, and gives your browser a session of its own that
lasts an hour. Your browser quietly gets a new certificate before that hour
is up, for as long as you are still allowed in.
From that moment your browser talks straight to your machine. The
chat, the files, the commands, the diffs: none of it comes through beafk
cloud, and none of it is stored here.
Your phone · a session an hour long, then a new one
Your machine · everything you look at, none of it through us
beafk cloud · a five-minute certificate, and nothing after it
What that means in practice
- We cannot read your chats or your code. They do not pass through
us. There is nothing to read.
- We cannot get into your machine. We hold no key that opens one. The
certificate is issued to your browser, for its own key, which never leaves
it.
- A stolen copy of our database is a list of machine names somebody still
cannot log in to.
- If beafk cloud is down, only opening a machine needs us. Everything
already running is unaffected — see
closing the tab.
Field by field, what that leaves on our side is
what beafk can see.
Cutting somebody off takes up to an hour
We stop signing for somebody the moment they lose their grant, their
session or their workspace — they cannot get into a machine again from that
second. But a browser already inside holds a session the machine gave it, good
for an hour, and the machine honours that by itself without calling us. So the
worst case is an hour, not a moment.
If you need somebody out now, the answer is on the machine.
sudo beafk cloud forget ends every open session on it at once, and the way
back is a fresh code. See
disconnecting a machine.
No pairing
There is no code to scan and no device to approve. Sign in on any browser and
you get a certificate. Access can also be taken away centrally: see
your browsers for cutting one off, and
who may open what for limiting a colleague to certain
machines.
If you skipped Tailscale
The machine still works, but only from itself. Run sudo beafk net tailscale
on Linux, or beafk net tailscale on a Mac (no sudo — root cannot see
Tailscale's app), whenever you are ready, and it will get its address then.
Until it does, the panel has no way to reach it from your phone.
On a Mac the app has to be there: install it from the
App Store, sign in to the
account that owns your network, and turn the switch on in the menu bar so it
says Connected. The install will not put a daemon on a Mac for you; the
connect screen offers that App Store link if the app is missing.
When it does not reach it
A machine that will not open is nearly always one of three things, and the first
is the phone you are holding:
when a machine will not open.