Threat Model

​

Scope

​

Trust boundary

┌─────────────────────────────────┐
│          TRUST ZONE             │
│  ┌─────────┐     ┌─────────┐   │
│  │  Host   │     │ Client  │   │
│  │ (your   │     │(user's  │   │
│  │  code)  │     │ browser)│   │
│  └─────────┘     └─────────┘   │
└─────────────────────────────────┘
┌─────────────────────────────────┐
│        UNTRUSTED ZONE           │
│  ┌───────────┐  ┌───────────┐  │
│  │ Signaling │  │   Relay   │  │
│  │  Server   │  │  Server   │  │
│  └───────────┘  └───────────┘  │
│  ┌───────────────────────────┐  │
│  │      Network              │  │
│  └───────────────────────────┘  │
└─────────────────────────────────┘

​

Threats in scope

​

Network attacks

​

Device attacks

​

Protocol attacks

​

Threats out of scope

​

Application-layer attacks

​

Device attacks

​

Advanced attacks

​

Capability system

​

What capabilities do

• Declare what operations a client can request
• Let the host approve/deny during pairing
• Persist the granted set for the session
• Provide a human-readable description for user consent

​

What capabilities don’t do

• Implement rate limiting
• Enforce time-based restrictions (use TTLs)
• Prevent abuse by a compromised client
• Replace application-layer authorization

​

Security recommendations

​

For host applications

1. Validate all RPC inputs — Don’t trust the client
2. Implement rate limiting — Prevent abuse of granted capabilities
3. Log security events — Pairing, capability grants, errors
4. Use OS keychain — Don’t store secrets in plaintext files
5. Review pairing requests — Show SAS and capabilities to the user
6. Rotate pairing codes — Generate new codes regularly
7. Monitor connections — Detect anomalous patterns

​

For client applications

1. Use CrosslinkClient.create() — Encrypted storage at rest
2. Verify SAS — Never skip the verification step
3. Review capabilities — Don’t approve capabilities you don’t need
4. Handle errors gracefully — Don’t leak information in error messages
5. Secure your domain — HTTPS is required for WebCrypto

​

For deployments

1. HTTPS everywhere — Signaling and relay must use TLS
2. Network isolation — Run services in a DMZ if possible
3. Access logs — Monitor who pairs with what
4. Regular updates — Keep the SDK updated
5. Backup identity keys — If you lose them, paired devices can’t reconnect