{"slug": "remote-controlling-your-computer-from-your-phone-the-security-traps-that-worry", "title": "Remote-controlling your computer from your phone: the security traps that worry me", "summary": "A developer building the DeepSeek Phone Harness, which lets users drive a desktop AI agent from a phone over 4G/5G, has outlined four security concerns for remote-control tools, including token authentication, approval cards, network isolation, and risks like MITM attacks, lost phones, and prompt injection. The developer is calling on the community to contribute to an open-source security checklist for remote-control tools.", "body_md": "#\nRemote-controlling the agent on your computer from your phone: what security traps worry you most?\n\nAn open security discussion. I'll share four real concerns I've hit or thought about. I want your fuller list — I'm sure there's stuff I haven't thought of.\n\nRemote control has always been a tug-of-war between \"convenient\" and \"safe.\" After turning my phone into a remote for the agent on my computer, I've put together a few **real** security concerns and would love to hear your complete checklist — there's definitely things I'm missing.\n\n##\nThree I've handled so far\n\nBuilding [DeepSeek Phone Harness](https://github.com/2903077918-lgtm/DeepSeek-phone-harness) (drive your desktop agent from your phone over 4G/5G), I dealt with at least three layers:\n\n-\n**Token auth**: every endpoint requires `Authorization: Bearer`\n\n; the token lives in a local `config.json`\n\n, never in any repo (I scrubbed history once already).\n-\n**Approval cards**: before the agent does something risky (writing files, running commands) → a \"authorization needed\" card pops on the phone; allow/reject is a human decision. I believe this is the **floor** for remote control — when you're not at the computer, authorization has to be interceptable.\n-\n**Network isolation**: recommend Tailscale private-network direct access, don't expose the port raw to the public internet; if public, go through a reverse proxy + strong token.\n\n##\nThe ones I'm honestly unsure about\n\nThese have no clear answer from me yet — open to being corrected:\n\n-\n**MITM on 4G/5G**: Tailscale encrypts, but if exposed without it, is a bearer token over HTTP acceptable?\n-\n**Agent privilege boundary**: an approval card can only block what I *know* to block. Could an agent chain harmless steps into a harmful outcome (read a bunch of files, then quietly write one)?\n-\n**Lost phone**: unlocked phone = control over your desktop agent. Should there be a second factor / device PIN / expiring tokens?\n-\n**Prompt injection on the model**: if I feed the agent a crafted prompt, could it run something unexpected? How granular should permissions really be?\n\n##\nWhat I most want from you\n\nA good security checklist for remote control is something the community knows better than one person. Let's hear:\n\n- When you remote-control your own computer,\n**which class of risk worries you most**?\n- Besides \"authorization interception\", what mechanism do you consider\n**essential**?\n- What's your\n**one-line objection** to \"control your computer from your phone\"?\n\nI want to turn this into an **open-source security checklist for remote-control tools** (and fold it into the project's `SECURITY.md`\n\nif it's useful), so every reply gets read and credited.\n\nProject (MIT): [https://github.com/2903077918-lgtm/DeepSeek-phone-harness](https://github.com/2903077918-lgtm/DeepSeek-phone-harness)\n\nMy security-ish implementation is open for review: `src/transport-lan.js`\n\n(auth / approval relay)", "url": "https://wpnews.pro/news/remote-controlling-your-computer-from-your-phone-the-security-traps-that-worry", "canonical_source": "https://dev.to/joey020907/remote-controlling-your-computer-from-your-phone-the-security-traps-that-worry-me-3am", "published_at": "2026-08-17 16:26:30+00:00", "updated_at": "2026-08-17 17:13:59.863185+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["DeepSeek Phone Harness", "Tailscale"], "alternates": {"html": "https://wpnews.pro/news/remote-controlling-your-computer-from-your-phone-the-security-traps-that-worry", "markdown": "https://wpnews.pro/news/remote-controlling-your-computer-from-your-phone-the-security-traps-that-worry.md", "text": "https://wpnews.pro/news/remote-controlling-your-computer-from-your-phone-the-security-traps-that-worry.txt", "jsonld": "https://wpnews.pro/news/remote-controlling-your-computer-from-your-phone-the-security-traps-that-worry.jsonld"}}