Secure relays | Expressed

Blog cover: Secure relays. A pen-and-ink lighthouse with a padlock in the lantern and a cobalt-blue beam.

Your laptop is behind NAT, a firewall, maybe a VPN, possibly all three at once - oh and let’s not forget your tablet is connected to your mobile phone, because IT won’t allow BYOD (bring your own disaster) devices onto the corporate network.

The (networking) fun just never stops.

Nobody is opening a port. Nobody is reading an IP address out loud. And yet the tablet in your other hand — or in another country — still needs to draw on that screen.

So Expressed does the only thing that actually works: it reaches out.

Closest node

The Host — that’s the desktop app — connects to the closest one. Outbound. Secure websocket. The relay never has to find you; you found it.

You can pin a custom relay in Settings if you are that sort of person. Otherwise Expressed just picks the nearest built-in before you start sharing.

Only the people you let in

The relay issues a short-lived Code. That’s the QR on the Expressed window, and the link under it. You share that with the people you want in the session. They join in a browser. No app to install.

Without the Code, there is nothing to join. With it, they still wait until you start sharing — the session has to be open. You see them on Connected Viewers. When you stop, that Code is retired. It cannot be reused.

Traffic, then gone

Once you are sharing, the tablet’s drawing commands and the live screen travel on that encrypted websocket. The relay is a switchboard. It forwards. It does not keep a copy on disk. Stop sharing and the session is gone: Code retired, in-memory cache emptied, nothing left to leak later.

Recordings — if you make one — never leave your machine. Same for a Snapshot: the Viewer tells the Host to capture, the command goes through the relay, the file lands locally. We never see it. The relay never stores it.

Ink sketch: an iPad drawing a blue circle, commands travelling through a lighthouse relay over a secure websocket, and the same ink landing on the Expressed host.

That’s the whole trick. Closest node, encrypted tunnel, only the clients you allowed, nothing stored.

– John