I built a remote desktop for my Macs with no account, no cloud and no open ports

Description and use

OwnDesk enables secure, account‑free remote desktop access to Macs from phones or laptops, using local discovery or Tailscale, signed protocols, and hardware‑backed keys, while avoiding external servers and open ports.

Problem

Need to access personal Macs from phone or laptop without relying on third‑party accounts, cloud services, or opening ports on the Internet.

Outcome

OwnDesk enables secure, account‑free remote desktop access to Macs from phones or laptops, using local discovery or Tailscale, signed protocols, and hardware‑backed keys, while avoiding external servers and open ports.

Workflow

• 1. Pair devices face‑to‑face on the same network using a QR code that contains the Mac’s device ID, addresses, and a one‑time pairing code.
• 2. The phone scans the QR code and sends a pairing request signed with an HMAC of the code, without transmitting the code itself.
• 3. Both devices display a short fingerprint; if it matches, the user approves on the Mac to complete pairing.
• 4. Each side stores the other’s public key in hardware‑backed key stores (Secure Enclave or Keystore).
• 5. For remote sessions, the Mac advertises itself via Bonjour; the controller connects to a WebSocket served by the Mac.
• 6. When away from home, Tailscale provides a stable tailnet address; OwnDesk connects directly or via relay if necessary.
• 7. All session messages are signed envelopes verified in a strict order, protecting the WebRTC video stream from man‑in‑the‑middle attacks.
• 8. Terminal access is achieved by having OwnDesk act as an SSH client to the Mac’s SSH server, using a separate hardware‑backed key and a one‑time request.
• 9. Clipboard sync is opt‑in on both sides, with per‑device switches and no logging of clipboard text.

Evidence

I wanted to reach my own Macs from my phone and my laptop. Every tool I tried wanted an account, sent my sessions through someone else's servers, or both.

Source

So I built OwnDesk: a Mac hosts, and another Mac, an Android phone or an iPhone controls it. There is no account, no cloud service and no port open to the Internet.

Source

Pairing happens once, face to face, on the same network: The Mac shows a QR code holding its device id, its addresses and a one‑time pairing code.

Source

The phone scans it and sends a pairing request with an HMAC proving it has the code, without sending the code itself.

Source

Both screens show a short fingerprint, like 25AA-F3B7-4F82. If they match, you click Approve on the Mac.

Source

Every message that sets up a session is a signed envelope, checked in a fixed order: size, version, recipient, known sender, signature, clock skew, replay, and finally the JSON Schema.

Source

The stream is WebRTC, encrypted with DTLS‑SRTP. In OwnDesk the SDP travels inside a signed envelope, so the DTLS fingerprint is signed too.

Source

The terminal is the Mac's own SSH server with OwnDesk as the client. Each device has a second hardware‑backed key just for SSH.

Source

Clipboard sync is useful and dangerous: whatever anyone copies on the Mac, a password included, could reach a device. So it is off until the person at the device switches it on.

Source