Conrad Sallian's community posts

Hi Douglas,

However someone using this to support their aged relative from across the country (a typical use case for free use) should have a way to create a free but trusted configuration

There is not a problem to create a trusted configuration for free license users. There is a problem to distinguish good free license users from bad free license users who would abuse such trusted configuration.  :) And that problem is not one that can be solved by technical means.

snk-nick wrote:

Not to keep an old topic going but was this ever implemented?

We are working on this change. It will be added soon.

Hello Max,

our pricing page clearly shows two paid license without this feature. Why do you keep saying it's not shown for commercial users? That's confusing and annoying to be gaslighted. You should be specifically mentioning the $499 and higher commercial license not 50% of your commercial licenses.

The line in the pricing table you are referring to mentioned a different message, specifically this one. Yes, it is shown for all commercial licenses except the Pro and Site and only when some conditions are met.

Whereas in this thread we are discussing a different message, the one that I've shown in my previous post. And this message is shown for free license and trial users only.

There's no connection between this message and your constant flagging by Av software for YEARS. How this isn't solved with digitally signed certification, and threats from legal. There's a difference between Av software saying the app may be potentially used as a RAT, versus Microsoft Defender that just outright says it has a virus. No other software I use has the ongoing issues as you guys.

... and then they remove the detection/classification and apologize. It's all the same every time.

Hello Max,

That's not true. You need to be on an enterprise plan. It is money gauging and your reasoning that buying a larger license negates the limitations is proving that.

The reason why we introduced this for free license owners is to put an obstacle of abusing the free version out-of-he-box for illegal activity.

If we wanted to start selling to free license owners, we would simply stop offering the free license at all.

Your rational that an attacker can get the silent installer installed and still need to have a really dumb message to inform the user is illogical.

The fact that this message is shown explicitly to the remote user is suffucient. Not that we are happy introducing such measures, but they are required if we want to get rid of unnecessary a/v software detections.  

Even walking through over the phone to install it and the user still gets the message and treats the IT person like it's unsafe. If my name or email address was shown instead, they'd know it was me, not some attacker.

If the free license (or a trial license) is used, yes it'll be shown. Simply because we are not clairvoyant and cannot programmatically distinguish good guys who use our software for good deeds from bad guys and hackers.

For that reason, the message wording is neutral. It just says that a remote session is in progress and gives a link to a page with more explanation about the message and the software.

I said years ago the message needed to be changed and was completely ignored, only to have the same complaint for years.

Perhaps, you mean another message since the message discussed here was introduced in version 7.  

And has these changes stopped AV providers from flagging your software EVERY TIME, no. You're handling this feature very poorly.

It should take time, maybe a couple of months before the dust settles. As with any new release there's momentum in a/v detections - modern a/v software detections are almost entirely based on statistics, AI, heuristics that sort of thing. They almost never judge objectively and of course will never remove an existing detection (even if a file is benign) unless they are forced to do so.

Hi Márcio ,

I understand allright, so I hope you understand too - that notice will likely make you loose potentially paying customers that would gladly pay for your software in other situations. Just not this one.

This message is not visible for a commercial license owners. And it's not because we want to squeeze money from our free license users, as we explained earlier. We just wanted to put another obstacle to abuse of the 'out-of-the-box' free RU version. It was just too easy to abuse it - and as a consequence we had a lot of headache with antivirus software.

What truly made us losing our customers and getting refund requests was antivirus software blocking the program for our corporate clients, just because yet another "mom's hacker" used the free RU to remote into his ex-girlfriend's computere to steal some photos. Well, that is what kills customer trust, and not extra security measures.

Hello Márcio,

Thank you for your feedback.

I often use Remote Utilities to access my own computer from work, and there is nobody near my computer to click on the message to turn it off (if its clicklable from the host).

It is not removable even from the Host side. The idea of this message is to be shown permanently during a remote session.

Besides, the message content is absolutely useless. If I saw an authorized remote session to my computer while I was using it, I would simply unplug the network cable instead of typing or clicking a web adress with information regarding this situation. The whole message itself is rather nonsense. "oh no, my computer is being controlled by whoever knows and I'm going to open a site with information about it, nice". And this, while the other person is watching. And controlling my computer. Seriously? lol...

Without such a message the remote user might not even know that someone is being connected to their computer. This is because the Host icon may be removed under the expandable arrow in Windows system tray and may not be immediately visible. And even if it's visible in the system tray - not everyone knows what that icon means and they might not even know that such category of programs - remote access software - even exists.

If you are worried about that "someone" having access to the host options, then let them be set only on the host side, so that "someone" on the remote side can't change them. Simple, and only the user can set these options.

You are considering a scenario when the remote user knows about Host and willingly installed it or at least authorized someone to install it. However, this message is about a totally different situation, when a bad guy lures an unsuspecting victim to install this software on their computer - NOT when a remote user willingly installs it and knows what this software is about.

Of course, in most cases users and sessions are legit and this message can be annoying. But we did not invent the wheel here :) What is the percentage of thieves and burglars among the population? Rarely more than a few percent. And yet, we all HAVE to use locks and passwords, and safes and strong boxes and lock our cars just to protect against that small percentage of not-so-perfect citizens.

Ever thought why the society spends trilliions of dollars a year on security, including IT security? Yes, all because of them - 1-2% of the population not willing to follow the rules.

Hope you understand.

Hi John,

Connection types:

1. Direct connection. No intermediate server is used, Viewer and Host communication directly.
2. Internet-ID connection. An intermediate server is always used. This can be either our hosted server, or a self-hosted server, your choice.

Authentication methods (are enabled on the Host when you configure it):

1. Single password. No separate users, no logins, just a password.
2. Remote Utilities security (login and password pair and permissions can be set per user).
3. Windows security. Piggyback on Windows security model and use Windows accounts for authenticating on a remote Host  (or Active Directory accounts if on AD network).
4. Custom (self-hosted) server security. Using a self-hosted server for authentication. Somewhat similar to what a domain controller does in an AD network, i.e. acts as a gatekeeper and keeps all user authentication information.

Now connection types and authentication methods are not directly related. There can be any mix of them.

For example, you may use direct connection as your connection type, and use custom server security for authentication. In this case your Viewer and Hosts will only use your self-hosted server for that purpose (i.e. authentication) and not as a relay server for Internet-ID connection.

Another example, you may use Internet-ID connection through our hosted servers with Windows security authentication. That is, you can connect to a remote PC over the Internet and authenticate on the remote Host using the credentials of a Windows account on that remote machine (e.g. the local Administrator account). Of course, you must first add permissions for that account in Windows Security authentication settings on the Host.

While it's true that any combinations may be used, typically certain authentication methods are more often used with a specific connection type. For instance, using Windows security with direct connection makes sense because - as a rule - direct connection is used in a LAN or even a domain network and it's perfectly natural to use Windows accounts for authentication than to create accounts anew in Host settings (e.g. for Remote Utilities security).

Custom server security is a middle ground. It tries to bring the benefits of centralized account management to a scenario with Internet-ID connection used across remote machines scattered across the internet, i.e. not on the same LAN/AD.

To sum it up, you shouldn't bother with the self-hosted server (RU Server) unless it's absolutely necessary for your scenario.

Hope that helps.

Hi,

I notice that the new server update has a note saying "Minor improvements to RU Server license registration mechanism." - I thought this might be a fix to the issue however it doesn't seem to have changed anything..?

Do you mean the issue of not being able to add a license key to server without Desktop Experience installed on the machine?

Hi Bill,

Unfortunately, no. In Remote Utilities paradigm the update process is always "human-initiated" and is under control. If Hosts start to update on their own this may lead to VIewer-Host version mismatch issues in case Viewer is outdated.

We understand that nowadays many apps update automatically but Remote Utilities isn't a single app, it's a dual app. And it dictates some caution when it comes to updating. Especially when a remote computer is many hundreds of miles from the user.

Hi Peter,

Yes, we fixed that in the current release :)

Thanks.