PIN pairing that can't be brute-forced: SPAKE2 for game streaming
A 4-digit PIN has only 10,000 values. With SPAKE2 pairing, an attacker gets one online guess per PIN and nothing to crack offline.
You pair a new device by typing a short PIN from the couch. A 4-digit PIN has only 10,000 values, though. If pairing leaks anything an attacker can test offline, all 10,000 fall in milliseconds.
Why simple PIN pairing is weak
Sending a hash of the PIN, or encrypting a known value with it, leaks a verifier: whoever records the handshake can try every PIN against it at leisure. GameStream, the protocol Moonlight speaks, pairs over plain HTTP, so Punktfunk ships with it off.
SPAKE2: prove the PIN without sending it
Punktfunk pairs with SPAKE2, a password-authenticated key exchange. Both sides mix the PIN into a key exchange and get the same key only if they used the same PIN. The PIN never crosses the network, and a wrong guess leaves nothing to test offline.
An attacker gets one online guess, against your host, in real time. Any attempt uses up the PIN, and an unused PIN expires after two minutes.
Both devices are bound
Each side keeps a certificate across restarts. The exchange binds both fingerprints into the key, so a machine in the middle with its own certificate can't complete it. After pairing, each side pins the other's fingerprint.
Reconnects are then silent and authenticated both ways. The host refuses devices it hasn't paired, and if a host's fingerprint changes, the client asks you to pair again.
Approve instead of typing
Choose Request access on the device, then Approve it in the web console under Devices. A request From the internet has no Approve, because its name proves nothing: Arm PIN makes a PIN only that device can use.
Trust on first use, only if you ask
On a network you fully trust, start the host with serve --open. The Apple, Linux and Android apps then show its fingerprint on first connect, and trusting it pins it. Clients never offer this to a host that requires pairing.
Every step is in the pairing guide. To let a friend in from outside, see playing with a friend over the internet.