MoxiVueDownload

How it works

Your machines, your keys. Our server only passes messages.

Your devices seal your data before it leaves them. Our server, the Dispatcher, passes it along and stores it, but it can't open it. It also can't add a device to your account or make a machine do anything. Every key, signature and sealed record is post-quantum, and the model is zero-knowledge and zero-trust by design: the Dispatcher holds no keys, and every device checks the account's signed log itself. Two witness servers keep it from showing your devices an old or different version of your account. It does see some things, such as your sign-in email and when your devices are online. The security page lists them.

Your devices, the Dispatcher and the witnesses

Your devices Your computer: a console window and CLI, console service your keys; opens what you may read Server or Raspberry Pi: a machine machine agent, no window seals and signs; holds no reading key MoxiVue Dispatcher sign-in, which unlocks nothing account log: signed, names sealed sealed readings, status and settings passes encrypted sessions stores sealed session recordings sends new log states to the witnesses sealed nightly backups no keys of yours: cannot read your data, add a device or act sealed data over TLS 1.3 Two witnesses countersign each state of the log every device asks both directly Email provider delivers sign-in codes they prove who you are, unlock nothing
  • sealed or encrypted between your devices
  • sign-in only
Your devices sign every change to your account and each one checks it, so the Dispatcher can't slip in a device of its own. The witnesses countersign each new state of the log, so it can't show one device an older or different version without that device noticing within an hour. Two devices that can reach each other connect directly, and the Dispatcher only introduces them.

Inside each machine

root, narrow jobs Measuring helper reads traffic per app, disks, drive health takes no requests Root executor sessions, sudo, updates, capture: signed requests only its own copy of the log and key; signs each result the system user moxivue, and each person's own account Machine agent (user moxivue) records system and network health seals readings and status, signs its records checks the log and both witnesses re-checks every session every 30 seconds On this machine history (30 days) its own keys, mode 600 Console service per person; the window and CLI ask it; no port
Nothing that talks to the network runs as root. The machine agent runs as the system user moxivue, and terminal sessions run in an account of their own, moxivue-session. Root work is split into a helper that only reads and a root executor that acts only on signed requests it checks itself. On a computer people use, each person's console service holds their keys; the window and the command line ask it over a local socket only that person can use. Changing a process's priority or a system service asks for the admin password first.

How updates reach you

Built and tested built twice, byte for byte equal security tests on every release Signed with the MoxiVue package key Package repository get.moxivue.com Your machines install only if the signature matches; you approve first
One version for everyone. A machine installs an update only if it carries our signature. It waits for someone to say yes, unless automatic updates were switched on for it; an owner or admin can also ask a machine to update from a console, through its root executor.

The mechanisms behind each of these are described on the security page.