The Family Guide to Secure Remote Access

Keeping your family's files at home solves a lot of problems. It creates one: you are not always at home.

You are at the airport and need the insurance document. Your mother wants to see the photos from Sunday and lives three hundred miles away. Your daughter is at university and wants a file she left behind. Being able to reach your own things from somewhere else is what turns a box in your house into something the family actually uses.

It is also the part that most often gets set up badly, in ways that quietly undo everything else you did to keep your family's life private. You do not need to be technical to get this right. You mainly need to know which of the three routes you are on.

The three ways families do this

One: put everything in a big cloud service. This is what most people end up doing, and reaching things from anywhere is the reason. It works, it needs no setup, and there is nothing to maintain. What you give up is that the company holds a copy of your family's files, can read them, and can change its terms whenever it decides to.

Two: set it up yourself at home. This is the do it yourself route. In plain terms, you go into the settings of your home internet box and tell it to let people from the outside world reach a device inside your house. It costs nothing and it does work.

It is also the option we would steer almost everybody away from. Doing it safely means getting several fiddly details right and then keeping them right for years. Get one wrong and you have not opened a door for yourself, you have opened it for everybody, which is a genuine and common way families lose the exact photos they were trying to protect. Unless you enjoy this sort of thing as a hobby, this is not the route to take.

Three: use something that handles the connection for you. Instead of your house letting strangers in, the device at home quietly reaches out to a meeting point on the internet, and your phone reaches the same meeting point. The two are introduced there, and everything that passes between them is scrambled so that whatever sits in the middle cannot read any of it. Nothing at your house is left open, and there is nothing for you to configure.

For most families this third route is the right answer. It gives you the convenience of the first option without handing your files to a company, and it avoids the risk of the second.

Why the do it yourself route goes wrong

It is worth understanding this even if you never touch it, because a lot of people had it set up years ago by a helpful relative and have not thought about it since.

When you let the outside world reach a device in your home, that device stops being tucked away on your private home network. It now has an address on the public internet, the same as any website.

The part that surprises people is what happens next. Automated programs scan the entire internet continuously, looking for devices that will answer. A newly exposed device is usually found within hours. Nobody is targeting your family. It is a machine working through every possible address, and yours is simply one of them.

What those programs find is whatever you left behind. A password that was never changed from the one printed on the box. Software that has not been updated in five years. Home storage devices left reachable this way have been broken into by automated attacks that scramble everything on them and leave a demand for payment in the folder where the family photos used to be.

If you think you might already have this set up

Two questions will tell you most of what you need to know.

Did anyone ever set up a way to reach something at your house from outside? A home camera, a storage drive, a media server, a games console someone configured. If a relative or an installer did this for you, ask them what they changed and whether it is still needed.

Is it still needed? Plenty of these arrangements were set up for something that stopped being used years ago. If you cannot say what it is for, it should almost certainly be switched off.

If you want to look yourself, log into your home internet box using the address and password on the sticker underneath it, and look for a section about letting outside connections in. Different makes call it different things, but the wording usually mentions forwarding, remote access, or a list of devices with rules next to them. Anything listed there is a door standing open. If you do not know why a rule is there, it very likely does not need to be. If that paragraph sounds like more than you want to take on, that is a completely reasonable place to stop, and it is a good reason to prefer the third route above.

Five things worth doing either way

1. Change the passwords that came in the box. That includes your home internet box itself, which in most houses still has the original password from the sticker.
2. Turn on two step verification wherever it is offered. It asks for a code as well as a password, and it stops nearly all automated break ins, because those rely on guessing passwords alone.
3. Let things update themselves. Most successful attacks on home devices use a weakness that was fixed by an update months earlier that nobody installed. If there is a switch for automatic updates, turn it on.
4. Be wary of cheap connected gadgets. Budget cameras, plugs and doorbells are rarely updated and are a common way in. If your internet box offers a separate guest network, putting those gadgets on it keeps them away from the device holding your family's photos.
5. Treat hotel and airport wifi as unsafe. It is fine to use, as long as whatever you are connecting to scrambles the connection the whole way. That is one more argument for a setup that does this by default rather than one you assembled yourself.

What to look for in an easier solution

If you would rather not manage any of this, and most people would rather not, these are the things worth insisting on when you pick something.

• Nothing at your house is left open to strangers. The connection should be made outward from your home, never inward from the internet.
• Scrambled the whole way, so that whatever passes your data along in the middle cannot read it, including the company that made the product.
• Access you can give and take back, person by person. Your parents seeing the photo albums should not mean your parents seeing your financial paperwork.
• It keeps working without being maintained. Anything that needs a knowledgeable person to repair it every few months will eventually be abandoned, and abandoning it is how families drift back to the big cloud services by default.

That list is the standard we held ourselves to when building The Ark. It reaches you through a meeting point rather than by opening your home up, the traffic is scrambled end to end so nothing in the middle can read it, and each family member gets their own access, so what your parents can open and what stays private is your decision. There is nothing to configure. You plug it in, follow a guided setup of about ten minutes, and everyone joins by scanning a code. If you can set up an iPhone, you can set up The Ark.

Whatever you use, the question at the top is the one that matters. If something at your house can already be reached from the outside world, find out what it is and whether it still needs to be. Most families who check find at least one door open that nobody meant to leave that way.