Security & Networking

Cliqer uses WebRTC (Web Real-Time Communication) to establish direct or relayed communication channels between the presenter's control device and the host computer running the presentation software.

WebRTC Technology in Cliqer

Cliqer uses WebRTC via the browser's native RTCPeerConnection to enable real-time communication between devices.

Components used by Cliqer:

• RTCPeerConnection: Establishes and manages the connection between host and presenter devices.
• RTCDataChannel: Sends control signals (next slide, previous slide, laser pointer coordinates) with low latency.
• Signalling: Cliqer uses WebSocket signalling via wss://cliqer.io/ws to exchange connection metadata before establishing the WebRTC peer connection.

Security

1. Encrypted Communication:
   • Signalling Server Security: All connections to Cliqer's signalling server use HTTPS/WSS (WebSocket Secure).
   • WebRTC Encryption: Data channels are secured using DTLS (Datagram Transport Layer Security). Media streams (when used) are encrypted via SRTP (Secure Real-time Transport Protocol).
   • Control signals are encrypted in transit. Over WebRTC they travel directly between the devices, or through a TURN relay that forwards the encrypted packets and cannot decrypt them. If neither connection can be made, our servers relay them over the TLS-protected WebSocket connection and do not store them.
2. Application Permissions:
   macOSWindows

   Cliqer requires explicit user consent for Accessibility and Automation controls (System Settings > Privacy & Security).

   • Accessibility: Required for sending keystrokes and mouse events to presentation software.
   • Automation: Required for controlling System Events and presentation applications directly.
3. Secure Links: Presenter links are cryptographically generated and session-specific. Treat these links as sensitive information.
4. Software Updates: Keep Cliqer, your OS, and presentation software updated for security patches.

Networking and Ports

1. Internet Connection: Both host and presenter devices require a stable internet connection.
2. Firewall Configuration:
   • Cliqer requires outbound connections to signalling and STUN/TURN servers.
   • Windows Defender or third-party firewalls must allow Cliqer network access.
3. STUN/TURN Servers:
   Cliqer uses the following servers for NAT traversal. Allow outbound traffic to these hosts:

   Role	URL	Port	Protocol	Purpose
   STUN	stun:stun.cloudflare.com	3478	UDP	Public IP discovery
   TURN	turn:turn.cloudflare.com	3478	UDP/TCP	Relay fallback
   TURNS	turns:turn.cloudflare.com	5349	TLS/TCP	Secure relay fallback
   TURNS	turns:turn.cloudflare.com	443	TLS/TCP	Secure relay on locked-down networks that allow only 443

   
   TURN credentials are minted per session with a 24-hour TTL and rotate automatically.
4. Dynamic UDP Ports: WebRTC uses dynamic UDP ports for data exchange. Restrictive firewalls blocking UDP traffic force connections through TURN servers over TCP.
5. No Inbound Port Forwarding Required: Cliqer initiates outbound connections to signalling and relay servers. No inbound port forwarding configuration is needed.