Security and privacy

What needs administrator rights, where to keep the executable, how updates are verified, and what the companion bridge accepts.

Arsenal writes to firmware, installs drivers, replaces its own executable and can listen for a paired phone. This page describes what each of those is allowed to do, what Arsenal refuses, and the choices that are yours to make.

Where you keep Arsenal matters

Arsenal is a portable executable, so it usually sits in Downloads, on the desktop, or in a folder you made yourself. Those are places you can write to — and so can anything else running as you. That is harmless while Arsenal runs as you, and it stops being harmless the moment Windows is asked to run that same file as SYSTEM.

The charge-limit task is the case that matters. It runs at boot, as SYSTEM, with nobody watching. If the file it points at can be replaced by a standard user, then whoever replaces it inherits SYSTEM. Arsenal now refuses to register that task unless the executable is in a location only administrators can write to, and it removes a task that was already registered against a writable one.

Arsenal reads the folder's actual permissions rather than checking the path against a list of known-good folders. A directory created at the root of a drive looks like an ordinary program folder and is not one: it inherits write access for authenticated users. A location Arsenal cannot read the permissions of is treated as unprotected.

Nothing else is lost by keeping Arsenal somewhere writable, and the charge limit itself still applies — only the boot-time task, which is the part that needs SYSTEM, is refused. Move Arsenal into an administrator-only folder and re-register the task from setup if you want the limit applied before login.

What needs administrator rights

Arsenal starts as a normal program. Elevation is requested for specific operations, not held for its own sake.

The firmware charge limit itself does not need elevation. See Advanced for the controls and Installation for the persistent preference.

When Arsenal runs Windows' own tools, it names them by their full path in the system directory. Starting a tool by bare name searches the calling program's own folder first, which would let a file dropped next to Arsenal stand in for a system tool.

How an update is verified

Arsenal replaces its own executable, so the update path is checked at each step.

• The release feed is signed, and the signature is verified against a trusted key set before any download starts.
• The package's size and SHA-256 are checked against the feed.
• The package is copied into the install folder and verified there, so the file that is checked is the file that is installed, not a copy in a folder something else can reach.
• The update script is handed to Windows directly rather than written to disk first. A script file waiting on disk for an administrator prompt is a file that can be swapped in the meantime.

The signed feed and the package hash establish that a release came from the project and arrived intact. They are not Windows Authenticode signing, which Arsenal does not yet have — SmartScreen may still warn on download. See Updating.

What the companion bridge accepts

The bridge is off until you allow network access, and it stops when you quit Arsenal.

• It answers only a device on a network this PC is also on. The test is whether the caller shares a network with one of this machine's own interfaces, not whether its address looks private — so a phone in the next room still works over IPv6, and a stranger on a network someone has marked private does not get an answer.
• It holds a limited number of connections — 32 at a time — and gives each one ten seconds to make its request. Without those limits anything on the network could hold sockets open indefinitely without ever presenting a credential.
• Device credentials are wrapped to your Windows account rather than stored in readable form.
• The connection is HTTPS with the PC's own certificate identity, pinned by the paired client.

Pairing, revoking devices and the firewall prompt are covered in Mobile companion.

Remote session choices

Remote desktop access is off until you enable it on the Windows Mobile Companion page. Pairing a phone gives it a credential for companion controls, but remote access is a separate switch. By default each remote session asks on the PC and expires if nobody answers. You may allow view only, or disable keyboard and mouse for every session.

Start without asking removes that on-PC prompt for paired phones. The PC keeps separate switches for sound, text clipboard and file transfer, plus an option to lock when a session ends. You can end all sessions and clear remembered approvals from Windows. Use the remote-control guide for the controls and public Android client availability.

Driver downloads

Driver packages are fetched only from ASUS hosts, and the same check is applied when Arsenal looks for a package you downloaded in an earlier session — a tampered catalogue cannot point it at a file of its choosing. A partly downloaded file is never treated as complete. Arsenal opens an installer when you ask it to; it does not install anything silently. See Drivers.

What is stored, and where

Arsenal has no account and no cloud service. Settings, telemetry and pairing data stay on the machine. The copy of your configuration in %ProgramData% exists so the charge task can read it while running as SYSTEM, and every account on the PC can read that location — so it is written without the companion's private keys. First run lists the locations.

Reporting a problem

Report a suspected vulnerability privately through the Security tab of the repository, or by email to legal@get-arsenal.com with SECURITY in the subject. Please do not open a public issue. Include the version from About, your laptop model, what an attacker gains and what they need in order to gain it, and the shortest reproduction you have.