Your tunnel has a secret. Your traffic is still plaintext.

transcript

Our tunnel uses an API key as its secret. So it's private, right? No. And it's an easy mistake to make.

I built BridgeLink to reach a team's Android phones from anywhere. ADB already talks to phones over a network. Port 5555. A tool called bore tunnels that port out to a public address. Now adb connect works from any laptop. With a secret, so strangers can't join.

But here's the catch. bore's own README says the tunnel traffic isn't encrypted. And classic adb over TCP? Plaintext too.

So what does the secret do? It authenticates the handshake. That's all. ADB's own RSA key check still blocks computers the phone hasn't trusted. But neither one hides what travels through the tunnel.

So for anything sensitive, wrap the link. In TLS. Or SSH. Or a VPN.

Authentication answers who you are. It doesn't hide what you send. A secret authenticates. It doesn't encrypt.

Full breakdown in the lecture.