How it works
What MediaShoot does with your photos, in plain words first. Open "Technical details" under any section if you want the specifics. Want to check it with your own tools? See Verify it yourself.
1. The short version
Your phone sends photos straight to your own PC. The connection is encrypted directly between your phone and your PC, with no server in between. The phone sends photos only to the PC you paired by scanning its QR code, and the PC accepts photos only from phones you paired. We run no servers that receive your photos, so there is nothing of ours in the path.
Technical details
- The PC runs an HTTPS server (TLS 1.2 or newer) in the Windows app, on port 8443 by default.
- The Android app is the client. It uploads each photo with an HTTP
PUTto/v1/files/<sha256>over that TLS connection. - The API is small:
/v1/status,/v1/pair,/v1/files/<sha256>and/v1/remote. Nothing in it talks to us.
2. What happens when you pair
On your PC the Windows app shows a QR code. Your phone scans it. The QR code tells the phone where your PC is and how to recognise it: like a fingerprint of the PC's secure-connection certificate. From then on, the phone will only talk to something that shows exactly that fingerprint. Nobody else can pose as your PC, because they cannot produce a certificate with the same fingerprint.
Technical details
- The Windows app creates a self-signed certificate the first time it runs (ECDSA P-256, valid for 10 years) and keeps the private key on your PC. There is no certificate authority involved.
- The QR code carries your PC's addresses and port, the SHA-256 fingerprint of the certificate, a one-time pairing secret (16 random bytes) and the PC's name.
- The phone accepts only a leaf certificate whose SHA-256 equals the fingerprint from the QR code. The hostname is not checked, because the identity check is the pin. If the certificate does not match, the connection fails and is never retried as "trust anyway". There is no trust-on-first-use.
- The pairing window opens when you ask for it, lasts 5 minutes, and closes after one successful pairing or 5 failed attempts. Pairing is by QR code only; there is no typed code.
- On success the PC issues this phone its own 64-character random token.
3. What happens when a photo is sent
The phone sends the photo over the encrypted connection and proves who it is with its own secret token. The PC checks that the file arrived exactly as sent before keeping it. Only after the PC confirms it has an identical copy can the app offer to delete the original from your phone, and that is off unless you turn it on. Android asks you to confirm each batch.
Technical details
- Each request carries
Authorization: Bearer <device token>. The PC stores only a SHA-256 hash of each token (indevices.jsonunder%APPDATA%\PhotosUploader) and compares in constant time. You can revoke a paired phone from the Windows app, and its token stops working. - The PC streams the upload to a temporary file and checks that its SHA-256 equals the hash in the URL and that its length equals the declared size. A mismatch discards the file and returns 400. Only a verified file is moved into your photo folder.
- If a file with the same content hash is already stored, the upload is skipped.
- Photos are never deleted from the phone automatically unless you choose a delete policy (the default is Never). Deletion is offered only for photos whose verified upload was confirmed, and Android shows its own confirmation.
4. At home and away
At home, the phone reaches your PC directly over your Wi-Fi. If you turn on the optional remote access setting, the Windows app asks your router (UPnP) to open one port to your PC, so your phone can reach it away from home. It is still a direct connection between your phone and your PC, with no relay of ours. Remote access is off unless you turn it on.
Technical details
- The phone tries the PC addresses from the QR code in order (last good first), with a short connect timeout. The same certificate pin and token are required on every address, home or remote.
- If every address fails, for example after your PC gets a new IP address, the phone looks for your PC on the local network with mDNS (service
_mediashoot._tcp). The fingerprint prefix in that announcement is only a hint. A found address is used only after it answers over the pinned certificate with the phone's token. - Remote access uses UPnP to map a router port; the request goes only to your own router. Clearing the checkbox in Settings removes the mapping.
- Anyone on the internet who finds the open port still needs a valid device token, and the phone only ever connects to your PC's pinned certificate. After 10 failed attempts within 5 minutes from one non-private address, that address is blocked for 5 minutes. Addresses on your home network are not locked out.
5. What leaves your devices, and what we see
Photos go to your own PC and nowhere else. We receive nothing from the apps: no photos, no file names, no usage data. The apps have no accounts, analytics, ads or crash reporting. Only this website has analytics: Google Analytics loads only after you accept the banner (see the privacy policy). The one thing outside our control is the QR scanner, which comes from Google Play services and may send limited diagnostics to Google while you pair (see the privacy policy). The apps do not check for updates themselves; Google Play and the Microsoft Store deliver them.
Technical details
- The Android app's network code is a single HTTP client that is pinned to your paired PC. The Windows app contains no outbound HTTP client code. It gets your public address for remote access from your router, not from an internet service.
- The Windows app's only network activity is serving your paired phones, announcing itself on your local network (mDNS) and, if you enable it, talking to your router.
6. Honest limits
- You trust the QR code you scanned. The pin is only as good as the QR code. Anyone who can see your QR code while the 5-minute pairing window is open could pair their own phone. Pair in private, and remove phones you do not recognise in the Windows app.
- A compromised phone or PC is not protected. Anything that has full control of your phone or your PC can read your photos there, whatever the app does.
- Photos on your PC are stored as normal files. They are not encrypted at rest by MediaShoot; your PC's own protection (Windows sign-in, BitLocker) applies.
- The Windows installer from our website is not code-signed yet, so Windows SmartScreen shows a warning. The Microsoft Store version is signed by the Store. The early-access download page shows the file's SHA-256 so you can check it.
- Self-signed means no outside authority vouches for your PC. That is why the QR code carries the fingerprint: the phone trusts that one fingerprint and nothing else.
Found something that does not match this page? Tell us at support@mediashoot.net.