MountedStorage Download
Menu

Security

Who can reach the drives on your Mac, what a share link gives away, how devices connect, what our servers hold, and how to check the app you downloaded. This page describes MountedStorage 0.2.1, the version you can download today.

Updated October 25, 2026

Known limits in 0.2.1

These are true of the version you can download today. Each one is explained further down.

  • No per-drive choice. Every device you pair can read every external drive on the Mac at home. To keep a drive out, disconnect it.
  • Software running as you can read the drives in ~/MountedStorage. On a Mac that shows another Mac’s drives, other user accounts can’t reach them without administrator rights, but any program you run can read them, as it can any of your folders.
  • Macs paired before 0.2.1 keep photo backup on until you untick Allow Photo Backup for each one. Macs you pair now start with it off.
  • Library validation is off, so the app can load Blackmagic’s RAW decoder, which Blackmagic signs rather than us. That turns off one of macOS’s checks on what code the app may load.
  • Share links reveal your Mac’s IP address to whoever opens one, including someone holding an old link, as with any direct connection.

0.2.0 had three more: no way to remove one paired device from the Mac at home, device keys kept as files, and a connection to Finder that other software and user accounts on the same Mac could use. 0.2.1 fixes them, so if you use 0.2.0, update.

Summary

Who can connect
Devices you pair with a one-time invite from the Mac at home, and people you send a share link to.
What they can do
A paired device can read every external drive on that Mac. Someone with a share link can download only the file or folder it names, until the link expires or you turn it off. Nobody can change, rename or delete anything on your drives.
How data travels
Device to device over encrypted QUIC, using iroh. Through a relay run by n0, Inc. only when a direct connection isn’t possible, and the relay can’t read it.
What we hold
None of your files or file names, no share links and no account. The app has no sign-in and sends us nothing.
The app
Signed with Developer ID Tauren James Brown (KTQQGY9MSJ) and notarized by Apple.

Who can reach your drives

You link your own devices with an invite. On the Mac with the drives, choose Add a Device… in the MountedStorage menu. The app copies an invite to the clipboard and shows it as a QR code for the iPhone app. On the other Mac, copy the invite and choose Connect to a Computer….

  • An invite works once, and only for 15 minutes. It holds a 128-bit random code plus your Mac’s identity and current network addresses, so treat it like a password until it’s used.
  • Every device has its own Ed25519 key, created on the device the first time the app runs. Pairing records the new device’s public key on the Mac at home. From then on the encrypted connection itself proves which device is asking, and the Mac refuses requests from any key it hasn’t paired.
  • The Mac at home lists every paired device under Your devices in its menu.

What a paired device can do

  • Read every external drive. A paired device can browse and read every external drive connected to the Mac at home, and search its index, including the thumbnails, details and transcripts of drives that are unplugged. The Mac’s own startup disk is never offered.
  • Nothing that changes your files. On another Mac the drives appear in Finder as a read-only volume. The app’s protocol has no request to change, rename, move or delete a file. Its one way to write is photo backup, below, which only adds new files.
  • One way to write, photo backup. The iPhone app (in TestFlight) uses it to back up photos and videos. Backups only add files, into that device’s own folder, MountedStorage Backups/<device name> on the drive you choose, and never overwrite one. A phone you invite starts with backup on, and a Mac starts with it off; turn it on or off for each device with Allow Photo Backup in the menu. Devices paired before 0.2.1 keep the setting they had, which was on for every device, Macs included. iPhone app builds from before 0.2.1 pair with backup off.
  • Every path a device asks for is checked to stay inside the drive, including through symbolic links.

Share on Home Network is separate. It turns on macOS File Sharing (SMB) for one drive, on your local network only, with guest access off, so your Mac’s own user accounts decide who can open it.

A share link offers one file or folder to someone who isn’t one of your devices. They download it straight from your Mac whenever they’re ready; nothing is uploaded anywhere first.

Making and turning off a link

  • On the Mac with the drives, choose Share a Link… in the MountedStorage menu, pick a file or folder on an external drive, and choose how long the link works: 1, 7 or 30 days. Every link expires. A whole drive can’t be shared, only something on it.
  • The link goes on the clipboard. MountedStorage doesn’t keep a copy, so a lost link can’t be shown again; you make a new one.
  • Live links are listed in the menu with the time they have left. Turn Off Link deletes the link and hangs up anyone using it, so a download in progress stops at once.
  • While a link is live, Keep Mac Awake While Sharing (on by default) keeps the Mac from sleeping.

What the link holds

  • A link looks like https://mountedstorage.com/s#MSSHARE1…. It carries a secret of 32 random bytes and the address of your Mac’s link endpoint, but no IP address.
  • Your Mac stores only a SHA-256 hash of the secret, in a file only your user account can read, so a copy of its settings can’t be turned into working links.
  • The secret is after the #, the part of an address browsers don’t send to servers, so our website never receives it. The page at that address only checks the link’s shape and hands it to the app; it has no cookies or analytics and never sends the link anywhere. Anyone who has the link, in a chat you sent it through for example, can use it until it expires or you turn it off.

What a link can reach

  • Only the file or folder you picked, and what’s inside a folder: never its parent or the folders beside it. Files whose names start with a dot and symbolic links are left out.
  • A link is tied to its drive’s volume ID, so a different drive with the same name (two camera cards called “Untitled”, say) is never served in its place.
  • Links are served by a separate endpoint with its own key and its own protocol, which can only describe, list and read the shared item. It isn’t the endpoint your paired devices use, and a link doesn’t reveal your Mac’s device identity.
  • An unknown, wrong, expired or turned-off link all get the same answer, “this link has expired or been turned off”, with nothing about your drives.
  • Your Mac accepts at most 32 link connections at once.

Receiving a link

  • The person you send it to needs the free MountedStorage app on a Mac. The iPhone and Windows can’t open links yet.
  • Opening a mountedstorage: link, or choosing Download from a Share Link… with the link on the clipboard, shows what’s offered (its name, a file’s size, and how long the link still works) and asks before downloading into Downloads.
  • The download comes straight from your Mac, encrypted end to end, through n0’s relay only if a direct connection isn’t possible. It resumes after a dropped connection and waits for your Mac if it’s asleep or offline.
  • Downloaded files are quarantined like anything from the internet, so macOS checks any app among them before it runs. A name from the sender must be one plain name, with no folders in it and no characters that change text direction.
  • Whoever opens a link connects to your Mac and can learn its IP address. That includes someone with an expired or turned-off link, because addresses are exchanged before the link is checked.

How devices connect

MountedStorage connects your devices with iroh, an open-source networking library made by n0, Inc. Share links connect the same way.

  • Encrypted end to end. Every connection is QUIC, which is encrypted with TLS 1.3. Each side is authenticated by its Ed25519 key, so nobody in between can read or change the traffic, or pose as one of your devices.
  • Direct when possible. iroh gets through home routers so your devices connect straight to each other, with no port forwarding or router setup.
  • A relay when it isn’t. Some networks block direct connections. Then the encrypted traffic passes through a relay run by n0, Inc. (MountedStorage 0.2.1 uses n0’s public relays). The relay has no key to decrypt it. It can see both devices’ public keys and IP addresses, when they connect, and how much data passes.
  • Finding each other. So your other devices can find it, each device publishes a small record, signed with its key, to n0’s address lookup service, naming the relay it can be reached through.

What our servers hold

MountedStorage 0.2.1 has no accounts, and no server of ours sits between your devices or between you and someone you send a link to. The app talks only to your own devices, to the Macs of people whose links you open, and to n0’s relays and address lookup. It sends no analytics, crash reports or usage data, and it doesn’t check for updates.

What we do run:

  • mountedstorage.com, static pages hosted by Vercel, with no cookies and no analytics. Vercel keeps standard request logs.
  • downloads.mountedstorage.com, the disk image, stored on Cloudflare R2.
  • Email to mountedstorage.com addresses, forwarded by Cloudflare Email Routing.

The Privacy Policy covers each of these.

Removing a device

  • On a Mac that connects to your Mac at home: open that computer in the MountedStorage menu and choose Remove. This Mac forgets it and stops connecting.
  • On the Mac at home: choose the device under Your devices, then Remove…, and confirm. It takes effect at once: the device’s open connections close, so anything it’s opening or backing up stops, and the Mac refuses it from then on, after a restart too. Backups it already made stay on the drive. It gets back in only with a new invite.
  • To stop a device’s backups without unpairing it, turn off Allow Photo Backup for it. Check Macs paired before 0.2.1, which keep backup on until you do.
  • Share links aren’t devices: turn one off from the menu at any time.

On your Mac

  • The keys that identify your Mac to your other devices, and the key for share links, are kept in your login Keychain, as items named MountedStorage device key. The Keychain encrypts them with your login password, only MountedStorage can read them without macOS asking you first, and they aren’t synced to iCloud. 0.2.1 moves them there from files in the app’s folder the first time it opens, then deletes the files. Copies of those files in backups or APFS snapshots made before then aren’t removed, so keep backups of your user folder encrypted.
  • The list of paired devices, the list of removed devices and the list of share links (hashes only) are files in ~/Library/Application Support/MountedStorage, readable only by your user account.
  • A download from a link you were sent keeps that link in the same folder until the download finishes or you stop it, so it can carry on after a restart. Then it’s deleted.
  • The search index, thumbnails and transcripts are made on the Mac and kept in the same folder.
  • To show another Mac’s drives in Finder, the app serves them to macOS’s built-in NFS client on 127.0.0.1 and mounts them in ~/MountedStorage. That local server answers only the mount MountedStorage makes: its address is a random name told only to macOS’s mount command, it accepts one mount and refuses any after it, and every file handle carries a random secret, so other programs can’t guess their way in. ~/MountedStorage and the folders the drives are mounted on are readable only by your user account, which keeps other user accounts out. Software running as you can still read the drives there (see Known limits). There’s no kernel extension, system extension or helper tool, and mounting needs no administrator password.

Code signing and notarization

  • The app and its disk image are signed with Developer ID Application: Tauren James Brown, Team ID KTQQGY9MSJ, and notarized by Apple. The notarization ticket is stapled to the disk image, so Gatekeeper can check it offline.
  • The app runs with the hardened runtime and one exception: library validation is off (com.apple.security.cs.disable-library-validation), so it can load Blackmagic’s RAW decoder from DaVinci Resolve or Blackmagic RAW Player, which Blackmagic signs rather than us.

To check your copy, compare the checksum with the one on the download page, then ask Gatekeeper and codesign:

shasum -a 256 ~/Downloads/MountedStorage.dmg
spctl --assess --type open --context context:primary-signature -v ~/Downloads/MountedStorage.dmg
codesign -dv --verbose=2 /Applications/MountedStorage.app

Sign in with Apple (planned)

Not in 0.2.1. Accounts are written and tested, and will be switched on once the account service is running. In short:

  • The service gives each signed-in device a certificate, signed with the service’s Ed25519 key, saying that this device key belongs to this account. Certificates last 30 days and renew in the background.
  • Your Macs check each other’s certificates offline, so access keeps working if the service is down.
  • The service will store Apple’s private identifier for your account (not your name or email address), each device’s public key, name and kind, and sign-in sessions as one-way hashes.
If the account service were compromised

Anyone able to sign certificates with the service’s key could add a computer of their own to your account, and your Macs would accept it. That’s the cost of not pairing every device by hand. The signing key will be kept apart from the service’s database, and the app accepts only the service keys built into it. When a new computer on your account first connects, the Mac at home names it at the top of its menu for a minute. Devices paired with an invite don’t depend on the service at all.

Not built yet: an “Ask before new computers connect” setting, a Remove button on that notice (Remove… for each device in the menu works now, and a device removed there can’t come back through the account), hosts checking the account’s list of removed devices, and approval of new devices by one you already have. Until hosts check that list, a device removed from an account can’t renew its certificate but keeps working until it expires, at most 30 days later. We’ll update this page before accounts are switched on.

Reporting a vulnerability

Email support@mountedstorage.com with “Security” in the subject, the version you tested and the steps to reproduce. MountedStorage is made by one person, Tauren Brown, who reads every report. Please give him time to ship a fix before you publish details.

The same contact is in /.well-known/security.txt.