I would like to suggest an improvement to the security and usability of ChatGPT’s Remote Control feature.
Recently, I accidentally registered a host for Remote Control. I then wanted to completely remove that registration and return the system to the state it was in before Remote Control was enabled.
What I found difficult was that there did not appear to be a clear user-facing way to fully deregister the host and verify that all server-side security state had been removed.
For security-sensitive features, I think registration and deregistration should be symmetrical.
If a user can easily enable Remote Control, the user should also be able to completely undo it without contacting support.
A complete deregistration process should remove or revoke, as applicable:
- Host registration
- Server-side credentials
- Access tokens
- Authorization records
- Trust relationships
- Any other server-side state created during Remote Control registration
After deregistration, the user should also be able to verify that the host is no longer registered and that the associated credentials have been revoked.
Ideally, the product could provide something like:
Settings → Remote Control → Registered Hosts → Remove / Revoke
with a confirmation screen showing what will be removed.
After completion, it could show a result such as:
- Host registration: Removed
- Credentials: Revoked
- Tokens: Revoked
- Trust relationship: Removed
- Remote Control access: Disabled
This is especially important because users can make mistakes.
A security feature should be designed with the assumption that a user may accidentally enable, register, authorize, or trust something. There should always be a clear and reliable way to return to the previous secure state.
In my opinion, good security UX is not only about making secure features easy to enable. It is equally important to make them easy to understand, verify, revoke, and completely undo.
I hope OpenAI considers adding a user-controlled full deregistration and rollback mechanism for Remote Control.