Are you asking how they currently do it, or how it could theoretically be done better? If you're asking how they currently do it, I guess by sending the passwo

Are you asking how they currently do it, or how it could theoretically be done better? If you're asking how they currently do it, I guess by sending the password, but I don't really know. One way that would be slightly better than that would be to send the hash. That's still a replayable token, but it has the advantage that if someone does password reuse it's not immediately replayable against other websites. Ideally the hash would be salted (maybe with the username and some teamviewer-specific constant). Even better than sending it would be to use a PAKE, authenticated with that salted hash. Maybe an alternative would be some sort of asymmetric key system, where each device gets its own keypair. I guess it depends on exactly what functionality is needed. Does it need to be able to be setup offline, or can it be setup online, then go offline for further use?