A method performed by a personal computing device (252-258, 310) for communicating with a game console (210, 350) via a generic companion-messaging session between a hosted application of the personal computing device (252-258, 310) and a title running on the console (210, 350), the generic companion-messaging session enabling the provision of a companion experience to a user on a second display screen associated with the personal computing device (252-258, 310) during presentation of media content by the title on a first display screen associated with the console (210, 350), the method comprising: sending an initialization message to the console (210, 350) via a local network shared by the personal computing device (252-258, 310) and the console (210, 350), the initialization message requesting a connection with the console (210, 350); receiving via the local network an acceptance of the request of connection from the console (210, 350); establishing the generic companion-messaging session over the local network, comprising receiving a set of signing and encryption keys from a service remote from the console (210, 350) and the personal computing device (252-258, 310), wherein the set of signing and encryption keys is also received by the console (210, 350), said keys are changed and redistributed whenever the personal computing device (252-258, 310) is signed out of the console (310, 350), and comprises session-level signing and encryption keys and a per-device encryption key to ensure a per-device privacy of the generic companion-messaging session between the personal computing device (252-258, 310) and the console (210, 350) over the local network by receiving a key from the service when a device joins a generic companion-messaging session, wherein the console (210, 350) also receives this same key for the personal computing device (252-258, 310) in the general companion-messaging session, wherein the per-device encryption key allows a connection between one console and multiple devices; and communicating a message (532, 540) between the hosted application and the title via an encrypted communication channel for the generic companion-messaging session over the local network, the message (532, 540) being encrypted using at least the per-device encryption key. sending an initialization message to the console (210, 350) via a local network shared by the personal computing device (252-258, 310) and the console (210, 350), the initialization message requesting a connection with the console (210, 350); receiving via the local network an acceptance of the request of connection from the console (210, 350); establishing the generic companion-messaging session over the local network, comprising receiving a set of signing and encryption keys from a service remote from the console (210, 350) and the personal computing device (252-258, 310), wherein the set of signing and encryption keys is also received by the console (210, 350), said keys are changed and redistributed whenever the personal computing device (252-258, 310) is signed out of the console (310, 350), and comprises session-level signing and encryption keys and a per-device encryption key to ensure a per-device privacy of the generic companion-messaging session between the personal computing device (252-258, 310) and the console (210, 350) over the local network by receiving a key from the service when a device joins a generic companion-messaging session, wherein the console (210, 350) also receives this same key for the personal computing device (252-258, 310) in the general companion-messaging session, wherein the per-device encryption key allows a connection between one console and multiple devices; and communicating a message (532, 540) between the hosted application and the title via an encrypted communication channel for the generic companion-messaging session over the local network, the message (532, 540) being encrypted using at least the per-device encryption key.