A method performed by a personal computing device (252-258, 310) for communicating with a game console via a generic companion-messaging session between a hosted application of the personal computing device (252-258, 310) and a title running on the console , the generic companion-messaging session enabling the provision of a companion experience to a user on a second display screen associated with the personal computing device (252-258, 310) during presentation of media content by the title on a first display screen associated with the console , the method comprising: sending an initialization message to the console via a local network shared by the personal computing device (252-258, 310) and the console , the initialization message requesting a connection with the console ; receiving via the local network an acceptance of the request of connection from the console ; establishing the generic companion-messaging session over the local network , comprising receiving a set of signing and encryption keys from a service remote from the console and the personal computing device (252-258, 310), wherein the set of signing and encryption keys is also received by the console , said keys are changed and redistributed whenever the personal computing device (252-258, 310) is signed out of the console , and comprises session-level signing and encryption keys and a per-device encryption key to ensure a per-device privacy of the generic companion-messaging session between the personal computing device (252-258, 310) and the console over the local network by receiving a key from the service when a device joins a generic companion-messaging session, wherein the console also receives this same key for the personal computing device (252-258, 310) in the general companion-messaging session, wherein the per-device encryption key allows a connection between one console and multiple devices; and communicating a message between the hosted application and the title via an encrypted communication channel for the generic companion-messaging session over the local network , the message being encrypted using at least the per-device encryption key. sending an initialization message to the console via a local network shared by the personal computing device (252-258, 310) and the console , the initialization message requesting a connection with the console ; receiving via the local network an acceptance of the request of connection from the console ; establishing the generic companion-messaging session over the local network , comprising receiving a set of signing and encryption keys from a service remote from the console and the personal computing device (252-258, 310), wherein the set of signing and encryption keys is also received by the console , said keys are changed and redistributed whenever the personal computing device (252-258, 310) is signed out of the console , and comprises session-level signing and encryption keys and a per-device encryption key to ensure a per-device privacy of the generic companion-messaging session between the personal computing device (252-258, 310) and the console over the local network by receiving a key from the service when a device joins a generic companion-messaging session, wherein the console also receives this same key for the personal computing device (252-258, 310) in the general companion-messaging session, wherein the per-device encryption key allows a connection between one console and multiple devices; and communicating a message between the hosted application and the title via an encrypted communication channel for the generic companion-messaging session over the local network , the message being encrypted using at least the per-device encryption key. <EOS>