Scheduled
2 min read By NT²
New Ledger, same old Notes mistake
Stories
The Ledger felt responsible. The recovery phrase still ended up in Apple Notes—because that is where every other secret goes.
Tagged: crypto
11 posts
Scheduled
8 min read By NT²
XSS steals sessions elsewhere; here keys are non-extractable
Tech
A vault that advertises invincibility is selling theater. NT² names the residual risks—XSS while unlocked, a stolen unlocked device, a hostile extension—and designs so those failures do not also become password oracles or exportable key dumps.
Scheduled
8 min read By NT²
Shared crypto packages get a 100% coverage floor
Tech
Specs bound scope. Security veto owns residual risk. Coverage floors own a narrower job: no uncovered line in the shared packages that seal, wrap, and describe vault facts—because agents will otherwise ship “done” with a hole.
Scheduled
7 min read By NT²
Security veto is a role, not a vibe
Tech
Agents can draft patches and greenlights. They cannot own the decision that a vault still refuses password escrow, extractable keys, or a “helpful” recovery desk. Security veto is a role with authority—not a mood in chat.
Scheduled
8 min read By NT²
Wrong password must fail closed
Tech
Unlock is not a best-effort decrypt of everything you own. NT² checks a small local verifier first. Wrong password fails closed: the vault stays locked, and the UI stays honest.
Scheduled
1 min read By NT²
Hardware wallet setup day
Stories
You bought the hardware wallet for safety. Setup day is when that safety either becomes a habit or turns into another note you hope you never lose.
Scheduled
9 min read By NT²
Auto-lock is a memory hygiene problem
Tech
Encryption at rest is incomplete if the decrypted key handle outlives the unlocked session. NT² treats auto-lock as memory hygiene: non-extractable CryptoKeys, in-memory only, cleared on idle, refresh, and tab close.
Scheduled
1 min read By NT²
1Password holds logins; where do mnemonics go?
Stories
A seed phrase does not have a login form. That small fact explains why some assets need a different kind of vault.
9 min read By NT²
The KDF salt stays on your device
Tech
A salt is not a secret. Still, where it lives changes who can assemble a password-guessing system. NT² keeps the KDF salt and password verifier with the local vault, so unlocking begins and ends on the device.
2 min read By NT²
Not another password manager login
Stories
Website logins already have good tools. The harder question is where to keep the secrets that are not just username, password, and URL.
3 min read By NT²
Your seed phrase shouldn't live in Apple Notes
Stories
If your recovery phrase is in Apple Notes, iCloud is doing backup. That is not the same as zero-knowledge—and it is not the same as structured, masked fields with auto-lock.