11 posts
4 min read By NT²
Tech
A proximity session has a budget. Contact invites and share manifests fit. PDF scans usually do not—so attachments leave on a bulk plane after SDP exchange, not stuffed into every control frame.
4 min read By NT²
Tech
If a proximity bootstrap can live in an ordinary https link, the authenticator has already toured browser history, referrers, and OS camera → URL launch paths.
5 min read By NT²
Tech
Connecting beside someone is a short-lived session. Recognizing them as a vault contact—and accepting a share into your vault—are still separate acts.
5 min read By NT²
Tech
Ciphertext and the secret that opens it should not travel as one convenient email. NT² splits carriers—file or link—from OOB passphrase delivery, and treats Strong as machine-handoff.
6 min read By NT²
Tech
Sharing to “someone in Contacts” only works if the row holds encryption material for that vault—not a phone number you hope matches the right person.
9 min read By NT²
Tech
A credential is a map of fields while you edit it. The moment those fields must survive a lock, a restart, or a replica, they need a portable ciphertext shape—not a JSON dump waiting for the next reader.
9 min read By NT²
Tech
Self-sovereign identity is useful when you take the parts that fit a zero-knowledge vault—and refuse the parts that turn the product into a general DID wallet.
8 min read By NT²
Tech
A share that opens with the same secret that unlocks the vault is not a handoff. It is a remote unlock of everything. NT² keeps those boundaries apart.
9 min read By NT²
Tech
Cloud services often treat an email inbox as the root of an account. An encrypted vault needs a different proof: control of a signing key, shown by answering a one-time challenge.
9 min read By NT²
Tech
One screen can make two security events look like a single login. We keep them separate because opening encrypted data and proving an identity to a server are different jobs with different risks.
9 min read By NT²
Tech
A vault can encrypt everything with one key and still claim that its data is encrypted. We wanted a more useful boundary: each item and attachment gets its own content encryption key, while the vault key protects those keys.
