A hostile page gets little↑ Why · Alex loses a phone, and it opens nothing A copied browser profile opens nothing, and can't add a device by itself.
Today the first browser holds the account key's seed, as bytes in IndexedDB, so one read of that storage is the whole account.
The core never holds a key; the host signs
A key the browser can't export can be used by a script while it runs, but never copied.
Shown when no core API takes private key bytes; a browser's storage holds no bytes of the classical half.
Not built: nothing in the code or tests names this yet.
The account key isn't in a browser
The key that adds devices and grants lives in a passkey or a trusted machine.
Shown when a browser's storage, copied, signs no log entry.
Not built: nothing in the code or tests names this yet.
A browser's delegation lasts hours, and renewing it takes a person
A compromised page is then a window, not for ever.
Shown when past its expiry a browser's calls are refused until a passkey tap or a native node's approval renews it.
Not built: nothing in the code or tests names this yet.
What a browser keeps as bytes is sealed under its passkey
A copied store, a backup or an extension reading storage gets ciphertext.
Shown when storage copied without the passkey opens nothing.
Not built: nothing in the code or tests names this yet.
Widening the account takes a second device
A hostile page can't add a device or grant silently; it can only trick someone into tapping.
Shown when from a browser alone, an add or a grant waits for a passkey assertion or a native node's allow.
Not built: nothing in the code or tests names this yet.
Native mode↑ Why · Someone checks every claim before trusting it On a network they don't trust, they can run the release they checked, not whatever the network serves.
Opt-in, for networks you don't trust; the first minute stays a plain page.
In native mode the page comes from your own node
Shown when with the network serving a changed page, native mode runs the signed release, and the key is never reached.
How Native mode
Not built: nothing in the code or tests names this yet.
The account approves the releases its nodes run
Shown when an unapproved release refuses to start in native mode.
How Native mode
Not built: nothing in the code or tests names this yet.
Noticing interception↑ Why · Someone checks every claim before trusting it A work network's inspection box is noticed and reported, not trusted in silence.
Interception is seen only from something the proxy doesn't control, and each finding goes to your other devices, which the proxy can delay but not forge.
A native node trusts only bundled roots and the issuers our CAA allows
Shown when behind a proxy with its own CA the node refuses the relay, and the account's devices hear that the network intercepts.
Not built: nothing in the code or tests names this yet.
Where a relay ends its own TLS, its challenge is bound to the channel
Shown when through a proxy that ends TLS the signature fails.
Not built: nothing in the code or tests names this yet.
A relay that sees a client's TLS fingerprint disagree with its browser warns the account, not the page
Shown when an attach through a known inspection proxy produces a sealed warning at the account's other devices.
Not built: nothing in the code or tests names this yet.
A page that finds an update unsigned locks its keys and warns
Shown when the network serves a changed page; the browser refuses to unlock and the other devices hear.
Not built: nothing in the code or tests names this yet.
Another device checks what our origin serves
Shown when a changed page at the origin is reported by a node on another network.
Not built: nothing in the code or tests names this yet.
A browser where interception was seen stays locked until a person clears it
Shown when after a warning the device is marked suspect, and only an Admin device or a passkey clears or revokes it.
Not built: nothing in the code or tests names this yet.