Problems we know are hard
Status labels: ✅ designed · ⚠️ open problem · 📋 claim pending verification. If you see an unlisted problem, please report it.
1 · Keys a grandmother can't lose. Client-side encryption is easy; recovery without custodians is not. Lost passphrase must not mean a lost life record. "We'll hold a copy" is the exact thing this project refuses. Candidate: social recovery — key shares held by the person's own People Circle, quorum to restore. Design open. ⚠️
2 · The adversary is often family. The realistic threat actor has physical access, knows the answers to the security questions, and may hold a legitimate consent grant. Elder financial abuse is mostly done by trusted people. We need coercion-resistant consent (witnessed grants, cooling-off periods, duress signals, silent-undo): the least-studied threat model in consumer security. ⚠️
3 · Break-glass that can't be quietly abused. Emergency access is designed in (pre-consented scope, identified invoker, unconditional after-notice to the owner, append-only record) — because lockout kills people too. Making notice unsuppressable and the log tamper-evident on a home node: partially designed. ✅/⚠️
4 · The endpoint is the castle. The archive lives on real devices: shared phones, old Androids, the family laptop. Owner-device compromise defeats everything above it. We need graceful degradation, sane defaults, and straight guidance. Assuming hardware nobody owns is fantasy. The paper layer is part of the answer. Paper has its own opsec. ⚠️
5 · Documents that attack their reader. Archive agents summarize PDFs and letters, so a malicious document is an indirect prompt-injection vector into the tools that hold the keys to context. Content must be treated as data. Nothing a document says can act as an instruction. Tool use must be provenance- and consent-gated. Frontier problem, and we're carrying it knowingly. ⚠️
6 · The log everyone must trust. The access log is the accountability spine: append-only, but hosted on hardware the household controls. Tamper-evidence (hash-chaining, replicated digests to the owner's other devices) is specified thinly. ⚠️
7 · Metadata is a confession. C0 content is invisible to remote callers, but sync timing, sizes, and query patterns still speak. We claim no traffic-analysis resistance. We are plain about that. 📋
8 · Backups ransomware can't hold hostage. Policy requires versioned, client-side-encrypted backups, an offline copy, and rehearsed restores (3-2-1, restic-class). A reliable restore drill for non-technical households remains unsolved. ✅/⚠️
9 · The supply chain of a community. Open code exposes maintainers to xz-style patience attacks. Answer under construction: signed, reproducible releases; two-person review on consent-gate code; a maintainer trust ladder that mirrors our people-vetting tiers. ⚠️
10 · De-identification that isn't a lie. Rich longitudinal personal data re-identifies; every security engineer knows it. So C4 research sharing leans on consent scopes and contracts, and says so to the person, plainly. Anonymization does no work in this design. 📋
11 · Proving “nothing you type leaves this page.” The claim is auditable: view source, watch the network tab, diff the served bytes. When we serve from our own domain: SRI, reproducible builds, a published hash. Verify us. That's the invitation. ✅
The threat table (v0)
How security people contribute
Break the design on paper. The archive spec, the consent gate, break-glass, the trust ladder: adversarial review before code hardens is worth ten audits after.
Take a security job from the board. Threat-model the consent gate; design household key recovery. Funded work, released to everyone, your name in the provenance.
Disclose in good faith. Found something? Write to us (kind: security). Coordinated disclosure with a safe harbor written into our Terms (§15, in plain language).
Review code when the repo opens. The gate's reference implementation ships with a public findings register: mitigated, accepted-risk, or open, each labeled and dated.
Teach a community security session. Cover passphrases, backups, and scam-spotting for the people scammers actually target. An hour of your knowledge can protect a whole street.
Why you'd bother
Because these are real problems: intimate-adversary consent, custodian-free recovery, and injection-resistant personal agents are careers' worth of unsolved. Because the user is your own mother, and eventually you. Because everything you fix ships to everyone, forever (the charter forbids it being taken back), with your name on the mitigation. Because someone will set the standard for person-owned archives, and it should be people who think like you and publish their threat model. And because this work defends people's own data, while most of the field defends companies' data about people. That's the fight a lot of us got in for.
Open and secure — how both hold
Kerckhoffs is the house rule: the mechanism is public, and keys are the only secret; if our security depends on you not reading the code, we have none. Openness gets its own gates: two-person review on consent-gate changes, signed reproducible releases, a maintainer ladder that vets people like we vet Hosts, and a public security register that lists accepted risks in the open. Open knowledge, sealed archives: the specs and registries belong to everyone; the data belongs to each person, behind one door that logs every knock. And what your work protects here is the unpriced: elders, kids, people in three languages the market never secures. That's what the world's community gets from yours.