9 min read By NT²
Challenge–response, not bearer email
Tech
Cloud services often treat an email inbox as the root of an account. An encrypted vault needs a different proof: control of a signing key, shown by answering a one-time challenge.
Tagged: security
8 posts
10 min read By NT²
The account database must not become a password oracle
Tech
An account table can contain no plaintext vault items and still create a dangerous password-testing surface. We removed the columns that could turn a database copy into an offline guessing or recovery system.
9 min read By NT²
No password reset, by design
Tech
“Contact support to reset your password” sounds reassuring. For an encrypted vault, it also reveals who ultimately controls access. NT² chooses a harder promise: recovery material stays with you, not our help desk.
9 min read By NT²
Unlocking a local vault is not logging in to the cloud
Tech
One screen can make two security events look like a single login. We keep them separate because opening encrypted data and proving an identity to a server are different jobs with different risks.
9 min read By NT²
One key per object: envelope encryption inside NT² Vault
Tech
A vault can encrypt everything with one key and still claim that its data is encrypted. We wanted a more useful boundary: each item and attachment gets its own content encryption key, while the vault key protects those keys.
9 min read By NT²
The KDF salt stays on your device
Tech
A salt is not a secret. Still, where it lives changes who can assemble a password-guessing system. NT² keeps the KDF salt and password verifier with the local vault, so unlocking begins and ends on the device.
10 min read By NT²
How one person builds and operates NT² Vault with AI agents
Tech
The useful question is not whether an AI agent can write code. It is how to give agents enough context and autonomy to move quickly while keeping product decisions, security boundaries, releases, and customer-facing actions under explicit human control.
6 min read By NT²
Why host a heavy server when a PWA can do everything locally? Built a zero-server privacy vault.
Tech
In the era of massive cloud-first applications, we often overlook a powerful alternative: the Progressive Web App (PWA). Why maintain a heavy, expensive, and potentially vulnerable server infrastructure when the modern browser is capable of running a full-featured, secure, and high-performance application entirely on the user's device?