15 posts
8 min read By NT²
Tech
Local-first only means ownership if you can leave with an encrypted snapshot the cloud never had to hold. .nt2backup is that snapshot: portable vault profile sections and sealed payloads in a file you control.
2 min read By NT²
Stories
Four small anxieties used to live in four different corners of the vault. The checkup brings them into one list, ordered by severity, with dismissals that stick.
8 min read By NT²
Tech
Salt, Key DID public material, sync cursors, and onboarding prefs are not one fat SQL row. They live as named vault profile sections—so backup, sync, and unlock can each touch only what they need.
8 min read By NT²
Tech
Unlock is not a best-effort decrypt of everything you own. NT² checks a small local verifier first. Wrong password fails closed: the vault stays locked, and the UI stays honest.
9 min read By NT²
Tech
A credential is a map of fields while you edit it. The moment those fields must survive a lock, a restart, or a replica, they need a portable ciphertext shape—not a JSON dump waiting for the next reader.
9 min read By NT²
Tech
Encryption at rest is incomplete if the decrypted key handle outlives the unlocked session. NT² treats auto-lock as memory hygiene: non-extractable CryptoKeys, in-memory only, cleared on idle, refresh, and tab close.
9 min read By NT²
Tech
Self-sovereign identity is useful when you take the parts that fit a zero-knowledge vault—and refuse the parts that turn the product into a general DID wallet.
9 min read By NT²
Tech
A cloud can help deliver sealed packages without becoming the place where pending shares live as readable mail. Relay indexes ciphertext. Inbox stays on the device.
8 min read By NT²
Tech
A share that opens with the same secret that unlocks the vault is not a handoff. It is a remote unlock of everything. NT² keeps those boundaries apart.
9 min read By NT²
Tech
Cloud services often treat an email inbox as the root of an account. An encrypted vault needs a different proof: control of a signing key, shown by answering a one-time challenge.
10 min read By NT²
Tech
An account table can contain no plaintext vault items and still create a dangerous password-testing surface. We removed the columns that could turn a database copy into an offline guessing or recovery system.
9 min read By NT²
Tech
“Contact support to reset your password” sounds reassuring. For an encrypted vault, it also reveals who ultimately controls access. NT² chooses a harder promise: recovery material stays with you, not our help desk.
9 min read By NT²
Tech
Sync does not have to turn a local vault into a cloud database. The edge can identify an account, store opaque replica frames, and deliver updates without learning what those updates contain.
9 min read By NT²
Tech
A salt is not a secret. Still, where it lives changes who can assemble a password-guessing system. NT² keeps the KDF salt and password verifier with the local vault, so unlocking begins and ends on the device.
6 min read By NT²
Tech
In the era of massive cloud-first applications, we often overlook a powerful alternative: the Progressive Web App (PWA). Why maintain a heavy, expensive, and potentially vulnerable server infrastructure when the modern browser is capable of running a full-featured, secure, and high-performance application entirely on the user's device?
