Skip to main content
HUMΛN
HUMΛN
←Community
Passport
Passport

Sync without us in the middle

HUMΛN Team··10 min·Privacy + Wallet engineers

You pair a second phone. Vault material moves. Months later someone asks: whose database held the ciphertext while it moved? If the only honest answer is “ours, forever,” you do not have portable identity—you have a hosted wallet with nicer cryptography.

What ships today: multi-device pairing can still move vault ciphertext over a relay path while clients catch up—documented as progressive honesty, not the final architecture. What we are building toward: P2P-capable clients negotiating E2E channels (WebRTC DataChannel) for vault bundles, with the server as ICE/SDP signal only. The server does not need to sit in the middle of identity payloads forever.

Canon alignment

Identity payloads should not need to live in our database as ciphertext as a permanent architecture. Where relay paths remain for previous-format clients, progressive honesty applies: name the mode, test downgrade resistance, ship the P2P path without a flag day. Pairing and relay staging live in Multi-device ECDH + QR.

WebRTC DataChannel

Encrypted vault bytes move peer-to-peer. STUN/TURN may assist NAT traversal; TURN sees encrypted frames if the crypto story is correct—verify with threat-model review, not assumptions. Signal-only is the contract: SDP/ICE exchange, not vault plaintext.

Migration without big-bang

A p2p_capable (or equivalent) capability lets new clients prefer P2P while old clients keep relay—no forced cutover that strands users on unsupported OS versions. Progressive honesty beats a romantic “everyone P2P on Tuesday” launch.

Revocation honesty

Push notifications plus signed catch-up on reconnect handle stolen offline devices within the limits of practical systems today. We say what ships; we roadmap stronger distributed revocation where Canon pushes us. Offline devices that never reconnect are a physics problem, not a marketing one.

Scroll-stopper: If the vault must always transit our database, we are not a trust layer for identity—we are a custodian with better branding.

So that…

…you can refuse “sync” designs that permanently warehouse identity ciphertext on vendor servers; you prefer signal-only WebRTC when clients can; and you document relay as a staged deviation—not as the product story.

Go deeper

Guardian recovery shares signaling patterns for shard delivery; keep those plans named separately from vault sync.