A lost deck: what a stranger can read from it

A consultant gets out of a taxi at the airport, pays, and is through security before she notices the card is not on its lanyard. It has her morning’s notes on it, the names of the people she met, and a day’s worth of what she said to her assistant. The taxi is gone. The card is on the back seat.

Whoever finds it will try the obvious things. Press the button. Say something to it. Plug it into a laptop. The question that matters is what each of those gets them.

The answer should be nothing, and that has to be designed, not hoped for.

The real cause: a carried device is a device you will lose

Everything carried gets lost, lent, pickpocketed or left on a seat. A phone is designed as if that were an edge case; a device built to hold your assistant’s memory has to be designed as if it were the normal case. The question is not whether the deck will end up in a stranger’s hands. It is what is readable when it does.

Where lost devices usually give everything away

Memory that is readable at rest. If the storage can be read when the device is off, the lock screen is decoration. A finder with a screwdriver and a reader gets the notes directly from the chip.

A key that lives next to the data. Encryption with the key stored on the same storage is a locked door with the key under the mat. The key has to be bound to the person, not to the device.

A cloud copy that anyone can ask for. If the memory also lives in a vendor’s account, the finder is the least of the problem. A legal request to that vendor reads more than any stranger could, and you will not be told.

No way to reach the device. When the only way to wipe it is through the vendor’s service, you are relying on that service existing, being awake, and agreeing with you.

A device that carries too much. A card that holds years of memory is a large loss. A card that holds today is a small one. Most of the damage from a lost device is decided long before it is lost, by how much it was carrying.

Backups nobody can open. The opposite failure: everything is so locked down that when you lose the device, you lose the memory too. Secure and recoverable have to be designed together.

What has to be true for the finder to get nothing

These are the design goals KyberDeck is built around. None is a measured result yet.

Encrypted at rest, always. The memory on a card, a band or a pocket deck is encrypted when the device is off and when it is locked. Reading the chip gets a finder ciphertext.

The key belongs to you, not the device. Unlocking is bound to the person: the same identity your KyberBot acts under, across every form you own. A device that cannot prove it is with its owner holds nothing it can open. Which is why the ID card is a computer: identity is the thing the hardware is for.

The home node can revoke it. The carried forms sync with the home node, and the node can withdraw a lost device’s access and tell it to wipe the next time it reaches any network. No vendor service in the middle, because there is no KyberDeck account holding your data in the first place.

There is no cloud copy to subpoena. The long memory lives on your shelf. A request to us returns nothing because we hold nothing. That is a limit on what the product does as much as a feature of it.

The carried device holds the day. The card and the band carry what they need for today. The rest stays home. A lost card is designed to be a small loss, which is the same reason it can afford a small battery.

The first hour

1. From your Node, or from any other form you own, revoke the lost device. Its key is now useless even if the device is never seen again.
2. Mark it to wipe on next contact. If it ever reaches a network, it empties itself.
3. Check what it was carrying. The Node knows the last sync, so you know which hours are on the card and nowhere else.
4. Decide whether those hours matter. Usually they are a morning’s notes that the Node already has a copy of.

Nothing in that hour involves calling a company and hoping.

What the stranger can still tell

Honesty requires the last part. A finder learns that the device exists, what it is, and that somebody nearby owns one. They can see its shell, its ports, the one line on its e-paper display if anything is shown while locked. If it has a radio on, they may be able to tell it is trying to reach something. The design goal is that they learn nothing about you, not that they learn nothing at all. A device that is invisible is a device you cannot find either.

A test you can run today

Take the device you carry now and answer three questions without looking anything up. If it were in a taxi right now, could you make its data unreadable from where you are sitting? Would that depend on a company’s service being up and on your side? And what is on it that is nowhere else?

If the answer to the first is no, to the second is yes, or to the third is “a lot”, then the device you carry was designed for the day you keep it, not the day you lose it. Every form on the KyberDeck homepage is designed for both.