memex

What this switchboard knows, and does not

This switchboard introduces a person’s devices to each other and to the people they share with, and passes along what they cannot exchange directly. What people keep and share crosses it sealed end to end between their devices, with one exception a person approves on their own phone: the questions an assistant in the cloud asks their devices, and the answers. It holds no key to anything anybody keeps.

While a device is connected

A fingerprint and a public key for the device, which the device made for itself, and which rooms it is in. A room is a set of devices that should meet (a person’s own, a share’s, two connected people’s, an assistant’s), and its name is random.
Who meets in which room, which tells it which devices belong to one memex, and which memexes are connected or share something: as fingerprints, never names.
The IP address each connection comes from, as any server sees it, used in memory to limit how often one address may connect and ask, and forgotten within minutes of its last request (within an hour for an assistant registering itself). It is never written down.
It lets go of a device’s rooms within minutes of its connection closing.

What passes through, and is not kept

The greetings two devices exchange first: public keys, and signatures over them.
WebRTC offers and answers, so two devices can find a direct path. They carry the devices’ network addresses, and looking for that path shows each device’s address to the other and to a public STUN server.
When no direct path opens, frames sealed under a key the two devices made between themselves. Sizes and timing; never contents.
An assistant’s questions and a device’s answers, readable, because the assistant’s connection ends here. Passed on, never kept.

What rests here, and for how long

Sealed pages between a person’s devices: every change one of their devices writes, left for each of the others, collected at once by one that is connected and waiting for one that is not. Each is sealed to a single-use key only the device it is for holds; the switchboard cannot open them. With each page it keeps the two devices’ fingerprints, which of the sender’s changes it covers, when it was left and its size, padded to one of three. A page is deleted when its device collects it, and 14 days after it was last written at most.
For a memex the switchboard keeps a log for: every change one of its devices writes, as a sealed, numbered entry in one ordered log per memex, which each of its devices reads from where it left off. An entry is sealed under a key only that memex’s devices hold; the switchboard cannot open it. Where the memex keeps a membership log here, that key is made on one of its devices and handed to the others inside a change to that log, and once all of its devices are updated it changes whenever a device is taken out and about once a week, so a device taken out, or a key copied off one, opens nothing written after. With each entry it keeps the writing device’s fingerprint, the entry’s number, when it was written and its size, padded. Entries are deleted 60 days after they were written at most, and the whole log the moment a device that can add devices asks. To know which devices may read and write it, the switchboard keeps, for a memex with no membership log here, the list of that memex’s device fingerprints, sent by a device that can add devices and replaced whenever one does; the list goes 60 days after it was last sent. For a memex with a membership log, that log decides.
For a memex whose devices keep a membership log here: that log, for as long as the memex uses this switchboard — its devices’ public keys, which parts of the memex each may open (by opaque identifiers), and when each was added or taken out, each change signed by one of the memex’s own devices. It is kept in the clear and names nothing anybody keeps. The switchboard keeps a change only when it is signed by a device the log says may make it. It answers the log itself to any device that proves its key — the memexes a memex is connected to read it to check which of its devices may speak for it — and everything else of that memex only to the devices the log names; a device taken out is refused from the moment its removal is kept. With it the switchboard keeps who is in now, read from the log, and which devices were taken out. Material a change carries for its devices (sealed keys the switchboard cannot open) is deleted 60 days after the change. A log names the memex’s vault room only by a code made from it. The switchboard keeps which devices each log names and when one last connected, and a log nothing was ever written after is deleted 30 days after it began once none of its devices has connected for 60 days. It keeps one log per key a memex was first known by — the first to bind it, and only the log of the memex whose vault room named that key here first — and tells any device that proves its key which log that is. For that it keeps, for as long as it runs, each such key’s fingerprint beside the first vault room that named it, and only where that key itself signed it: sent with the list of a memex’s devices, or with its membership log’s first change. Its operator can clear one, which it does only to undo a mistake.
For each device that uses those pages: the single-use public keys it published, which devices may leave pages for it and which key each was handed, how far it has read from each, and a mark that it proves its key when it connects, so that nothing joins under its name without that proof. Forgotten 45 days after the device last connected.
For each assistant a person approved: its registration (the name it gave itself and where its sign-in returns), the room that person’s devices answer it in, hashes of its tokens and of the key those devices answer with, and which devices answered. The tokens, the room and those devices are deleted when the person disconnects it, and otherwise 30 days after its last use; its registration 60 days after.
While an assistant’s sign-in page waits for the person’s phone, twelve minutes at most: what the assistant calls itself, and once the phone approves, the name of the memex that approved, so that page can say who did.
A push address for a device that asked to be woken, only where the switchboard’s operator has switched waking on. memex pro asks for none.

What it logs

When it started; the errors it met, a request that failed on its side among them, by its status and error and never its path; and once an hour, how many connections it let in from versions of memex too old to prove their key. It logs no request, and no line holds an IP address, a path, a device’s fingerprint, a room or anything anybody wrote, at any level. How long the log is kept is up to whoever runs this switchboard.

What it never holds

The key to anything. The part of a share link or a pairing link after # never reaches it.
Any record, file or word in readable form, apart from an assistant’s questions and answers passing through and the name of a memex approving an assistant, above.
An email address or a phone number. There are no accounts.
The power to add a device to a memex, take one out, change what one can open, or change the keys its log is sealed under: only that memex’s own devices sign those, and the switchboard can refuse to keep one but cannot write one.
The power to speak for a memex. What a memex says to the people it is connected to is signed by one of its own devices and names the point in its membership log it was said at, and their memex checks that device was in it, with the right to speak, at the newest point it knows. The switchboard cannot forge a point or a signature; it can show someone an older point, until one of the memex’s own devices meets them, and two different logs at one point are caught and said.

Whose it is

The switchboard at memex.thinkingmachinelabs.dev is run by the makers of memex, and memex pro’s privacy policy says what it keeps and for how long. memex pro can use another switchboard instead, chosen on the phone under Your memex, Switchboard; what its devices exchange from then on goes through that one.