anthony taguest·sydney --:--
← hubnotes
> notes --tag e2ee
Short notes I keep coming back to — mostly what I've learned building.
fail-closed, and still surprisedA refusal that only fires at use-time can hide broken for months.e2eeJul 30, 2026rotate the key, keep every promiseRe-encrypting everything is easy; never having a moment where something can’t decrypt is the job.e2eeJul 24, 2026end-to-end has a server in the middleBrowser E2EE trusts the origin to serve honest code — the one gap crypto can’t close.e2eeJul 22, 2026right bytes, wrong addressA valid auth tag proves the ciphertext is intact — not that it’s the one you asked for.e2eeJul 14, 2026the backup that needed no encryptionWhen everything is ciphertext, a backup is just the same bytes on a different disk.e2eeJul 14, 2026the counter that never countsSynced passkeys report signature counter 0 forever — design for the credential that lies.e2eeJul 14, 2026safe by construction, not by runbookRules that live in an operator’s discipline get skipped; encode them in structure.e2eeJul 12, 2026a cron that writes secrets it can’t readA keyless server can append to a diary it can never open.e2eeJul 12, 2026one store, every doorA bulk write to one feature suspended the store holding every private surface — including the record that signs me in.e2eeJul 12, 2026prove the new door before closing the oldMigrations are two acts, not one: add and prove in parallel, then remove in a step small enough to skip.e2eeJul 12, 2026
the hub · warm terminal