For reviewers

A threat model that only lists what a system defends is marketing. This page lists both directions, because a reviewer who finds the limits stated up front can spend their time past them.

What holds, and why

• No credential database exists to breach. Services hold public keys. A full dump of any server yields nothing that authenticates anyone.
• Handles never touch the network, and never rest on the device. Only hashes route, and only one-way derivations are stored. An observer of all traffic learns which hashes talk, not who anyone is; a seized device yields chosen display names, not the handles that route relationships. Those exist only between the humans who exchanged them.
• Key exchange requires breaking eight primitives at once, drawn from four unrelated mathematical families (three distinct elliptic curves, structured and unstructured lattices, and code-based systems including one unbroken since 1978). All outputs combine into a single seed; the weakest is not the target, the conjunction is.
• History is tamper-evident. The rolling chain advances per message with each state dependent on all prior state. Deleting or editing message N breaks every hash after N, visibly, on both ends.
• Full legal cooperation yields nothing actionable. No component holds user identity data, messages, or keys. There is no Lavabit lever: no custodian to compel, no service whose destruction is the price of refusal.
• The transport rejects replay by construction. Session state never repeats; captured exchanges do not re-run.
• No implementation can become the middle. Conformance requires user-elected portable custodians, issuer-indistinguishable attests, and owner-provisioned secrets. The patent non-assertion pledge covers only conforming implementations, so a vendor that routes recovery thru its own account, or ships a chip a verifier can tell apart, is outside the protocol and outside the pledge. Institutional capture is in scope for this threat model, and this is the defense.

What does not hold, stated plainly

• A compromised device is a compromised identity. Malware with your privileges reads what you read. Pegasus-class zero-clicks are on this list. Mitigation is architectural (run the client on a hotspot-tethered machine, not the phone), not cryptographic. The honest fix is sovereign silicon, and it is not shipped yet.
• Desktop device-binding is derivation, not hardware. On stock Linux, Windows, and macOS, the machine identifier the key derives from is readable by any local code, no root required. That binds against remote attackers only. Android's app-scoped identity is stronger; a dedicated hardware secret (the PIPE design: write-once key from on-device entropy, one wire, no read path) is the endgame, and until it ships this limitation stays on this page in bold.
• Custodian collusion is real. A threshold of your chosen recovery custodians, acting together while all your devices are offline, can reconstitute you. Choose custodians accordingly; the minimum-three floor exists so no pair can ever do it.
• Total device loss before recovery ships is total loss. No backdoor exists for us either. That is the point, and it cuts both ways.
• Physical access to an unlocked device is game over, here and everywhere else in computing.
• Consent gating is the owner's guarantee, not the verifier's. A signed answer proves the key spoke, fresh, for this challenge; it cannot prove a human tapped a consent box first, because an auto-signing device would produce an indistinguishable signature. That is placement, not accident: the consent gate protects the key's owner, so it runs on the owner's hardware under the owner's policy. Anywhere a verifier could inspect it is somewhere someone else controls it. Hardware that attests its own gating policy (the PIPE design) can make it provable later.
• 1 = 1 is not enforced, today or ever, and that is deliberate. Nothing stops one person claiming several handles; the proof of work prices bulk, not duplicates, and no authority exists that could refuse anyone. A power to deny existence would be a compellable power, so the protocol does not contain one. The bet is economic: reputation accrues per handle, thru lived interactions, and does not transfer, so a spare handle stays a shell with no history, no custodians, and no standing to spend, while a lived second identity costs a second life. With reputation unshipped, that bet is untested at scale. It is stated here so you can attack it: the cheapest sustained impersonation of human-weight multiplicity you can construct is a finding.

How to report what you break

Mail fractaldecoder@proton.me. Plain text is fine. Include enough to reproduce.

• No NDA, ever. Publish whenever you like; coordinated disclosure is appreciated, silence is not required, and you will be credited by whatever name you choose.
• No bounty theater. There is no triage vendor, no severity haggling, no "duplicate, closed." A real break gets a fix, public credit, and honest gratitude from every user of the protocol.
• The code is the scope. Everything is open: the client, the derivations, the wire format. Read it with your best adversarial eye; that is what it is published for.

The claims on this site are worded to be falsifiable on purpose. If one is wrong, demonstrating it makes the protocol stronger, and we will say so in public, in plain language, with your name on the finding.