Same room only — a six-digit passphrase

Last time I wrote that STIL.HUB is a duo — iPhone and Mac. Today, the design of the language those two speak. It's continuous with everything this family has written about privacy, and also a little different.

Danger in the opposite direction

The family's tools so far — photos, cards, receipts, voices — made one promise: we hold your data, and it doesn't leave.

STIL.HUB's danger points the other way. This app can launch apps on your Mac, type keys, open files. If some stranger could press buttons on your Mac — that's a different species of accident from a data leak, and every bit as ugly.

So this time the design needed, on top of "nothing goes out," "nothing gets in."

No route out of the room

Start with the foundation. The iPhone and the Mac talk directly, inside the same network. The iPhone calls into the room — "is the companion here?" — and the Mac's companion answers. There is no server in between. It's not so much that nothing passes through the cloud as that there is no place for it to pass through.

And I left it that way: there is no route to touch a STIL.HUB Mac from across the internet. I traded the convenience of remote control for something easier to reason about — only two machines in the same room can speak.

First meetings use a six-digit passphrase

Being in the same room isn't enough, either. The same Wi-Fi carries the rest of the household's devices, and guests' devices too.

So first meetings use a passphrase. Six digits appear on the Mac's screen, and you type them into the iPhone. Only someone who can see both screens at once — someone in that room, sitting at that Mac — can pass this gate. Once through, the two machines remember each other, and from then on a greeting is enough.

The remembering works like a duplicate key. On every later connection, the Mac challenges the iPhone: if you hold the key, you can answer this. The key itself sits in the iPhone's keychain and never travels over the wire.

Locked before launch

To be honest: the earliest build stopped at that identity check. It's local traffic in one room, and "make it work first" is this house's usual order of operations.

But before launch — before even one user existed — I decided the traffic itself should be locked. I first tried the OS's standard TLS (its pre-shared-key flavor), but the connection wouldn't hold steady in this setup, so I let it go. Instead, using standard cryptographic parts (AES-GCM), each connection derives a session key that belongs to those two machines alone, and everything after the first hello is encrypted. Get the passphrase wrong, and decryption fails — the intruder is quietly disconnected.

The other meaning of "Data Not Collected"

In the App Store's privacy section, STIL.HUB reads like the rest of the family: Data Not Collected. But here the label carries a second meaning. Not just that we don't collect — there is nowhere to collect to. No server, no account, no traffic leaving the room.

In the data post I wrote that what you don't hold can't leak. For a tool that operates things, it becomes: what can't be reached can't be pressed. The phrasing changes; the spine doesn't.

Next time

That was the foundation of trust. Next, the shop floor: everything connected fine, and a PDF wouldn't open. The logs all said "ok" — the story of learning to doubt that ok.

STIL.HUB is out on the App Store.