Security
Who Stonesafe protects you from.
Any security tool protects against some people and not others. This page names both. The algorithms and key sizes are on the architecture page.
01The goal
A person who gets your phone must not get the files you chose to protect.
They might steal it. They might make you hand it over and unlock it. Stonesafe is designed for both cases, and for the case where someone gets a copy of everything we store.
02In scope
The people we plan for.
| Who | What they have | What they get |
|---|---|---|
| A thief | Your phone, locked or unlocked. | No files from a locked vault. Vaults lock when the screen turns off. The home vault opens with a tap on your phone, so your screen lock guards it. |
| Someone who makes you open the app | The unlocked phone, and you. | The vaults you open for them. A vault with Phone copy off is not on the list, and the phone holds nothing that shows it exists. |
| A forensic lab | A full copy of the phone's storage. | Encrypted data. The key that seals it is in the phone's hardware key store and does not leave the phone. |
| Us, or our storage companies | Every byte we store. | Encrypted files with random names, their sizes and times. No file names, folder names, vault names, passwords or keys. |
| Someone who reads your email | The codes we send you. | No sign-in. Signing in needs your account password, and a password reset needs your recovery key too. |
| Someone who knows your account password | Your sign-in. | Your home vault. Every other vault needs its own password. |
03How
What stops each of them.
- Encrypted on your device. Files, names and folders are encrypted before anything is uploaded. The keys never reach us.
- A key per vault. Each vault has its own key, opened by its own password. One open vault does not open another.
- Slow guessing. Each password try costs 1 GiB of memory, so guessing many passwords takes a long time, even on a copy of the data.
- No biometrics. Someone can press your finger to the phone or hold it up to your face. They cannot do that with a password.
- Locks on its own. After the time you set in the background, and at once when a phone screen turns off.
- No trace with Phone copy off. The phone keeps three places for such vaults, filled with random data whether they hold a vault or not. Without the password, nobody can tell which ones are in use, the app included.
- Nothing in screenshots or notifications. On Android the screen is blank in screenshots and recordings, and the upload notice shows counts and sizes, never names.
- No reset. We cannot reset a vault password. If we could, so could anyone who forced us to, or who broke into our servers.
04Out of scope
What Stonesafe does not protect against.
- Malware, or a remote attacker, that controls your phone or browser while a vault is open.
- Someone who watches you type a password.
- Copies outside Stonesafe, such as a photo your gallery app uploaded to another cloud before you moved it into a vault.
- Hiding that Stonesafe is installed. Anyone who looks at your phone can see the app.
05Known limit
One problem we have not solved yet.
All vaults of an account share one storage limit. Someone who knows your plan size could fill a vault you opened for them until storage is full, and work out that more data exists somewhere. We are working on a fix. Until then, keep this in mind if you rely on Phone copy off.
06Audits
No independent audit yet.
Nobody outside our team has reviewed the code so far. When an audit is done, we will publish the report here. Until then, read this page as a description of how Stonesafe is built, not as a certificate. If you find a security problem, write to [email protected].
How the encryption works