Your email address can now live in a vault that only you can open. The server that stores it cannot read it, which is, when you think about it, the whole point of a vault.
Nobody has ever been entirely sure what websites do with email addresses. The websites themselves are frequently unsure, which is one of the less comforting facts about the internet, and the addresses, if asked, would probably rather not know.
Macropoiesis has decided to settle the question the boring way, by arranging not to have yours. So it built a vault.
The problem, briefly
Every website you have ever registered with keeps your email address in a database. This is not sinister; it is how the site knows who you are when you log in, and where to send the "you asked to reset your password" note. It is also, in the unhappy event of a break-in, the first thing that walks out of the door. Passwords are hashed and useless to a thief. Email addresses are not hashed, and are exactly what a thief wants.
The usual answer to this is to promise very hard not to get broken into. Promises are nice. Encryption is nicer.
What the vault does
From your account page you can now put your email address into an identity vault. Here is what happens, in the order it happens:
- You choose a second password. This one is called the vault password, and it is not your login password. It is, in fact, a different thing altogether, which is rather the point.
- Your browser, and only your browser, turns that password into an encryption key. It does this by making the password sit through six hundred thousand rounds of a very tedious mathematical procedure, which is the computer equivalent of being asked to fill in a form six hundred thousand times. This is deliberate. It makes guessing extremely slow.
- Your browser encrypts your email address with that key and sends the encrypted version to the server.
- The server files the encrypted version away and never sees the real address again.
The vault password never leaves your device. It is not sent, not stored, not logged, not glimpsed in passing. If the server were held upside down and shaken, nothing readable would fall out.
"But then how does anything work?"
This is the correct question, and the answer is a small, clever thing called a blind index.
When you vault your address, your browser also sends the server a fingerprint of it, made with a secret key that lives only on the server. A fingerprint cannot be turned back into an address, but it can be compared against another fingerprint. So when you type your email address on the login page, the server fingerprints what you typed, looks for a matching fingerprint, and finds you. It knows that it is your address. It does not know what your address is. Rather like a bouncer who can recognise your face but has never learned your name.
The same trick lets the site notice when someone tries to register with an address that is already taken, and lets password reset work exactly as before. You type your address, the server matches the fingerprint, and it sends the reset link to the address you just typed, which it then forgets, much as the rest of us forget the middle verse of the national anthem.
What if you forget the vault password?
This is not a crisis, and here is why.
Forgetting the vault password loses you precisely nothing important. You can still log in with your username. You can still log in by typing your email address, because that goes through the fingerprint. You can still reset your login password. The only thing you cannot do is open the vault and look at the address you put in it, which, given that it is your own address, you probably know anyway. If you want a fresh start, reset the vault from the account page and put the address back in with a new vault password.
What the admins see
Administrators, who are the sort of people who normally see everything, now see a small padlock next to your name and the word vaulted. They cannot email you. If they need to reach you, they leave you a message inside Macropoiesis instead, which appears in your inbox like any other.
What it means that we don't know you
This is the part worth sitting down for.
Once your address is in the vault, Macropoiesis does not know who you are. It knows there is a someone with a username, a vault, and a fondness for a particular set of stocks. It cannot put a name, a face or an inbox to that someone, and neither can anybody who asks it to.
Consider the ways a website normally gives your identity away, and what happens to each of them here:
- A break-in. Thieves who copy the database get a column of encrypted blobs and a column of fingerprints. Neither can be turned back into an address. The traditional post-breach ritual, in which a company writes to everyone whose address it lost, is not needed, because nothing of the kind was lost. There is simply nothing in the bag.
- A leak from the inside. An administrator with full access to the database, which is the most privileged position there is, sees a padlock. That is all there is to see. Privacy that depends on the staff being trustworthy is a policy. Privacy that survives the staff being untrustworthy is a design.
- Somebody asking nicely, or not nicely. A list of members' email addresses cannot be handed over, sold, traded, or "shared with selected partners", because it does not exist. You cannot be helpful with information you have carefully arranged never to possess.
- The mailing list that never was. No newsletter can be sent to a fingerprint. Every message the site ever sends you is one you asked for, at an address you typed at that moment, and forgot again once the message left.
In the language of European privacy rules this is called pseudonymisation: the data is still there, but the link from the data to the person has been removed and kept somewhere else. In this case the somewhere else is your head, and possibly a password manager. We are not lawyers and this is not legal advice, but the general idea, that a company cannot spill what it does not hold, is one that lawyers, regulators and thieves all agree on, which does not happen often.
There is a temptation to call this total privacy, and it is nearly right, so here is the small print. While you are actually using the site, the server can see the address your connection comes from, in the same way that a shop can see you walk in; the security system keeps a note of that for a while, because it needs to tell customers from burglars. Your username is whatever you chose, and if you chose your real name, that is on you. And your holdings are visible to the code that adds them up. What the vault removes is the one thing that ties all of this to a person: the address that is yours everywhere else on the internet.
Take that away, and what remains is a member of a stock-tracking site who likes dividends. There are a great many of those, and being one of them is about as identifying as being a fan of tea.
What is not in the vault
Honesty compels a short list:
- Your username stays as it is. It is a handle, not a secret, and the site needs to call you something.
- Your Telegram link, if you have set one up, stays readable, because a bot cannot send a message to a fingerprint.
- Your portfolios and holdings stay readable by the server, because the server has to add them up, chart them, and occasionally tell you that they have gone down. Encrypting them would produce a very private and entirely useless portfolio tracker.
The vault is for identity: the part that says who you are. The plan is to put anything else of that kind, a payment customer number for instance, through the same door.
How to use it
Open your account page and look for Identity vault. Choose a vault password that is not your login password, ideally one you would not mind typing occasionally, and press the button. New members can do the same on the registration page. If you do not see the option yet, it has not been switched on for your instance; it is arriving.
It is entirely optional. Nothing changes for anyone who ignores it. But if you have ever wondered what a website does with your email address, here at least is one answer that fits on a single line: it does not know it.
Thank you for your address. We shall now proceed to not know it.