Can Liir be hacked?
Our servers can be attacked like anyone's. The difference is what's inside: nothing worth stealing. No passwords, no card numbers, no photographs, no vault keys. Mostly public keys, which were already public.
Can it
be hacked?
The first question everyone asks, and it deserves better than trust us. So here is the design, what happens when a phone is stolen, the part where you can genuinely lose everything, and the list of things we have not done yet.
What if my phone is stolen?
You revoke it, from any browser on earth, in about a minute. It stops being you. The thief cannot spend, cannot become you, cannot lock you out.
What if I lose everything?
Your recovery words bring you back: slowly and loudly, on purpose. Lose the words too and we cannot help you. We would rather tell you that here than pretend.
Where this stands
This page describes the security design Liir is built to. The identity and storage layers are running; the recovery machinery described below is being built to this exact specification, published so it can be argued with. No third-party security audit has happened yet. That is on the list at the bottom, where we keep the honest part.
Why a breach of Liir is boring
Every company you have ever trusted with a password made the same promise: we will guard the secret. Every breach you have read about is that promise breaking.
We made a different promise: we will not hold the secret at all.
What Liir's servers actually contain is a registry: which public keys belong to which mark, which have been revoked, what operations are pending. Your private keys never leave your hardware. Your recovery words never reach us even while we verify you know them. The math for that has a name, and it is not new. Your vault is encrypted before it leaves your device, with a key we never see.
So the honest sentence about a breach is not it cannot happen. It is:
We can lose our servers.
We cannot lose you.
There is no database of secrets here, and you cannot leak what you never held.
The one place a breach is not boring, said before someone else says it
Your Vault. We hold your sealed relics as ciphertext we cannot read. But a breach would hand an attacker that ciphertext to attack offline, forever, and the only wall standing is your vault words. So we built for that day: words are minted from a 2,048-word list by chance, not chosen by taste: six words is roughly 66 bits, which is out of reach; six words a person picks themselves might be 30, which is not. The key-stretching meets the current OWASP floor, every vault gets a random salt so nothing can be precomputed in advance, and the sealed format carries a version so the day a stronger algorithm is warranted, your relics migrate instead of ossifying.
Mint the words when the Vault asks. Write them on paper, once. That is the wall.
The trade, stated plainly
If we hold nothing, then you hold everything, and the risk moves from a thousand companies you will never audit onto things you actually control:
- Your devices carry keys that cannot be copied off them. A key in secure hardware is not information that can be stolen over the internet. It is a capability that only works where it lives. There is nothing to phish.
- Your face or your words release those keys at the moment of use. Holding your phone is not being you.
- Your recovery words, six to eight of them, the one thing you must keep, bring you back when hardware is gone.
Most of what makes this safe is one rule: how fast an operation is depends on which way it points. Taking power away is instant. Using power needs you, live. Changing what power is takes ten days and screams the whole time.
Revoke a stolen device, cancel a recovery
Instant · your words, any browser
See your own things
A signed-in device
Approve a payment, open the vault
Your face or your words, at that moment
Add a device, change your words, erase the vault
Ten days, every device notified, any of them can cancel
Why that shape? Because revoking can only ever protect you, so it should be the easiest thing in the system. And because everything an attacker actually wants (a new device enrolled, your words replaced, your vault erased) is exactly the kind of change that should be impossible to do quietly. Even for you. Especially for you, since anyone who can do it quickly to you can be tricked or forced into doing it quickly for someone else.
The stolen phone, minute by minute
Not a hypothetical. The design was tested against exactly this: an unlocked phone, no screen lock, signed in, gone.
You, minute one. Any browser. liir.net. Your words. Revoke everything. The phone stops being you before the thief has left the parking lot.
The thief, meanwhile, can read what was open on the screen and anything you had left unlocked. That window is real and we will not pretend otherwise. Here is what he cannot do, no matter how long he holds it:
- Spend your money: every payment needs your face or your words. Possession is not authorization.
- Open anything Vaulted: vaulted things are sealed with a key that is not on the phone. Not hidden behind a prompt. Not there.
- Change your words: needs the current ones, which are in your head.
- Add himself as a device: ten days, every screen you own lights up, one tap kills it.
- Erase you: deletion is the most protected operation we have, above reading.
Everything he can do is a snapshot. Nothing he can do is a takeover.
And on your new phone: your words get you reading your own things within minutes, small payments within a day, and full authority after the waiting period, which nothing objects to, because you already revoked the only device that could have.
Losing everything, and the part we refuse to lie about
House fire. The bag with the phone and the laptop in it. Total loss is rare, and it is the case that decides whether a system like this is honest.
Your words start recovery from any device on earth. What they start is deliberately slow: reading your own data comes back in minutes. The power to move real money or change who counts as you comes back over days. And the entire time, every device ever enrolled and the email on file are being told, loudly, with a one-tap cancel. Someone who stole your words does not get a skeleton key. They get a ten-day countdown pointed at every screen you own.
And then the floor, which we state instead of burying:
If you lose your words and every device, you are gone
Not as a punishment. As arithmetic. Any back door that could rescue you in that state is a door someone else can walk through: a system with no unrecoverable state is a system where a stranger can always get in. Every company that promises otherwise is holding a copy of you, and a copy of you is a thing that can be stolen.
So: write the words down once. Keep the paper somewhere that does not travel with your phone. That single act is nearly all of the self-custody homework there is.
This is also, plainly, what Liir Cloud is for. Most people own one device, and one device is one bag away from total loss. Cloud is the second anchor: an encrypted copy we cannot read, on hardware that does not burn down with your house, with the recovery clock running somewhere a thief cannot reach. It is not more storage. It is how you come back.
The questions with teeth
Someone steals my session: the cookie, the logged-in browser tab.
They get a window display. A signed-in session can look. It cannot spend, cannot open the vault, cannot change anything about who you are, because none of those run on a session. Each one round-trips to your face or your words at the moment it happens. The most common theft on the web buys the least here.
What about malware on my computer?
The honest limit. Malware cannot copy your key off secure hardware, but while it is on your machine it can try to use what you unlock. This is why approvals are designed to be read (one merchant, one amount, on the screen) and why the things that matter most sit behind the vault, which stays sealed until you open it, each time.
Can the government make Liir hand me over?
They can take everything we have. What we have is a registry of public keys, encrypted blobs we cannot open, and a verifier that proves you know your words without containing them. We cannot be compelled to produce what we do not hold: that is not bravery, it is inventory. What a court can do is order us to stop serving you, which is why the local copy of your vault is yours and always will be: your vault card carries the two public halves of recovery (the vault id and the salt), so your words on paper, the card, and copies of your sealed files open the vault anywhere, with us or without us. Our gatekeeping can slow an attacker down, and it can never strand you.
Someone forces me to unlock it, in person.
Cryptography does not solve someone standing over you, and we will not claim otherwise. What the design does: big changes take days and scream to every device, so coercion has to last ten days and stay quiet, which it rarely can. It is a mitigation, not a solution, and that is the most honest sentence available on this subject.
You let people PRINT their vault words?
We do, and we will defend it. Your words never touch our servers either way: printing routes them through your machine and your printer, nothing of ours. Paper is the most battle-tested key storage in history: it cannot be phished, cannot be exfiltrated over a network, and survives every password reset ever invented, which is why banks mail PINs, hardware wallets ship blank recovery cards, and the backup-code pages of the largest companies on earth have a Print button on them today. What actually loses vaults is a shaking hand miscopying word four. The print flow interrogates you before it prints (are you somewhere private, is the printer yours) and the card itself repeats the warning. The people this decision serves do not post about security; they have a fireproof box and a grandchild. We built it for them.
Why should I believe any of this?
You should not, yet. Belief is what the next section is for.
What we have not done yet
A security page that only lists strengths is an advertisement. Here is the other column, kept current on purpose.
- No third-party audit has happened. The design you just read has not been attacked by professionals we paid to break it. It will be, before the parts that move money leave testing, and the results will be summarized here, including the embarrassing parts.
- This is a very small team. That means one set of eyes wrote what one set of eyes reviewed. The counterweights: the design leans on published standards rather than invented cryptography, and it is written down publicly (this page and its companions) so it can be attacked on paper before it is attacked in production.
- The recovery machinery is being built to this spec, not finished. Anything described above in the future tense is exactly that.
- Found something? bugs@liir.net reaches a person. Real findings get credited by name if you want, and thanked either way. A formal bounty comes with the audit.
Disclosed is strong. Discovered is fatal. We intend to stay in the first column.
We hold nothing worth stealing.
You hold everything,
and we built for the day you drop it.
Security that depends on
nobody making a mistake
is not
security.
Phones get stolen. Words get glimpsed. Houses burn down. The design assumes all of it, and the worst day still ends with you, still you.
or start with why this exists · it is free on your own hardware
Sources
- OWASP, Password Storage Cheat Sheet. The key-stretching floor the vault meets (600,000 iterations of PBKDF2-HMAC-SHA256) is OWASP's current recommendation, not a number we picked.
- IETF CFRG, The OPAQUE Asymmetric PAKE Protocol. The math with a name: proving you know your words without the words ever reaching the server.
- BIP-39, the 2,048-word list the mint draws from. Six uniform draws from 2,048 words is 20486: the 66 bits is arithmetic, not marketing.
- NIST, SP 800-63B, Digital Identity Guidelines. Why chance chooses the words and taste does not: human-chosen secrets concentrate into a guessable few.
- W3C, Web Authentication. The passkey standard: keys bound to hardware, released by presence: the reason there is nothing to phish.
- NIST, SP 800-38D. AES-GCM, the authenticated seal on every relic: tampering is not a risk to detect, it is a decryption failure.
These are the standards the design leans on, named so the claims can be checked rather than trusted. The missing citation is the one we owe you: a third-party security audit. It has not happened yet, and this page says so above.
Keep reading: Why this exists · What it does to scams · The notary · we can prove when