What Klenod protects, and what it doesn't
What Klenod protects, where its limits are, and what you can do about them.
The short version
Klenod is built to keep a locked library unreadable to anyone who gets hold of its files without your passphrase. It doesn't hide who you are on the network, hide that a library exists, or protect a Mac that someone else already controls.
What is encrypted
- Your video. Lake at dusk.mov, 22 MB
- Cut into pieces. Up to 4 MiB each: five full, one short
- Each piece sealed. XChaCha20-Poly1305. Names, folders, tags, dates and places too
- What your storage, or a copy, holds. Sealed pieces, their sizes, when they change
- File contents, file names, folders, tags and the list of what's in the library, using authenticated encryption (XChaCha20-Poly1305). Tampering is detected when data is read.
- Your passphrase protects the library's key through a slow, memory-hard key derivation (Argon2), which makes guessing expensive. A long passphrase still matters.
- The library's key is kept in locked memory while the library is open, and wiped when it closes.
Watching and browsing
- On screen. Only while you watch
- Decrypted in locked memory. A few pieces at a time, kept out of swap
- Your library on disk. Stays encrypted, with no decrypted copies saved
Klenod decrypts into memory to show a photo or play a video, a few blocks at a time. It does not write decrypted files to disk to do that, and keeps no thumbnail cache on disk. The pieces it keeps in memory for smooth playback are locked so macOS never writes them to swap, and the app's web view keeps no data on disk, so there is no media cache either.
Klenod's window is left out of screenshots, screen recordings and screen sharing unless you turn that off, and library folders are excluded from Spotlight. A camera pointed at the screen, or software that controls your Mac, can still see what you see.
There is no mounted drive, no kernel extension and no Finder in between, so there is no Quick Look cache, no Trash and no file-system history to leak from. Klenod sends no crash reports. We test for leftovers on a Mac and keep closing the ones we find. Some things stay outside any app's reach, such as how macOS handles its own memory, and that is why the library locks itself when the Mac sleeps or the screen locks. Keep FileVault on. It protects what macOS keeps on disk, and Klenod's unlock screen tells you when it's off.
On-device search
Searching by the words in pictures, grouping faces into people and finding similar pictures are off until you turn them on for a library in Settings. A helper on your Mac does the work, using Apple's Vision framework and a face model that ships with the app. macOS stops that helper from using the network, writing files or starting other programs, and an automated test checks that it can't. It reads your photos and videos from the open library through Klenod, a piece at a time.
What it finds (the words, face measurements, the names you give people and picture fingerprints) is stored encrypted inside the library and its second copy. Shares never include it. Turning everything off, or Start over, permanently deletes it.
Opening cloud links
When you open a link from MEGA, Proton Drive, WeTransfer, Yandex Disk or another service, Klenod talks to that service directly. The service sees your network address and which files you read, as it would in a browser. Connections are direct unless you set a proxy in Klenod's settings. The Mac's own proxy settings are ignored. With one set, everything Klenod sends goes through it or not at all, including name lookups, so Tor and SOCKS5 or HTTP proxies work without leaks. A VPN that covers the whole Mac carries its traffic either way. A proxy hides your network address from the service, not your account or the fact that a link was opened.
When you back up, Klenod checks files against what the service publishes: Proton Drive's block hashes and file key, checksums from Yandex Disk and Mail.ru Cloud, exact sizes everywhere. That proves the copy matches what the service served. It says nothing about who made the file.
Storage
| Who | What they can see |
|---|---|
| Someone who copies your library | Encrypted data only. Without the passphrase, nothing readable. |
| Your storage provider (S3, iCloud Drive or Dropbox) | Encrypted data, sizes, and when things change. |
| Someone using your unlocked Mac | Whatever you can see. Lock the library when you step away (⌃⌥⌘L from any app). It also locks when idle, when the Mac sleeps and when the screen locks. |
| Someone with your lost or stolen Mac | Your library stays encrypted. With FileVault on, the rest of the disk is too. Klenod's unlock screen tells you when it's off. |
| A drive that fails or is lost | Nothing readable. Your second copy (in Backup) opens with the same passphrase, and Check library finds slow damage early. |
| Malware or an administrator on your Mac | Outside what Klenod can protect against while the library is open. |
Passphrases and keys
Changing your passphrase stops the old one from opening this copy of the library. It doesn't change the key underneath, so an old backup of the library still opens with the old passphrase.
Rekeying is for when you think your passphrase leaked. Klenod copies everything into a new library with a new key, in memory, without writing decrypted files. Copies of the old library still open with the old passphrase, so destroy them. No software can change what they already hold.
Forgetting your passphrase means the library can't be opened, unless you made a recovery key. The recovery key sets a new passphrase. Anyone who has it and your library can do the same, so keep it as carefully as the passphrase. Klenod keeps no copy of either.
Deleting
Deleting a file moves it to Recently deleted, inside the encrypted library, where you can restore it for 30 days. After that, or at once with Delete now, its encrypted pieces are deleted. It all happens inside the library, so nothing passes through the Mac's Trash or is decrypted along the way. This is ordinary deletion, so other copies, storage version history and drive-level remnants may still exist.
Sharing
A share link contains the key to what it shares, so anyone who has the link can open it until you stop sharing or it expires. Send links privately, and use one link per person so you can stop sharing with one without affecting the others. Shares are signed, so someone who has you in their contacts can check a link came from you.
Reporting a problem
You can read exactly how encryption, playback and sharing work in the source code, how a library is stored in the format description, and how Klenod is tested on How it's built.
If you find a security issue, please report it privately on GitHub before publishing it. You'll hear back within five working days.