/security

Verify, don’t trust. Here’s exactly what that means.

This page is written the way we’d defend it in the Handshake Discord — including the tradeoffs. Non-custodial by construction: there is no Tilde server that could hold your names.

Your keys: three tiers, plainly stated

Seeds live in the hardware-backed iOS Keychain. You choose at setup — device-only, or end-to-end-encrypted iCloud recovery — and can migrate later. The copy below is the same text the app shows, taken from the code that enforces it.

Guarded

Your seed exists only in this device’s Keychain and never leaves it. Every signing operation requires Face ID or Touch ID. Apple cannot access your keys, and neither can anyone who compromises your Apple account.

If you lose this device without a written-down seed phrase, your coins and names are gone. Permanently. No one can recover them — not Apple, not us, not you.

Resilient

Your seed is stored in iCloud Keychain, end-to-end encrypted. Every signing operation requires Face ID or Touch ID. Your wallet survives device loss, theft, or destruction.

If someone compromises your Apple ID without Advanced Data Protection enabled, they could access your seed. Your security now includes your Apple account hygiene.

Accessible

Everything Resilient offers, but small transactions below your threshold need only device unlock — renewals stay frictionless. Larger transactions still require Face ID or Touch ID.

Anyone who can unlock your device can move funds below your threshold without Face ID. Choose a threshold you can afford to lose.

ScenarioGuardedResilientAccessible
Device lost or destroyedWithout a written seed phrase: total loss.Recoverable — restore via iCloud on a new device.Recoverable — restore via iCloud on a new device.
Apple ID compromisedNo effect. Your seed is not in iCloud.With ADP: seed unreadable. Without: at risk — enable ADP.With ADP: seed unreadable. Without: at risk — enable ADP.
Phone stolen while unlockedThief needs your biometrics to sign anything.Thief needs your biometrics to sign anything.Below-threshold amounts movable; above requires biometrics.

One technical honesty note: Handshake uses secp256k1 keys, which the Secure Enclave cannot hold (it only does P-256). The Enclave protects the Keychain that holds your seed — we won’t claim more than that.

What SPV verifies — and what it doesn’t

Tilde runs an SPV light client over Handshake’s encrypted P2P network. You’re not asking a server what you own — you’re checking. But SPV is not a full node, and we won’t pretend otherwise. The full scope, written out

Proof-of-work block headers, verified on-device against consensus rules
Name-ownership proofs (Urkel tree), checked against those verified headers — including proofs that a name is unowned
Chain tip cross-checked across multiple peers before it’s believed
Bundled bootstrap data (headers, filters, name index) is verified, not merely trusted: headers self-validate on open — linkage walk, compiled-in checkpoints, proof-of-work spot checks — and every block fetched afterwards is merkle-verified against a verified header
Full transaction validation of every block — that’s a full node’s job. SPV trusts the chain with the most work; a majority-hashrate attack could fool it.
Two gaps that are ours, not the model’s: difficulty-retarget validation isn’t implemented yet (compiled-in checkpoints plus a cross-peer chainwork quorum cover it today), and eclipse resistance is incomplete. We’d rather you heard it here.

What each connection mode reveals

Privacy claims mean nothing without the tradeoff table. Tilde is P2P-first by default; the gateway exists as a rescue path.

P2P block scan · default

Your wallet discovers its own transactions by scanning blocks downloaded from random peers over encrypted connections. Reveals nothing about which addresses are yours. A restore matches your addresses against the bundled filters entirely on-device, so even the slow first pass leaks nothing.

Gateway query · rescue path

Asking a gateway about your transactions is faster, but the gateway learns which addresses you’re interested in. Tilde labels this plainly in Settings and never silently falls back to it.

Still skeptical? Good.

Tilde is MIT-licensed, and the full source publishes when 1.0 ships. Until then, take this page as a statement of intent you’ll be able to check — not one you have to take on faith.