Original Summary

I built a study app that syncs between your devices without any of the usual infrastructure: no user accounts, no server-side auth, no database I control. Here's how the sync works. ─── THE CONSTRAINT The app stores everything in browser localStorage. Users have no account. There is no server that knows who they are. But they want to sync between laptop and phone. So how do you do that? ─── THE SOLUTION: ROOM CODE + PASSPHRASE User picks a room code (e.g., "SAM-2026-XYZ"). It's just a string, no auth. User picks a passphrase. It never leaves the browser. Client derives an AES-GCM key from the passphrase using PBKDF2 with 250k iterations and a per-room salt. Client encrypts the entire state blob locally. Client writes the ciphertext to Firebase (Firestore). Second device enters the same room code + passphrase. It derives the same key, pulls the ciphertext, decrypts locally. Firebase only ever sees ciphertext. Even if their database leaks, the data is unreadable without the passphrase. ─── THE INTERESTING BITS - Salt management: the first device to write the room uploads the salt in plaintext alongside the ciphertext. This is fine because the salt is not secret — it just needs to be unique per room. - Conflict handling: two devices both edit → automatic merge by ID. Deletions use tombstones so a delete on one device isn't resurrected by a merge from the other. - Passphrase recovery: there is none. This is by design. The warning says so explicitly the first time you set it. - Offline behavior: sync is optional and off by default. The app works perfectly without it. ─── WHAT I'D DO DIFFERENTLY - I'd version the ciphertext format from day one instead of adding it later. - I'd make the initial sync dialog more explicit about "this is a one-time merge decision" — I had to patch that in. - Firebase's free tier is generous (1GB stored, 10GB/month transfer) but if this ever went viral, I'd need a plan. For now it's a non-issue. ─── Ask me anything about the sync architecture.   submitted by   /u/netajiputin [link]   [comments]

  • 情报分类：综合情报
  • 分类依据：内容未命中明确的垂直分类规则，归入综合情报
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/9/23 10:00:52