Privasys Wallet

Privasys Wallet is a FIDO2/WebAuthn authenticator for web services running inside hardware-secure enclaves (Intel SGX/TDX, NVIDIA CC). TESTING The full sign-in flow needs a running enclave with a QR code. To evaluate without one: 1. Launch → Profile tab → "Set up" (biometric setup + hardware-bound key). 2. Profile tab: Personal Data (import / edit attributes, set a photo, "Verify & Import ID"), Drive, Account Recovery (email, recovery codes, guardians, 24-word phrase, devices). 3. Access tab: what can reach the user, each removable: live sessions, access granted to apps, connected accounts, registered credentials, sharing history. Empty on a fresh install. Floating QR button. 4. Settings tab: language, biometric grace period, verification mode, logs, About. 5. Drive (Profile → Drive): a client view of the user's confidential drive over an attested connection (needs a signed-in wallet). It lists files and lets the user approve or decline access requests. The wallet never uploads or stores files. 6. Push: tapping a sign-in push opens the approval screen whether the app is foreground, background, or cold-launched. 7. ID verification (real ePassport/eID, physical device, NFC): Profile → Verify & Import ID → scan the data page → hold the document to the phone → selfie. An enclave checks it, offers the verified attributes, then discards the images. 8. Access requests: an attested app can ask for limited, revocable access to something the user owns. The approval names both parties and may show a form the service needs (e.g. a mail password), sent only to that service over attested RA-TLS. Only an app can start this. 9. Passkey provider: Settings → General → AutoFill & Passwords → Privasys Wallet. Serves passkeys on this device. DEMO: https://explorer.privasys.org, "Authenticate" tab, shows a QR. Open it on a computer and scan it from the Access tab. No account needed. PERMISSIONS • Camera: QR scanning, photographing the ID data page (its machine-readable zone unlocks the chip), and an optional profile selfie. Nothing is uploaded. • Photos: the system picker, only to choose a profile photo. The app sees only the photo picked. • NFC: reading a passport or ID card chip, only during verification. • Face ID: unlocks the device-bound signing key. The ID-check selfie is matched against the chip photo inside the enclave and not retained. • Push notifications: optional, for approvals and recovery alerts. The token goes only to relay.privasys.org and privasys.id. ENCRYPTION HTTPS (TLS 1.2/1.3), RA-TLS for enclave connections, ECDH-P256 + HKDF-SHA-256 + AES-256-GCM and XChaCha20-Poly1305, via OS crypto and standard libraries. No custom algorithms. ITSAppUsesNonExemptEncryption = NO (export-exempt). NETWORK • relay.privasys.org: sign-in relay • as.privasys.org: attestation verification • privasys.id: identity service; holds no personal data in readable form (recovery routing, encrypted backups only the user's phrase opens) • The identity-verifier enclave: only during document verification • OAuth issuers (Google / Microsoft / GitHub / LinkedIn): only on attribute import • Enclave hosts the user connects to, and the service holding a resource the user grants access to, over attested RA-TLS • api.developer.privasys.org: app listings and identity resolution for the approval screen No analytics, advertising, or tracking SDKs. SIGN-IN The app is itself an authenticator: no username, no password, no account to issue. A hardware-bound key is generated on first launch by confirming the device's screen lock, which MUST be enrolled first (a device prerequisite, not a login). Do not use "Recover Account": it restores an existing wallet from a 24-word phrase. On a fresh install use "Set up" on the Profile tab. ACCOUNT DELETION Data is on-device. Profile → Clear All Data. privasys.id keeps no readable personal data.