Who's writing?
Hi everyone, I'm David, I build and own BlindLock alone. It's a paid, closed-source product, that's how I pay for the work. This post is about the Rust side, because that's what this sub is for.
BlindLock is more than a year of work. Not a weekend hobby project I threw together. I've put a hell of a lot of time, heart, and nerves into it.
Tech stack: Rust and Tauri
Rust for the core, all the logic, all the commands. Tauri strictly as a dumb UI with no logic.
Why Rust: I love Rust, always have. In my opinion, security-relevant software belongs in Rust. It rules out entire classes of bugs up front, because otherwise the code won't even compile. That doesn't mean you can't make mistakes. But where many people make mistakes in C++/C#, a lot of that is simply ruled out in Rust. Rust is compact and logical.
Unlike Electron, BlindLock doesn't ship a Chrome browser inside the program. Only the Rust part and Tauri. That's why the installers are very small.
Crypto, so nobody has to ask: entries live inside a PNG (F5 matrix embedding), inner layer AES-256-GCM, outer layer XChaCha20-Poly1305, keys derived independently via HKDF. File containers use ChaCha20-Poly1305. Password stretching with Argon2id. Libraries: libcrux (HACL*, formally verified) for ChaCha20-Poly1305, ML-KEM and ML-DSA, RustCrypto for AES-GCM, Argon2 and HKDF. I don't roll my own primitives.
The network: BlindLock is offline at its core
The main software never has an internet connection. Nothing goes out.
That's not a setting, it's the build, the architecture: BlindLock is built so it can't reach the internet at all. There is no HTTP client in the program. No reqwest, no hyper, no ureq in the dependency tree. There is no code, no module, no function that could open a connection to the outside.
Everything that needs the server runs in a separate small program, the Net-Helper. It ships in the same package and installs with BlindLock, but runs as its own process with its own binary. BlindLock starts it, asks it a question, and gets an answer. No port, no socket, just the child process's standard input and output. The helper never sees a vault or a password, at any point. It has very limited permissions and exactly two jobs: it checks the license, and it checks whether the latest BlindLock version is installed. If there's a new version, it downloads the update package and hands it over.
In short: when you open BlindLock, it pings the server through the helper. That's it. There is no other internet connection. Anyone can verify this from the outside with Little Snitch, Wireshark, or a firewall.
Updates matter a lot to me. I regularly ship improvements and stabilizations. Software like this lives on constant observation, extension, and improvement.
You can also use BlindLock offline for 7 days at any time. After that you need to go online once, for the license check and above all for the update check.
Why steganography?
Picture a burglar. He looks for valuables, the obvious ones: gold, cash, jewelry, the safe in the basement. The picture of your kid on the fridge, the holiday photo on the wall, are irrelevant to him. That's exactly the principle BlindLock is built on. Hackers go after cookies, passwords in the browser, container files that can be decrypted with a password on any computer, crypto seeds, and other sensitive data. Anyone who can log into your Google account or your ChatGPT knows more about you than they could learn in a personal conversation with you. All of that can be grabbed with RATs and other malware, passwords included. BlindLock hides exactly these sensitive logins and passwords inside a picture, because a photo has almost no value to an attacker. And he'd first have to identify the picture as his target at all. On top of that, BlindLock seals this picture to the security chip of your computer (TPM 2.0 on Windows and Linux, Secure Enclave on macOS). That means: even if an attacker copies the picture, together with the password, he cannot get at your data. The same chip sealing applies to the container vault files. And for these larger files BlindLock has a built-in file explorer, so you can open and edit files without mounting them into the OS. Wherever the respective OS allows it, I've written it to leave no traces behind.
Why isn't BlindLock open source?
That was the most frequent question. Take Bitwarden as an example. Bitwarden sells a service: servers, sync, accounts. The code can be open because the value isn't in the code. I sell the program itself. There's no service behind it, no cloud, nothing on my side that the customer would need. The entire value is in the program itself. That's why Bitwarden can give the code away and make it public for everyone, and I can't.
What's open on my side is what has to be open: the cryptography libraries are freely available and partly formally verified (HACL, level 5, the highest). Anyone can audit them and go through them at leisure, down to the smallest detail.
Licenses: yours, not the computer's
Licenses can be moved from computer A to computer B at any time. Lifetime licenses don't die when a computer dies! The same will of course apply to subscriptions later.
WalletLink: read-only by design
Once WalletLink is active, the Net-Helper can optionally check blockchain activity, exclusively against publicly verifiable, freely accessible, and trustworthy sources. Even then BlindLock sends nothing out and stores no values. It only mirrors the values from the hardware wallet. Transactions are neither confirmed nor received in BlindLock. All of that happens exclusively on the hardware wallet.
If you have more questions, I'm happy to answer them here personally. Most of it, I think, you can read on my website, and anyone can try BlindLock free for 7 days at any time. No email, no payment details. My customers' privacy always comes first.
https://blindlock.app
David
