From 1b33002ee7e28e7913624ea11b18d4a9d4f76e28 Mon Sep 17 00:00:00 2001 From: Alain Brenzikofer Date: Mon, 14 Sep 2026 14:06:48 +0200 Subject: [PATCH] disencourage hidden profiles using names --- docs/rfcs/2026-09-10-wallet-keys.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/rfcs/2026-09-10-wallet-keys.md b/docs/rfcs/2026-09-10-wallet-keys.md index 294fac0b75..215eae9ba6 100644 --- a/docs/rfcs/2026-09-10-wallet-keys.md +++ b/docs/rfcs/2026-09-10-wallet-keys.md @@ -132,10 +132,12 @@ signed record edit, not a rebinding of keys. ## Hidden profiles -Nothing about profiles is encoded in the derivation, so the wallet holds nothing -that would disclose a hidden profile. The seed is the device's: whoever unlocks -any profile can export the phrase and derive every name key, hidden profiles -included. A key per profile rather than per device is what would change that. +A hidden profile should not register a name yet. The seed is the device's, so +whoever unlocks any profile can derive every name key. Beyond that, a name is +written into the profile's own row and listed device-wide, and hidden profiles +are a view filter rather than encryption, so the binding is readable beside it. +Nothing in the wallet prevents it, and closing it is work in the profiles and in +the name record rather than here. ## Scope