Delivery between people

Once you've added someone in People, what you send them arrives by itself, and so does what they send you. There's no server of midden's in between. Each person keeps a mailbox folder in their own Google Drive. You post what you send into yours, and the other person's midden collects it from there. Nobody ever writes into anyone else's Drive.

Delivery needs sync to be set up first.

How it works

Adding someone

• First contact is mutual: you scan their card and they scan yours, or you send a card each way. On the phone, add someone asks how you're doing it, then walks you through it: one of you shows first and the other scans first, so you swap places in the middle.
• Set up delivery before you swap: your card says where people fetch from, and a card made without it can't bring you anything later.
• Comparing the safety number on both screens comes last, because it needs both cards. It proves each card really came from the other person.
• A card carries the person's public keys and the address of their hello folder.
• From a card alone you can't send anything to a stranger: midden only accepts messages from people you've added.

The folders

midden mailbox/        private: only you (and midden, through drive.file)
  ├─ hello/            shared by link; its ID is on your card
  ├─ <opaque>/         shared by link; one per contact, its ID handed to them sealed
  └─ <opaque>/

• midden mailbox is private. Nobody but you can list it, so nobody can find your other contacts' folders.
• hello/ is for first contact. Its ID is on your card.
• One folder per contact. When you add someone, midden makes a folder for them, shares it by link, and hands them its ID in a sealed mailbox message (posted in hello/).
  • From then on, what you send them goes there, and they read it from there.
  • Until they've confirmed the handover, things still go through hello/, so sending right after adding someone works.
  • If either side loses track (you remove someone and add them back, restore a backup, or delete the folder from Drive), the folders are handed over again by themselves.
• Folders are named with a random ID and carry no description, because whoever holds a link-shared folder's link can read both. midden keeps who each one is for in its own app properties, so in Drive you can't tell whose is whose.

Checking it works

Setting up delivery tests your mailbox the way a contact reaches it: midden posts a small file in hello/, lists and fetches it without signing in, and takes it down. Each device tests once (a mailbox set up earlier is tested at its next check), and keeps testing while it's failing. People shows the result, along with any trouble from the last check, and check again runs another. It says you're reachable, not that a particular contact has added you.

If your mailbox folder is moved to the trash or deleted

Every check also looks for your folders in Drive.

• In the trash: midden stops posting and offers restore it in People, rather than doing it for you, since you may have meant to. Your folders come back unchanged, so your card still works. What people send you still arrives meanwhile. Drive empties its trash after 30 days.
• Deleted for good: midden offers set up again, which makes a new mailbox with a new address. People you've added can't find it from the old card, so swap cards with them again.
• One contact's folder: a new one is made and handed over to them by itself.

Sending something

Use send on a card (in its ⋯). The same screen opens on the phone and the desktop:

• Who it goes to: pick one person or several. Each gets their own sealed copy. Anyone you haven't compared safety numbers with shows as not verified.
• A message: optional, up to 2,000 characters, and the same for everyone you picked.
• What goes: the item, where it came from, the text midden read from it (a transcript, the words in a picture), and your message. Your tags, notes and reminders stay with you.

A send is a copy: it's theirs once it arrives, and you can't change it or take it back. If delivery isn't set up between you, the screen gives you the sealed copy to pass on yourself, to paste into a chat or save as a file.

When something arrives

• It waits in People for your OK, with the sender's message, and nothing enters your midden until you take it. The people icon in the header counts what's waiting.
• Once you take it, the card keeps the sender's colour along its edge, their initial, and "from" their name. Their message stays on the card as their words, separate from your notes, so you can't edit it. It syncs to your devices with the item, and you can search for it.
• If you decline, the item and its message are dropped.

Sending and receiving

1. Sending: midden seals the item (see Security) and posts it as one file in the folder you made for that person. The file is named <mailbox>.<message id>.i, where <mailbox> is worked out from both people's keys, so only the two of you can work it out.
2. Receiving: your midden lists your contacts' folders and fetches what's yours. It does this without signing in, using midden's API key: the folders are link-shared, and the key only identifies midden's Cloud project to Google, not you.
3. Receipts: once you have an item, midden posts a sealed receipt in your folder for them (<mailbox>.<id>.r.<item id>).
4. Cleanup: when the sender sees your receipt, they take their copy down. Once their copy is gone, you take your receipt down. Everything clears itself, from listings alone, on whichever device checks first.
   • What nobody picks up is taken down after 14 days.
   • Removing a contact deletes their folder, and everything in it. Whichever of your devices has heard of the removal does it; a device that simply hasn't met them yet leaves it alone.

When it runs

• Checking: when midden opens or the browser starts, every 10 minutes while the browser is open, every 2 minutes while the phone app is on screen, and straight away after you send something. Never more than once a minute, except after a send. Once a contact's folder is working and nothing's unanswered, their hello/ is read about every half hour rather than every time. If Google Drive says its limits are reached, midden stops there and waits, up to an hour, longer each time; what's sent keeps waiting in the mailbox.
• What's waiting shows as a count on the people icon in the header.
• Your other devices read the same folders, through your synced contacts. Whichever device adds a contact makes their folder, so there's never a second one.

Security

What protects a message

Each item, receipt and handover is sealed before it leaves the device:

• a fresh X25519 key for every message, agreed with the recipient's key, then HKDF;
• the result encrypted with AES-256-GCM;
• inside, the sender's Ed25519 signature over the header. The signature also covers the recipient's key and the one-time key, so a recipient can't re-seal a message to someone else as if the sender had sent it. The header names the body's hash, so the body is covered too.

Nothing outside the sealed file says who it's from, who it's for, or what it is.

What each party can see

The API key

• The key ships inside every build, so it's not a secret, and it isn't treated as one. It only says "this request is from midden's Cloud project". It doesn't sign anyone in, and it doesn't open anything that isn't already shared by link.
• It's restricted to the Google Drive API.
• The real risk is to quota: someone could use the key for their own Drive API calls, using up midden's quota.

Limits, said plainly

• Link-shared means shared: anyone holding a folder's ID can list it and download its files. The protection is that the IDs are hard to guess, are only ever on your card (hello/) or sealed to one contact, and that every file is sealed.
• What the files reveal: sizes and times show that you're talking, and roughly how much, to anyone who holds that folder's ID (Google included).
• A lost or stolen device holds your keys, so anyone with that device unlocked can read what arrives. There's no remote wipe, and no way yet to replace your card and keys.
• Message size: one message carries up to 100 MB. Anything bigger posted into a folder is ignored, not fetched.
• Messages and older builds: someone on a build from before messages still gets the item, without your message.
• Being sent something you already have: the message shows on the card, but search won't find it until midden next rebuilds its text.
• No arrival alert on the phone yet: items arrive at the next check, while midden is on screen or when you open it, and nothing tells you while it's closed.