Guide What the operator sees
Lire en français

What the operator sees

ripoux.fr has an administration area. This page says what it shows, because you are entitled to know, and what it cannot do, because it is built that way.

Who gets in

Ordinary accounts, listed one by one in the server configuration. There is no separate administration password and no back door: the operator signs in like you do, with a passphrase. Every action taken in that area is written to an administration log that is never purged.

What it shows

Exactly what the Tor and anonymity page describes, laid out differently:

  • Activity: number of accounts, sessions and segments received per day, last upload, pending jobs.
  • Accounts: handle, kind, creation and last-activity dates, volumes, number of sessions, contacts and phones, whether codes are set, the date a duress code was used if ever.
  • Sessions: recording windows, lock and its end date, number and size of segments, arrival times, hashes, connected phones, shares and their state, manifest and timestamp.
  • Storage: what the database declares against what the store contains, to spot orphan or missing files.
  • Data held: the inventory of every table, field by field, with its nature: clear, encrypted by you, hash, or excluded.

What it does not show, and never will

  • Your images, your sound, your photos, your positions.
  • The names of your sessions and contacts, your profile.
  • Your passphrase, your keys, your contacts' key shares.

These are encrypted in your browser with keys the server never had. The administration area shows them as opaque blocks, and that is all it can do with them.

What it can do

  • Maintenance: run the scheduled jobs pass without waiting (closures, reminders and sharing, purges), delete orphan files the store agrees to release.
  • Delete a session or an account, under the same conditions as you: never while a segment is locked. Deleting a session goes through the same 24 h delay, is written to your journal, and you can cancel it from your account.
  • Sign out everywhere: close every open sign-in of an account, in all its browsers. The person signs in again with their passphrase.

It can neither shorten a lock, nor read a segment, nor sign in as you.

Registrations and limits

So that the service is not swamped by mass-created accounts (which costs storage locked for 30 days), the operator has a few settings, adjustable at any time: registrations open, invite only or closed, with a message on the creation page; storage quota of new accounts; maximum number of accounts created per 24 hours; a global ceiling above which no account or session is created any more, running sessions keeping a margin to finish. These settings never touch what was already sent.

Sponsorship

In invite-only mode, every account keeps track of who issued its invitation code. The operator sees that tree and can delete an account with all its descendants, under the same conditions as any deletion: never while a segment in the branch is locked. Nothing else is kept about the link between two accounts.

Publications and reports

When a collective publishes a blurred copy, the operator hosts that copy, in clear, on its server: it is the only readable data it holds about footage. The Publications tab lists the copies online, listed or not (an unlisted publication, absent from the public list, is marked “Unlisted”), most reported first, with the reason, the details and the optional contact of each report.

Recommended procedure: read the report, watch the passage it points to, and remove the publication if a face is recognisable or the content is plainly unlawful. Remove deletes the video and its preview at once, leaves a “removed by the operator” page, notifies the collective with the reason and records the removal in the administration log. A report that needs no action is marked “handled”. The IP address of the person reporting is not kept.

In Settings, the operator can close publications: no new copy, those online staying until they are removed.

If an authority lawfully requests information, the operator can only hand over what it holds: the legal export of an account. It is a file containing every database row about that account, encrypted blocks included as they are, with the inventory saying for each field whether it is readable. Authentication material (hashes of the passphrase, of open sign-ins and of codes) is excluded: it describes nobody and its disclosure would weaken the account. The key bundle encrypted with the passphrase is excluded too: it would allow passphrases to be tried offline. No IP address, no e-mail, no name: the service does not collect them.

If images are requested, a session archive provides the segments as received: encrypted. Without your key they stay unreadable, for the operator as for the recipient.

Every export is written to the administration log. The procedure recommended to the operator is in the project's security model (docs/SECURITE.md, section 7).