Guide Known limitations
Lire en français

Known limitations

What ripoux.fr does not do, or does not do yet. Better to know it before the protest than during it.

A web page, not an installed app

The field phone is a web page. Nothing to install, nothing left behind once it is cleared. In return:

  • Recording stops if the screen locks or if the page goes into the background (another app, an incoming call).
  • No background sending. What is waiting in the queue only goes out while the page is open.
  • Restarting the phone does not restart anything.
  • Discreet mode's automatic resume only acts when the page is reopened, and only if the browser has remembered the microphone permission.

Turn off automatic lock and keep the page in the foreground. See The field phone.

iPhone

On iPhone, all these limits are stricter: recording always stops when the screen locks, and the browser may erase the data of a rarely used web page, this phone's access included. Safari produces MP4 videos, Chrome on Android produces WebM: both are accepted. In the account, MP4 segments play one by one, without continuous chaining; in the export, MP4 takes are not assembled into a single file, only WebM takes are. See Legal export.

No live streaming

Images arrive in segments of 2 to 3 seconds, not live. A contact sees a session a few seconds after it is filmed at best, and only if it is opened to them.

Blurring: what it does not do

Publishing a blurred copy is reserved for the admins of a collective. Automatic detection misses faces in profile, from behind, blurred or very small: only a human review of the whole masked version guarantees the result. iPhone takes (MP4) and passages mixing sound-only segments or photos are not supported. Rendering happens in real time, in a desktop browser (Firefox or Chrome). The published proof establishes where the footage comes from, not that nothing else was edited. The originals are never blurred.

Sending the legal archive to a lawyer through a protected link is not available. Go through a read-and-modify trusted contact, or download the archive.

Verifying a decrypted file

Each file in the export is checked with sha256sum against its plainHash in the signed and timestamped manifest. That hash is computed and declared by the phone: the server, which only sees encrypted data, cannot check that it matches the content. It attests that it received it at a given time, and nobody can produce, after the fact, another file with the same hash. The chain hashes (hash), on the other hand, cover the encrypted segments: they can only be recomputed from the archive when it contains the encrypted segments and the session key (option checked by default), which also link each decrypted file to its encrypted segment without relying on the phone. See Legal export.

A single server

ripoux.fr currently runs on a single server, with a single hosting provider.

  • If the server is unavailable, the field phone keeps everything in its queue, encrypted, and retries. Nothing is lost as long as the page stays open and the phone holds out.
  • The data is backed up, encrypted, at another site. A restore may take time.
  • The server's disk space is limited. If several accounts use their whole quota at the same time, the server may fill up before they do.

The lock and the service operator

The lock is enforced by the server: no request, from anyone, can delete a locked segment or shorten a lock.

With storage on the server's disk, which is used by default, an administrator with direct access to the machine could erase files by bypassing the application. The strong guarantee, where the storage itself refuses deletion, requires object storage with a retention lock ("Object Lock" in compliance mode). This is planned and will be enabled; until then, this guarantee relies on the service operator. A deletion forced in this way would remain visible: the hash chain and the timestamped manifest would show what is missing.

The duress code has limits

  • The screen is identical, but the effects are real: your contacts are notified, the lock moves to 30 days, and the log records it.
  • From the field phone, only the contacts ticked when the session was created receive the sharing, and the decoy does not apply.
  • Without a decoy, the person coercing you sees your real account.
  • With a decoy, an attentive person may notice that it is almost empty. And the decoy carries a legal risk.

One contact can do everything, by default

With the default setting (1 contact needed), each trusted contact can rebuild your entire key on their own, and therefore read your whole account. A higher number of contacts needed, in the advanced settings of the contacts page, protects against a single contact, not against collusion between enough contacts.

A removed member keeps what they saw

Removing a member from a collective cuts their access to the server at once. But what they already downloaded or exported stays with them, and the keys of the collective are not renewed: had they copied them out of their browser, they could still decrypt an archive obtained some other way. Invite only people you trust, and remove without delay those who leave.

The key comes from the server you are using

Encryption happens in your browser, with the code the site sends it. If that code were modified (compromised server, coerced operator), it could capture your passphrase the next time you enter it. This limitation is shared by all encrypted services used through a browser. The code is free and published; verifiable builds are a possible future improvement.

The lock stops at 30 days

Nobody can set a lock longer than 30 days, duress code included. Beyond that, deletion becomes possible again, scheduled 24 h later and cancellable. To keep footage longer, extend the lock before it ends, or export the archive.

No recovery by us

Without a passphrase, a recovery key or enough contacts, your images are lost. That is the price of end-to-end encryption.