Security
Portrait's mission is to enable autonomy in everyday internet usage. Providing a secure and transparent environment for all users is critical to our mission. This means that we are deeply invested in ensuring that your data is protected and that you have full control over your digital identity.
Beta Safety and Security Nets
While Portrait is in beta, we have implemented several safety and security measures to protect your data and ensure a smooth user experience. As a result, some features are still under development, and certain limitations are in place.
Smart Contract Limitations
- Deployment: All contracts are deployed on the Base Sepolia testnet.
- Controlled Registration Period: The
PortraitIdRegistryis currently in theControlledRegistrationPeriod()(opens in a new tab). This means that only our team, as the contract owner, can register new Portrait IDs. This measure is temporary and allows us to monitor and control the registration process. In the future, this restriction will be lifted, enabling anyone to register a new Portrait ID. - State Management: The
PortraitStateRegistryserves as a safety net during the beta phase by returning the latest state of a Portrait. This contract will be deprecated in favor of the state provided by hosting nodes.
Some features and contracts are still under development. Here are the components yet to be fully implemented in the application layer:
| Contract | Description |
|---|---|
| PortraitPlanRegistry | Ability to manage the plans associated with a Portrait, including personal, professional, and business types. |
| PortraitIdRegistry | The ability to tokenize and manage ownership of a Portrait is forthcoming. |
| PortraitAccessRegistry | Future implementation will allow management of access control for a Portrait. |
Hosting nodes
When checking in once per 24 hours, you essentially post a proof that you still have the data on your device. The caching nodes cache your proof for at least 24 hours, for others to see. By default we run a dedicated network of caching nodes to secure the network while utilizing a fleet deployed by Waku too. The status of our current fleet of caching nodes can be found on our status page (opens in a new tab).
The caching nodes function as a safety net, ensuring that when data is requested, we can relay your proof and the data to the requester. This security layer is essential for PWA's, as they can't be serving all the time due to their limitations. To achieve a more realtime experience of serving data, we recommend running a hosting node in a desktop environment, as it allows you to serve data to others in real time.
As we reach a critical mass of users, we can expect that at any time, someone is online and running a node, making caching nodes theoretically redundant.
Content Topics
During the beta, we are using portrait_test as identifier. This is to ensure that the network is not polluted with test data. In the future, we will switch to portrait as the main identifier.
What if all hosting nodes hosting a Portrait go offline?
Rest assured, we have designed a robust system to ensure your data remains accessible, even if all hosting nodes go offline. The PortraitStateRegistry contract acts as a reliable safety net during Portrait's beta phase, ensuring persistent access to Portrait states by referencing a CID of your Portrait. The data is then offloaded to IPFS, Arweave, and Filecoin to store the actual Portraits, providing multiple layers of redundancy and ensuring data availability.
Our vision is to create a resilient network where data remains accessible as long as there's demand. This mirrors the operation of IPFS, where data persists based on node availability. Users can enhance data availability by running a hosting node or using hosting services, ensuring their data is always accessible. High demand for a Portrait increases its likelihood of being available on the network.
To illustrate caching nodes, think of the IPFS (opens in a new tab) network: data is pinned by nodes and can be retrieved through public gateways. Even if nodes go offline, cached data can still be served temporarily. In Portrait, caching nodes serve a similar role, while hosting nodes act like IPFS nodes that pin data.
Decentralization in our system emphasizes autonomy, permissionlessness, and verifiability; not data persistence.
We are committed to transparency and security as we continue to develop and improve Portrait.