A security term is useful only when you know what it protects, what it leaves exposed, and which action it changes. These definitions connect the vocabulary to decisions about private photos and files.
Find a concept
- AES-256-GCM: AES-256-GCM is authenticated encryption that combines AES with a 256-bit key and Galois/Counter Mode to protect confidentiality and detect unauthorized changes.
- Argon2id: Argon2id is a memory-hard password-processing function that makes each attempted secret more costly to evaluate by requiring both computation and memory.
- Photo metadata: Photo metadata is information stored with or about an image, such as capture time, location, device details, editing history, orientation, and color information.
- End-to-end encryption: End-to-end encryption protects content so that its intended endpoints hold the decryption capability rather than an intermediary service that transports or stores it.
- The term Zero-knowledge in private storage: In private-storage descriptions, the phrase zero-knowledge usually means a provider is not given the secrets needed to decrypt a specified set of user content; the exact scope must be stated.
- Secure Enclave and Android Keystore: Secure Enclave and Android Keystore are platform security facilities involved in protecting cryptographic operations or key material; they are not interchangeable names for an encrypted photo vault.
- Plausible deniability in a vault app: Plausible deniability in a vault interface means ordinary use can reveal one private space without the interface itself confirming every other space that may exist.
- Decoy vault: A decoy vault is a separate private space containing selected material that can be opened without displaying the contents of another vault.
- Duress vault: A duress vault is a configured vault whose opening triggers an emergency response affecting other protected content; in NullVault that response can remove access to other local vaults.
- Panic wipe: Panic wipe is an emergency action intended to remove future access to protected local content; its name alone does not establish physical erasure of storage or deletion of remote copies.
- Recovery phrase: A recovery phrase is secret material used by a supported recovery process to regain access to encrypted content; it does not recreate a missing copy of that content.
- Encrypted backup: An encrypted backup is a separate recoverable copy of content protected by encryption, together with a documented way to restore it using the required credentials.
Apply the definitions
Start with the security architecture for NullVault’s implementation, or use the private-photo threat model to identify the problem you are trying to solve. No single algorithm, storage label or emergency control covers every situation.