Palimpsest
The path of your keystrokes is the secret, not the final string
Specified
Sheet 38 of 47
Description
Two people who both end up with hello in a password field have different credentials if one typed it straight through and the other typed hellp, backspaced and typed o. Palimpsest captures the full ordered edit stream, canonicalises it into a deterministic transcript, and uses that as the credential.
The repository is honest about its threat model up front: it defends against attacks that see the rendered value, not against an attacker who owns the input path. That caveat is the first section of the specification, not a footnote.
Features
- Ordered keystroke edit stream canonicalised into a deterministic transcript
- Characters typed and deleted never appear in the field but remain part of the secret
- Threat model stated up front, including what the scheme explicitly does not defend against