Approve from your phone, through a relay that cannot read the card

The app's bargain is that a bot asks before it acts, which only works while you are at the computer. From 0.10.0 a waiting card can also go to a phone you paired, and your answer there counts exactly as a click on the desktop would.

Pairing

In Settings › Phone approvals, press Pair a phone and scan the code. The phone signs in as you, makes its own keys, and both screens show the same six characters. You compare them and press Pair on the computer. That comparison is the point: it proves the phone in your hand is the one the computer is about to trust.

The pairing secret and the computer's key travel in the part of the link after the #, which a browser never sends to a server. The page reads them and removes them from the address at once. lobstack.ai never learns either.

What travels, and what lobstack.ai sees

When a bot stops to ask, the computer seals a copy of the card for each paired phone, with a key only that phone shares, bound to that approval and that phone. lobstack.ai stores the sealed copy and hands it over. The phone opens it, and your answer goes back signed with a key that never leaves the phone.

The relay can see that a card is waiting, when it was sent, how long it waits, its sealed size, and whether the answer was approve or deny. It cannot see the bot's name, the command, the path, the diff, whether the card is a payment, or why you denied it. Nor can it forge an answer: that takes the phone's private key.

Before applying an answer the computer checks it twelve ways, among them: signed by a phone paired on this computer, never seen before, for a card this computer sent that phone, matching what was sealed, inside its window, and not the approval of a payment.

The rules that do not bend

• Payments are approved on the computer. A phone can deny one, never approve it.
• Scheduled runs never ask your phone. They still refuse risky steps on their own.
• Nothing is sent until you pair a phone, and every call goes out from your computer.
• A card waits 15 minutes, an hour, four hours or until its run ends; an hour by default. Decide it on the computer and it is withdrawn from the phone.
• The lock screen shows one line, "<bot> wants to <action>", never the detail.

The risk we name

The page that opens the card on your phone is served by lobstack.ai. Someone able to change that page's code could change what it does with what it opens. That is the one risk this design does not remove, and it is why payments stay on the computer.

Phone approvals need Sign in with Lobstack. The approval gate is in the app docs.