Other uses / Contacts and following

Contacts and following

People reach you through a card link you choose to share, and only after you accept them. There are no accounts, handles or directories.

Your identity

Your lwis identity is a set of keys, not an account. It lives on one device, the keyring:

• On your phone: open People in the Android app, enter the name you want others to see, and tap Create my identity. It takes about a minute (the phone solves a small proof of work to register with the server).
• On a machine: lwis id create --name "Your name" makes lwis the keyring for that machine.

The two are separate identities: a phone and a machine that each create one are two different people to your contacts. Your other browsers can be linked to your phone's identity instead (see Your devices).

lwis id create --name "Yann"
lwis id show            # your identity, fingerprint, card link and counts

The hosted web app at /capture/ never holds an identity: it runs code served by the website, so it can only be linked to your phone.

Your card link

Your card is a small signed document listing the devices that can receive for you. It is stored encrypted on the server, and the link to it looks like:

https://lookwhatisee.xyz/c/<id>#<key>

The part after # is the key that opens the card. Anyone holding the link can ask to follow you, and nobody else can read your card. The name on your card is only a claim: your contacts pick their own name for you.

• Phone: People shows your card link and a QR code of it, with Copy and Share.
• Machine: lwis card link prints it; lwis card publish republishes the card now.

If a link has spread further than you want, rotate it. The old link stops working and your existing contacts receive the new one automatically:

lwis card rotate

Following someone

Following someone means they can send you captures. You send the follow request; they decide.

1. Get their card link, in person or through a chat you trust.
2. Send the request:
   • Phone: People → Follow someone, paste the link, optionally give them a name, then Send follow request.
   • Machine: run lwis follow.
3. Wait for them to accept. Until then they show as "request sent". The request has to reach them within about 24 hours: an older request is refused, so if they were away longer, send it again.

lwis follow 'https://lookwhatisee.xyz/c/…#…' --petname alice

The command prints the safety number right away, so you can compare it with them before they accept (see Safety numbers).

Accepting follow requests

A request shows the name their card claims, for example "Alice" wants to follow you · unverified. When you accept, you give them a local name (a petname). lwis always shows your petname, never the name their card claims. If the claimed name matches a contact you have already verified, you get an impersonation warning.

• Phone: Accept or Decline on the request. Follow back is ticked by default; untick it if you don't want to receive their captures.
• Machine:

lwis contacts                                   # contacts and pending requests (q1, q2, …)
lwis contacts accept q1 --petname alice         # they can now receive your captures
lwis contacts accept q1 --petname alice --follow-back
lwis contacts decline q1                        # silent by default; --tell lets them know

Accepting lets them receive your captures. It does not let them send you anything unless you follow back. When you both follow each other, the app shows "you follow each other". Unanswered requests are forgotten after 7 days, and at most 50 can wait at once.

lwis contacts shows the same thing as they-send-me and i-send-them.

Safety numbers

A safety number proves that nobody sits between you and a contact. It depends only on your two identity keys, so it stays the same when either of you adds a device. Every pair of contacts has one: 60 digits, plus 8 emoji words derived from the same keys.

1. Open it:
   • Phone: open the contact's safety number from People.
   • Machine: lwis id safety alice.
2. Compare it with your contact's screen. In person, read the 60 digits. On a call, reading the 8 emoji words is enough.
3. If they match, mark the contact verified. On the phone, type the 60 digits from their screen and tap Mark as verified. On a machine:

lwis id safety alice --verify '12345 67890 …'   # spaces don't matter

If the numbers don't match, don't mark the contact verified. Someone may be relaying your messages. Remove the contact and follow them again through a channel you trust.

Blocking and removing

• Block refuses their captures, drops every session with them and removes their doorbell, so they can no longer wake your phone. They are not told. A new request from them is ignored until you remove them.
• Remove forgets the contact and every session with them. They can send a new follow request later.

lwis contacts block alice
lwis contacts remove alice

On the phone, each contact row has a block (⊘) icon and a trash icon (remove); the block icon disappears once the contact is blocked.

Your recovery kit

When you create your identity, lwis generates a recovery kit: 24 words that can move your identity to a new device if the keyring is lost or stolen. The kit is not your identity key itself. It can only announce a successor, and your contacts see that announcement and are asked to verify again.

The kit is shown once. After you confirm one word, it is erased from the device.

• Phone: People → Show my recovery kit, write the words down, then type the word it asks for.
• Machine:

lwis id kit                      # shows the words, then asks for one of them
lwis id kit --confirm 7 <word>   # confirm without a terminal prompt

Write the words on paper and keep them offline. Anyone holding them can announce a successor to your identity.

Restoring from the kit isn't in the app or CLI yet. Keep the words anyway: they are the only way to carry your identity over once restoring ships. Without them, a lost keyring means a new identity, and your contacts have to follow you again.