Rohan Kumar

HostSpica

Rohan builds HostSpica's Android apps — Authenticator, Passkey and Identity — and writes up how they work, including the mistakes along the way.

Articles

• How to check that an Android app has no internet permission (and how we check ours)
• How TOTP works, and how HostSpica Authenticator implements it
• Inside Google Authenticator's export QR code, and why we cap a page at 10 accounts
• How HostSpica backups are encrypted: file formats, key derivation and limits
• Where every HostSpica secret lives: the Android Keystore key hierarchy
• Passkeys from first principles: what happens when you sign in without a password
• How an Android passkey provider works: Credential Manager, step by step
• How Android Autofill works, and how HostSpica Vault gates every fill
• Threat model: what a local-only authenticator, passkey and vault app protects, and what it cannot