Overview
It's Me is a serverless identity verification system designed to combat deepfake impersonation attacks. The core insight is that while AI can perfectly replicate someone's voice and face, it cannot replicate a cryptographic secret that was exchanged in person.
The system works by establishing a shared secret between two people when they meet face-to-face. This secret is then used to generate synchronized, time-based verification codes that both parties can compare over any communication channel.
Serverless: No backend infrastructure required. All cryptography happens on-device.
Offline: Verification works without internet connectivity.
Per-contact: Each relationship has unique encryption keys.
Time-based: Codes rotate every 30 seconds, preventing replay attacks.
Threat Model
It's Me is designed to protect against impersonation attacks where an adversary attempts to convince you they are someone you know and trust.
Attacks We Defend Against
- Voice cloning: AI-generated audio that perfectly mimics a known person's voice
- Video deepfakes: Real-time or pre-recorded video impersonation
- Caller ID spoofing: Falsified phone numbers or identities
- Account compromise: Attackers using stolen accounts to message as someone else
- Social engineering: Urgent requests exploiting trust relationships
This system cannot verify identity if the initial exchange was compromised (e.g., you added an impersonator thinking they were someone else). The security model assumes trust at the point of in-person contact establishment.
Key Exchange Protocol
When two users want to become contacts, they perform an in-person key exchange using QR codes. This establishes a unique shared secret between them.
QR Code Contents
Exchange Flow
Shared Secret Derivation
Code Generation
Verification codes are generated using a time-based one-time password (TOTP) scheme with custom formatting for easy verbal communication.
NATO Phonetic Alphabet
Words are chosen from the NATO phonetic alphabet for clarity over voice channels:
ALFA, BRAVO, CHARLIE, DELTA, ECHO, FOXTROT, GOLF, HOTEL, INDIA, JULIET, KILO, LIMA, MIKE, NOVEMBER, OSCAR, PAPA, QUEBEC, ROMEO, SIERRA, TANGO, UNIFORM, VICTOR, WHISKEY, XRAY, YANKEE, ZULU
Security Analysis
Why Deepfakes Can't Bypass This
An attacker using AI to impersonate someone faces an impossible challenge: they need to know the verification code, but the code is derived from a secret they don't have access to.
| Attack | Result |
|---|---|
| Attacker clones voice and asks for code | ❌ Attacker can't provide matching code back |
| Attacker intercepts network traffic | ❌ No codes transmitted; derived locally |
| Attacker records and replays old codes | ❌ Codes expire after 30 seconds |
| Attacker compromises server | ❌ No server exists |
| Attacker steals victim's phone | ⚠️ Requires Face ID to access app |
Algorithms & Standards
| Component | Algorithm | Standard |
|---|---|---|
| Identity Key Pair | Curve25519 | RFC 7748 |
| Key Agreement | ECDH (X25519) | RFC 7748 |
| Key Derivation | HKDF-SHA256 | RFC 5869 |
| Code Generation | HMAC-SHA256 | RFC 2104 |
| Key Storage | iOS Keychain | Apple Security Framework |
| Biometric Auth | Face ID / Touch ID | LocalAuthentication |
| Export Encryption | AES-256-GCM | NIST SP 800-38D |
The protocol is intentionally simple and uses well-established cryptographic primitives. Security comes from the mathematical properties of these algorithms, not from obscurity.
Device Transfer
When switching to a new phone, your cryptographic identity needs to be transferred securely. Your contacts will sync automatically, but the identity (stored in the secure iOS Keychain) requires explicit export.
Why Transfer is Needed
Your identity is stored with kSecAttrAccessibleWhenUnlockedThisDeviceOnly, which means it's bound to your physical device and won't transfer via iCloud backup. This is a security feature — but it means you need to explicitly export when switching phones.
Export Process (Old Phone)
- Go to Settings → Export Identity
- Create a PIN (4+ digits) to protect the export
- A QR code is generated containing your encrypted identity
Import Process (New Phone)
- Install It's Me on your new phone
- The app detects your synced contacts and prompts for import
- Scan the QR code from your old phone
- Enter your PIN to decrypt and restore your identity
Export Security
The export QR code contains your identity encrypted with AES-GCM. The encryption key is derived from your PIN using SHA-256 with a fixed salt. Without the correct PIN, the data cannot be decrypted.
If you forget your export PIN, you'll need to create a new identity and re-add all contacts in person. There's no recovery mechanism by design.