A different product entirely
A bracelet that works for the person wearing it
Not a monitor somebody else reads. A device that lets you prove you got where you were going, that the strap was never opened, and nothing else about your day.
The ask was for bracelets for everyone: a band that keeps a record that you got places safely, that nobody took it off you, that nobody forced you anywhere. That is not a smaller version of the monitoring device on the devices page. It is the opposite of it, and this design document treats it as a separate product with its own constraints.
The monitoring device produces evidence about a person for somebody else to read. This one produces evidence for the person, which they hold, and disclose only when they choose. Everything below follows from that one inversion.
The test that separates the two
Ask who can read the record without the wearer's cooperation. If the answer is anyone - a parent, an employer, a platform, a court with a subpoena to the vendor, an attacker with the vendor's database - it is a surveillance product wearing an attestation label. The construction below is built so the honest answer is nobody, because the device holds the key and the operator holds nothing worth taking.
What it can attest, and what it cannot
This is the part of the idea that has to be got right before any of the cryptography matters, because a claim the hardware cannot support is worse than no claim at all: it is a false assurance carried by a device that looks authoritative.
It can attest
- Presence at an anchor. "This bracelet was within range of the anchor at Meadow Road crossing between 08:14 and 08:16." The anchor is a fixed installation with a known identity; the bracelet heard it.
- Arrival. The same claim, at the destination, which is the one most people actually want: proof of getting there.
- Strap continuity. "The optical loop through this strap was unbroken from 07:40 to 18:02." The device knows this directly.
- Removal attempts. A break, a stretch beyond tolerance, or a splice attempt is a witnessed event with a timestamp.
- Body contact. Whether it was on a wrist rather than in a bag, from capacitance and skin temperature.
- Its own gaps. A period with no anchor in range is recorded as a gap, not silently omitted. A record that hides its own holes is not evidence.
It cannot attest
- That nobody bothered you. This is the honest correction to the original ask, and it matters. The device has no sensor for it - no microphone, no camera, and by design it never will. It cannot certify the absence of an event it cannot perceive.
- That nobody forced you anywhere. It can show where you were. It cannot show why, and a coerced journey looks exactly like a chosen one.
- That you were safe. Continuity and arrival are proxies. Sold as safety they become the false-security harm this document warns about elsewhere.
- Where you were between anchors. It receives; it does not locate. See the constraints below.
Promising the absence of an unsensed event would be exactly the kind of claim this site exists to refuse. The right product language is "I can prove I arrived and that the strap was never opened," and nothing beyond it.
The construction
The wearer holds a signing key generated on the device and never exported. Through the day the bracelet appends events to a local list. At the end of the day it commits the whole list to a single hash and signs it. Any one claim can then be handed to somebody with a short proof that it belongs to that commitment - and the proof carries nothing about the rest of the day.
- Each event is salted. Sixteen random bytes from the device's own generator go in before the event text is hashed. This is not decoration, and it closes two separate leaks. The first is guessability: "arrived at the library at 15:42" carries almost no entropy, so an observer holding the root and one undisclosed sibling hash could confirm a guess by hashing every plausible sentence until one matched. The second is repetition. A real day says the same thing more than once - several continuity assertions covering the same anchor read word for word alike - and unsalted, those events would hash to identical leaves, so the tree itself would announce which parts of the day were the same as which other parts. With a distinct salt on every event, two identical sentences produce two unrelated hashes and the repetition disappears.
- Each leaf is hashed with a leaf tag. A single byte,
0x00, before the salt and the event text. - Each interior node is hashed with a different tag.
0x01, before the two child hashes. The two tags mean a leaf can never be replayed as an interior node, which is the classic way a proof of this shape is forged. - An odd node is promoted, not duplicated. Carrying the lone node up unchanged avoids the ambiguity where two different event lists produce the same root.
- The root is signed by the wearer's key. One signature covers the whole day. Nothing leaves the device unsigned and nothing is signed twice.
- Disclosure is one claim, its salt, its position, and the sibling hashes on the path to the root. A verifier recomputes the leaf, folds the path, compares the result to the signed root, and checks the signature. The other events appear only as opaque hashes.
A day of sixteen events discloses in four sibling hashes. The proof grows with the logarithm of the day, so a busy day is barely larger than a quiet one.
Generate a day, disclose one claim, verify it
Real WebCrypto SHA-256 and a P-256 signature, computed in this browserComputing the day's commitment.
The day, as the bracelet holds it
- -Generating a day of events.
The claim being disclosed
One event and its salt.
Its inclusion proof
- -Sibling hashes on the path to the root.
- The verifier is handed one claim, its salt, the sibling hashes and the signed root. Nothing else leaves the wearer.
The key pair is generated in this browser and never leaves it. Salts come from the browser's own generator, so every regeneration produces a different root for the same shape of day - which is the property that makes an undisclosed leaf unguessable and stops two events carrying the same sentence from hashing alike. The check page runs this construction against its vector table: a valid proof verifies, a tampered leaf fails, a proof for an event that is not in the tree fails, and the root changes if any event changes.
Receive-only, exactly as the child device is
Everything the child-side device is forbidden from doing, this device is forbidden from doing, for the same reason and with the same force. A wearable that reports where a person is becomes a stalking instrument the moment somebody else controls the account, and the published record on children's trackers is not a warning about the future.
| Year | What was found | Source |
|---|---|---|
| 2017 | Children's watches where the IMEI alone authenticated the account, returning the child's name and geofence locations; one could be commanded to place a silent outbound call, making it a remotely controllable listening device. | Mnemonic AS for the Norwegian Consumer Council, #WatchOut [33] |
| 2019 | About 600,000 devices found using the default password 123456, with all traffic in plaintext HTTP. | Avast / Martin Hron [34] |
| 2026 | More than 70 tested devices - tens of millions of units - funnelling through just three shared backends, where an attacker could locate a device, alter emergency contacts, falsify location, and activate microphones and cameras with no visible indication. | Stykas & Solferini, Black Hat [35] |
| 2021-24 | More than 40,000 stalking reports involving item trackers reached one manufacturer, whose own documents conceded its safeguards would deter rather than prevent misuse. | Item-tracker stalking litigation reporting [36] |
70+ tested children's tracking devices - tens of millions of units - funnel through just three shared backends.Stykas & Solferini, Black Hat (Aug. 7, 2026)
An attacker could locate a watch, alter emergency contacts, falsify location, and activate microphones and cameras with no visible indication.
The lesson is structural and it is the reason for C-5 below: the backend is the attack surface, and it is probably not operated by the company whose name is on the box.
| Constraint | Requirement | How it is met |
|---|---|---|
| C-1 Receive-only for location | The bracelet never broadcasts identity or location. It listens for anchors and records what it heard. | No outbound radio for positioning at all. The day's record moves off the device only when the wearer syncs it, over a link the wearer initiates. |
| C-2 No microphone, camera or remote-call capability | Absent from the bill of materials, not disabled in software. | A part that is not fitted cannot be enabled by a firmware push, an account takeover, or a court order. This is the single most important line on the page, because every documented failure above went the other way. |
| C-3 No location history on the device | The device holds today's events and the commitments for the retention window the wearer chose. It holds no continuous track. | There is nothing to breach and nothing to subpoena that the wearer has not already chosen to keep. |
| C-4 Linked-account changes are visible and delayed | Adding, changing or removing a guardian or any linked account notifies every existing party and takes effect after a delay. | The standard mitigation against an abuser silently seizing an account. It is also the mechanism a coerced wearer needs, because a silent takeover is how coercion is normally operationalized. |
| C-5 Named, audited backend operator | Contractually identified in the product documentation, independently penetration-tested, results published. | "We use a cloud provider" is not an answer. The operator is named, or the device is not fit to sell. |
| C-6 The wearer holds the key | Signing keys are generated on the device and never exported. No escrow, no recovery service, no operator copy. | An escrowed key is a key somebody else can be compelled to produce, which reintroduces everything C-1 to C-5 removed. |
The flaw: a bracelet that proves you were somewhere is a bracelet you can be made to wear
Every property that makes this device useful to a person who chooses it makes it useful to somebody who wants control over them. A controlling partner who says wear this so I know you got to work. An employer who makes it a condition of a shift. A landlord, a school, a treatment program, a parent of an adult child. The device does not know the difference between a wearer and a hostage, and it never will.
Voluntariness is therefore not a property of the product. It is a property of the environment the product is sold into, and it has to be defended in law as well as in hardware.
Duress
- A duress gesture that looks like nothing. A sequence the wearer can perform with the device on their wrist and both hands visible, which marks the day's events as made under duress. The mark is carried inside the wearer's own commitment, so it is present in any disclosure the wearer later chooses to make and absent from anything the coercer can read.
- A duress state that does not announce itself. No change in indicator, vibration, battery behavior or sync timing. A duress feature a coercer can detect is a feature that gets the wearer hurt.
- A plausible-deniability disclosure. Because disclosure is selective, a wearer under observation can produce the arrival claim being demanded of them without producing anything else, including the duress mark.
- No remote wipe, and no remote anything. A coercer with account access must not be able to erase a record, and neither must anybody else.
Retrievability
- The record is not retrievable by anyone but the wearer. Not by a guardian, not by an operator, not by the manufacturer, not by an employer who bought the device.
- Purchase does not confer access. If a company issues these to staff, the company holds no key and receives no record. It receives whatever an employee chooses to disclose, and nothing else.
- Minors are the hard case and are treated as one. A guardian relationship is legitimate and it is also the most common coercive relationship. The answer is C-4 - visible, delayed changes - plus a graduated handover of key custody with age, written into the product rather than left to a setting.
- No operator-side index. The operator cannot enumerate wearers, days or anchors. If it could, the subpoena target is the operator and the whole construction was theatre.
Compelled wearing has to be prohibited, in the statute
This is a design requirement that cannot be met by design. It needs drafting, and it needs it before the first device ships, because the drift is fast and one-directional.
| Requirement | What it says | Why the softer version fails |
|---|---|---|
| Prohibition on compelled wearing | No employer, landlord, school, insurer, platform or service provider may require the wearing of a personal attestation device, or condition a benefit on it, or offer a discount for it. | A prohibition that omits pricing is not a prohibition. A discount for wearers is a penalty on non-wearers, arrived at by a different route. |
| Prohibition on compelled disclosure | No party may require production of a bracelet record as a condition of employment, tenancy, enrollment or service. | If the record can be demanded, the device is compulsory whatever the first rule says. |
| No adverse inference | The absence of a record, or a refusal to disclose one, may not be treated as evidence of anything. | Without this, everyone wears one to avoid looking like they have something to hide, which is compulsion by reputation. |
| Court orders are the narrow exception, and are named as such | A court may order monitoring under supervision. That is the other device, under the legal architecture, with the process that goes with it. | Blurring the two lets a supervision tool be sold as a consumer product and a consumer product be repurposed as a supervision tool. |
| Sunset and reauthorization | The statutory framework expires unless renewed on published outcome data. | The same requirement this document places on every other component. A scheme nobody has to justify again is a scheme nobody measures. |
Mandatory in practice, which is how voluntary systems end
Nothing has to be made compulsory for it to become compulsory. The sequence is well worn and it does not require anybody to act in bad faith. A device becomes common. Insurers offer a lower premium to wearers. An employer adopts it for lone workers, reasonably. A school offers it to parents, and the parents who decline are asked why. A court, in a custody dispute, is shown one parent's records and not the other's. Within a few years the honest description of the system is that everybody wears one, and the word voluntary is doing no work at all.
The countermeasures are the three rules above - no conditioning, no compelled disclosure, no adverse inference - and one measurement obligation: the operator publishes what share of wearers acquired the device on someone else's instruction. A number that climbs is the system telling you it has stopped being voluntary, and it is the only early warning available.
The honest summary
- What it is. A device that produces evidence for its wearer, held under the wearer's own key, disclosed one claim at a time.
- What it proves. Presence at named anchors, arrival, strap continuity, removal attempts, and its own gaps.
- What it cannot prove. That nobody bothered you, that nobody forced you, or that you were safe. No sensor for any of it, and none will be added.
- What it risks. Being made compulsory in fact while remaining voluntary in name, and being used as an instrument of control by the person closest to the wearer.
- What it is not. Not the monitoring device. Not a find-my-person product. Not a safety guarantee, and not a substitute for anything that actually keeps people safe.
This page is part of a design document. No bracelet described here has been manufactured, and the constraints above are requirements written to be argued with, not features of a shipping product.
How this works
1:10 · narrated · captioned · nothing here is sent anywhere when you press play. Prefer to read it? The transcript is below.
Transcript
| At | Section | What it says |
|---|---|---|
| 0:02 | A different product | This is a different product entirely. The monitoring device produces evidence about a person for somebody else to read. This one produces evidence for the person wearing it. |
| 0:12 | The separating test | The test that separates them is one question. Who can read the record without the wearer's cooperation? Here the honest answer is nobody, because the key never leaves the device. |
| 0:24 | The construction | Each event is salted and hashed into one commitment for the day, signed by the wearer. One claim can then be disclosed with a short proof, and the rest of the day stays opaque. |
| 0:35 | What it cannot say | It cannot attest that nobody bothered you. There is no sensor for that, and by design there never will be. It cannot certify the absence of an event it cannot perceive. |
| 0:46 | The flaw | A bracelet that proves you were somewhere is a bracelet you can be made to wear. The device cannot tell a wearer from a hostage, so voluntariness has to be defended in statute. |
| 0:56 | It runs here | The commitment and the proof run on this page with real WebCrypto. Generate a day, disclose one claim, edit it after signing, and watch the verification refuse it. |