Fingerprints

The auditor’s next request sounds like a trap and is one. Show me one runner’s password. Say, bib 11208’s.

The correct answer, which Finn gives with visible relief, is that nobody at Traversal can. The users table stores no passwords. It stores the output of hashingConcept · lights on your maphashingA one-way transformation: input in, fixed-size fingerprint out, the same input always making the same fingerprint, with no way back. Login hashes the attempt and compares fingerprints, so the company never keeps, can never leak, and can never tell you your password. Also used for integrity: a changed file means a changed fingerprint., and a fingerprint is not a face. When Case logs in, the typed attempt is hashed and the fingerprints are compared. Match, enter. The password itself exists nowhere but Case’s head, which is why an honest service answers a forgotten password with a reset link and never, ever, with the password.

The impostor

The auditors probe one classic confusion on purpose. The timing vendor’s XML feed wraps its payload in base64, and base64 is encodingConcept · lights on your mapencodingTransforming data for format reasons: base64, URL-encoding. No key, no secrecy, trivially reversible by anyone. Emphatically not encryption: “it’s base64-encoded” means it is, security-wise, plaintext., a repackaging with no key and no secret, undone by anyone in one line. Encoding dresses data for travel. Encryption locks it. Confusing the costume for the lock is how systems end up “protecting” card numbers with the digital equivalent of pig latin, and the auditors are pleased to find Traversal’s docs make the distinction in bold.

The calendar entry

Last stop: the secrets manager, met in Act III handing each container its credentials at wake-up. Next week its calendar fires a post-race ritual, key rotationConcept · lights on your mapkey rotationRegularly replacing keys and credentials with fresh ones. It limits how long a silently stolen secret stays useful, and it flushes out forgotten hard-coded copies, which break on rotation day. That is the point. Painless rotation signals health; “we can’t rotate that key” is a confession.: every API key, database credential, and signing secret replaced with a fresh one, on schedule, while nothing is on fire. If some forgotten script has a key pasted into it, Tuesday will find that script the honest way. It will break, loudly, on a scheduled day with room to absorb it.

The auditors’ notebooks are nearly full. One thread remains, and it is the one this act has been circling since the photographs: not how the data is guarded, but why Traversal holds so much of it at all.