The position
Software should be replaceable.
An app is a temporary thing. It gets updated, deprecated, removed from a store, broken by an operating system release, or abandoned by the company that made it. Building the value of a security product inside an app makes it perishable.
So the app does as little as possible: it encrypts what you type, writes it to the card, reads it back, and decrypts it in memory when you supply the password. It keeps no vault of its own.
That makes the app boring, no accounts, no dashboard, no sync, nothing to log into. Boring software is easier to trust and easier to replace.
What that buys you
Consequences of a thin app.
-
I
Nothing to breach
There is no service holding your vaults, because there is no service.
-
II
Nothing to lose
Delete the app, change phones, switch platforms. The vault is on the card.
-
III
Nothing to subscribe to
You bought cards. There is no ongoing relationship required for them to keep working.
-
IV
Small surface
Fewer features mean fewer places for something to go wrong.
The card is the product.
The app is a tool.