Device Identities

A phone, a tablet or a laptop can hold a Whisper identity without running anything Whisper wrote. The device gets its own /128 with the same published records an agent identity has, and it uses that identity for one purpose: asking Whisper's resolver for DNS answers, and getting a policy verdict with each one. Nothing is installed beyond an encrypted-DNS setting the operating system already has.

What the device gets

Adding a device mints an allocation and publishes it. The reverse record names the device identity, the forward record resolves back to the address, and the registry answers for the allocation, exactly as in The Address as Identity. A stranger verifies a device identity with the same keyless call that verifies an agent.

The device is also handed the places to point its resolver at: an encrypted DNS endpoint over HTTPS, a hostname for platforms that speak DNS over TLS, and a configuration profile for Apple platforms. Set Up a Device walks the per-platform flow.

The device token

The credential a device carries is a device token, and it is deliberately narrow. Its whole reach is resolving DNS as that device and reading that device's own lookup history. Every control-plane operation refuses it, so a token lifted off a phone cannot mint an identity, change policy or read another device's history.

The token is shown once, when the device is added. The encrypted DNS endpoint carries it inside the URL, which makes that URL a secret in its own right: treat it as a password and keep it out of tickets and screenshots. If it leaks, remove the device, which rotates the credential, and add it back.

What the state column means

A device identity reads as confirmed once it is registered and while it has not been revoked. That is a statement about the registry rather than about the device: it says an allocation exists and stands, not that the phone is switched on or sending its lookups to Whisper. Read the device's own query history to answer the liveness question.

Policy is set once, for the account

A device identity is a subject of policy rather than a place policy is written. The allow list, the block list, the default action and the resolution mode apply across the account, and every device inherits them. Resolver Policy is the reference, and How Resolution Works covers what happens to a lookup on the way to an answer.

Removing a device

Revoking a device identity withdraws its records and de-provisions its encrypted DNS, so the token stops resolving and the name stops answering. The same call locks that device's stored history: afterwards every read is refused, including yours, so export what you need first. Revoke an Identity is the same operation with the same proof steps.

A device identity and an endpoint

A device identity governs what a machine looks up and gives it a name anyone can check. A machine that also runs the Whisper sensor is an endpoint: it reports processes, connections, files and detections, and it can act locally. The two are separate registrations, and one machine can hold both. Endpoint Security covers the sensor side.