Grábrók · Borg

Grábrók is a podcast booth at the University of Akureyri: a physical kiosk running an Electron application on a dedicated machine, recording into BORG, the backend I built for the university. The interesting part of it is not the recording. It is the authentication.

The design problem

Take the booth seriously as a piece of public infrastructure and the authentication question stops being a checkbox. A member of staff recording a lecture supplement wants the file attached to their name — they will want to find it again, and the university will want to know who spoke. A visiting speaker on campus for one afternoon — or a prospective student, or a parent on a campus tour — has no institutional account, and is not going to acquire one for a ten-minute recording.

Both single-path designs fail, and they fail in opposite directions:

• Everyone through SSO. Clean, auditable, and it deletes the guest use case — which on a walk-up kiosk in a public building is often the case that matters most.
• No authentication at all. Fast, welcoming, and it produces unaccountable audio on university hardware, published under the university's name, attributable to nobody.

So the real question was narrower, and more useful than "how do we add a login": not whether to authenticate, but where.

Two paths through one booth

Signed in

The idle screen carries a QR code, refreshed automatically so it is never stale while the booth sits unused. A registered user scans it, signs in on their own phone through the university's single sign-on, and confirms the pairing with an explicit action — tengja klefann. There is no silent binding: no session is ever attached to someone who did not actively agree to it. The booth then picks up a scoped booth-session token, a klefalota, on its next poll, and records under that person's real name.

The token is the load-bearing piece. It is short-lived, valid for one recording session, and verified server-side. Ownership is derived from it and from nothing else the kiosk can assert about itself. That matters because the thing you are authenticating is a shared machine in a hallway, and a shared machine should be trusted with as little as possible.

Putting the sign-in on the phone follows from the same reasoning. Nobody should type a university password on a keyboard that a hundred other people touch. The phone does the authenticating; the booth only needs proof, once, that it is talking to the right session.

Guest

One tap on the screen. No phone step, no account, recording starts. A sentinel identity mints the session instead of a real user, so a token exists — the upload path never runs unauthenticated — but it is bound to no person.

Accountability then moves to where it belongs. Nothing recorded at the booth — signed in or not — reaches the public feed on its own; booth recordings are drafts by construction, and a person publishes them deliberately. Only the browser recorder, used by someone already signed in at their own desk, publishes directly. That is the trade the design actually makes. Not "prove who you are before you may speak", but "speak freely, and a human decides before it is published in the university's name".

What happens after you stop recording

The signed-in flow uploads the moment recording stops. No extra tap, no confirmation screen. An earlier version asked first — send it now, or keep it in the booth — and that step cost a user a recording, so the step came out. The general rule I took from it: the fewer decisions a booth asks of someone mid-recording, the better. The booth also signs itself out after a few idle minutes and clears its local state, but defers that logout while a recording or an upload is still in progress, so the timeout can never be the thing that eats your work.

A signed-in recorder gets a real notification when their file is live on Borg — not just an administrator's dashboard. That was a deliberate correction: the system used to tell the admins and not the author.

Guests get their recording handed straight back — a QR code on screen, or a link by email, going directly to that one recording and nothing else. A walk-up recorder retrieving their own file should not be the moment they finally meet the sign-in screen they were spared five minutes earlier.

Inheriting the system

I did not start this project. It came to me as an existing prototype with a working idea and a first shape of the interface, and I took it over in May 2026. Before changing any behaviour I wrote a full assessment of what was there, and worked from that rather than from impressions.

What followed was a rewrite of the trust and authentication model rather than a set of patches. The original system was built on different assumptions about who has to prove who they are, and those assumptions were the thing that had to change. The idea itself and the interface's first shape carried forward; the original authors are credited in the project itself, and that is worth saying plainly rather than quietly overwriting.

The Grábrók surface carries 54 automated tests of its own, inside a much larger suite that runs on every change. A failure in the session store refuses the request rather than falling back to trusting the client.

The face

The idle screen is a full-bleed photograph of the Grábrók crater the booth is named after, desaturated and darkened so the university's red and white type sits cleanly on top. Two columns: the name and the instructions on the left, the QR code and two entry points on the right — Instructions and Record as guest.

Tapping Instructions before scanning does not produce a wall of text. It asks which of the two flows you are in — I have a Borg account or I'm a guest — and explains that one. The authentication argument reaches the surface as a layout decision: the first thing the screen does is let you say which kind of person you are.

Not "how do we add login" — but where exactly does identity need to attach, and where does it just get in the way.

Idle-screen background photograph: Jakub Hałun, Wikimedia Commons, CC BY-SA 4.0.