5412e020bb
/wipe overwrites the message log and VACUUMs; identity and friends stay. /wipe-all deletes the data dir after confirm so the next open is a new person. Neither runs without a typed confirm screen.
27 lines
1.8 KiB
Markdown
27 lines
1.8 KiB
Markdown
# OnionWire threat model (v1)
|
||
|
||
OnionWire is a two-party chat over Tor onion services. There is no chat server.
|
||
|
||
## Tor relays are not a chat server
|
||
|
||
Each install hosts its own v3 onion and dials friends’ onions through in-process Arti. Relays move cells; they never see plaintext, never store messages, and never hold a roster. Compromising a relay is not compromising OnionWire’s message store. The store is the sqlite file on the endpoint.
|
||
|
||
## Location updates are not a missing-person finder
|
||
|
||
A signed `loc` frame (`onion`, `ts`, `sig`) rewrites a friend’s locator **only if** that friend is already in the roster, the signature verifies against the pinned pubkey, and `ts` is newer. There is no directory, DHT, or introduction server. If you rotated while they were offline, they cannot find you until they rescan your QR. OnionWire will not hunt for a missing person.
|
||
|
||
## Rotating the onion does not revoke a friend
|
||
|
||
`F4` changes the locator only. The identity key is unchanged. Anyone who already has your pubkey can still prove they are talking to you, and a later QR/rescan with the same `k` updates their row. To become a new person, `/wipe-all` (new identity key). There is no in-band unfriend/revoke in v1.
|
||
|
||
## v1 stores plaintext locally
|
||
|
||
The message log, identity secret key, and friend public keys sit on disk unencrypted (aside from whatever the OS/FDE provides). A seized laptop yields the chat history and who you talk to. `/wipe` overwrites message bodies and vacuums; `/wipe-all` deletes the data dir. sqlcipher is out of v1.
|
||
|
||
## Fail closed
|
||
|
||
Peer onion down → send fails. Fingerprint mismatch vs the pinned key → hard fail, no send. Arti HS experimental: if it cannot publish, OnionWire stops; it does not fall back to C-tor.
|
||
|
||
## Out of v1
|
||
|
||
Prosody, XMPP, s2s, MAM, carbons, outbox, multi-device, DHT / name server, sqlcipher.
|