ci / test (push) Has been cancelled

Details

[verified] feat(tui): drop unicode QR, share onionwire:v1 invite

F2 shows the invite string with fp/onion hints instead of a terminal QR.
Keep encode/decode and F3 paste; drop the qrcode crate.

2026-09-10 16:53:03 -04:00

2.9 KiB

Raw Blame History

OnionWire threat model (v1)

OnionWire is a two-party chat over Tor onion services. There is no chat server.

Tor relays are not a chat server

Each install hosts its own v3 onion and dials friends’ onions through in-process Arti. Relays move cells; they never see plaintext, never store messages, and never hold a roster. Compromising a relay is not compromising OnionWire’s message store. The store is the sqlite file on the endpoint.

Location updates are not a missing-person finder

A signed loc frame (onion, ts, sig) rewrites a friend’s locator only if that friend is already in the roster, the signature verifies against the pinned pubkey, and ts is newer. There is no directory, DHT, or introduction server. If you rotated while they were offline, they cannot find you until they F3-paste your new invite. OnionWire will not hunt for a missing person.

Rotating the onion does not revoke a friend

F4 changes the locator only. The identity key is unchanged. Anyone who already has your pubkey can still prove they are talking to you, and a later invite paste with the same k updates their row. To become a new person, /wipe-all (new identity key). There is no in-band unfriend/revoke in v1.

v1 stores plaintext locally

The message log, identity secret key, and friend public keys sit on disk unencrypted (aside from whatever the OS/FDE provides). A seized laptop yields the chat history and who you talk to. /wipe overwrites message bodies and vacuums; /wipe-all deletes the data dir. sqlcipher is out of v1.

Fail closed

Peer onion down → send fails. Fingerprint mismatch vs the pinned key → hard fail, no send. Arti HS experimental: if it cannot publish, OnionWire stops; it does not fall back to C-tor.

Profile is friend-visible, not a directory

A signed prf frame is shown to people who already have a session with you. Apply only for existing friends. There is still no name lookup, DHT, or public profile server. Anyone who already has a Noise session can see the profile you send them; that is not confidentiality against that friend.

Monero sidecar is not a wallet

OnionWire never holds spend keys. Optional ONIONWIRE_WALLET_RPC talks HTTP to a user-hosted monero-wallet-rpc. Never trust a rcp frame without RPC confirmation (verified stays 0). Subaddress reuse is the user’s wallet policy.

Backup file is the identity

/backup writes the identity and Noise static secrets. Treat the file like onionwire.db. Restore overwrites self keys and does not rewrite the friends table.

Rate limit is availability, not anonymity

Incoming rendezvous accepts are token-bucket limited (30/60s, burst 10). Excess is dropped without handshake. That is a DoS/availability control. It does not hide that you run an onion, and it is not a traffic-analysis defense.

Out of v1

Prosody, XMPP, s2s, MAM, carbons, outbox, multi-device, DHT / name server, sqlcipher.

2.9 KiB Raw Blame History Unescape Escape