5412e020bb
/wipe overwrites the message log and VACUUMs; identity and friends stay. /wipe-all deletes the data dir after confirm so the next open is a new person. Neither runs without a typed confirm screen.
1.8 KiB
OnionWire threat model (v1)
OnionWire is a two-party chat over Tor onion services. There is no chat server.
Tor relays are not a chat server
Each install hosts its own v3 onion and dials friends’ onions through in-process Arti. Relays move cells; they never see plaintext, never store messages, and never hold a roster. Compromising a relay is not compromising OnionWire’s message store. The store is the sqlite file on the endpoint.
Location updates are not a missing-person finder
A signed loc frame (onion, ts, sig) rewrites a friend’s locator only if that friend is already in the roster, the signature verifies against the pinned pubkey, and ts is newer. There is no directory, DHT, or introduction server. If you rotated while they were offline, they cannot find you until they rescan your QR. OnionWire will not hunt for a missing person.
Rotating the onion does not revoke a friend
F4 changes the locator only. The identity key is unchanged. Anyone who already has your pubkey can still prove they are talking to you, and a later QR/rescan with the same k updates their row. To become a new person, /wipe-all (new identity key). There is no in-band unfriend/revoke in v1.
v1 stores plaintext locally
The message log, identity secret key, and friend public keys sit on disk unencrypted (aside from whatever the OS/FDE provides). A seized laptop yields the chat history and who you talk to. /wipe overwrites message bodies and vacuums; /wipe-all deletes the data dir. sqlcipher is out of v1.
Fail closed
Peer onion down → send fails. Fingerprint mismatch vs the pinned key → hard fail, no send. Arti HS experimental: if it cannot publish, OnionWire stops; it does not fall back to C-tor.
Out of v1
Prosody, XMPP, s2s, MAM, carbons, outbox, multi-device, DHT / name server, sqlcipher.