Threat Model and Mechanism

Onyx Mail Security Overview

This page is written for a reader who distrusts claims and trusts mechanism. It states what Onyx Mail protects against, from whom, and what it does not address. Each control maps to a property that can be inspected in the source, in a response header, or in a signed artifact.

Reading Guide

Onyx Mail as it runs today

The posture below covers what Onyx Mail runs and publishes now: a live Tor v3 service, a PGP-signed warrant canary, and the keys that verify it.

Tor serviceLive v3
RuntimeFirst-party only
VerificationLocal GnuPG, off the page
JavaScriptOptional

Threat Model

What the current design addresses

Naming what a system does not protect against is a strength. The lists below separate the reduced risks from the risks that remain the reader's responsibility.

Addressed by the current design

  • Exposure of the reader to third-party trackers, because the runtime is first-party only.
  • Silent substitution of a signed artifact, because the warrant canary is PGP-clearsigned.
  • Reliance on a truncated identifier, because complete fingerprints and the full onion address are published for comparison.
  • A browser that cannot run scripts, because core content is server-rendered.
  • Clearnet network-path observation of a visit, when the reader uses the published Tor v3 address.

Outside the current design

  • A compromised endpoint: malware, a malicious extension, or a hostile operating system on the reader's device.
  • A targeted state actor with the capability to attack an endpoint or correlate traffic at scale.
  • The inherent metadata of email: sender, recipient, timing, and routing are visible to mail systems regardless of content encryption.
  • Coercion or compromise of the operator, which the warrant canary can signal but cannot prevent.
  • A future cryptanalytic development that weakens a deployed algorithm.
AdversaryResisted by the current designNot resisted
Network observerTor access removes the clearnet path from a visit, and same-origin assets prevent third-party beacons.Traffic-confirmation attacks by an adversary who observes both ends of a Tor circuit.
Hostile mirror or cloneA clone cannot reproduce a valid signature from the published key, and the full onion address can be compared character by character.A reader who accepts a short key ID or a partial address instead of comparing the complete value.
Passive artifact tampererAny edit to the clearsigned statement breaks signature verification under GnuPG.A tamperer who also controls the reader's trusted copy of the public key.
Compromised endpointNothing on this surface. This is stated plainly rather than obscured.Keystroke capture, screen capture, or key theft on the reader's own device.
Coerced operatorThe warrant canary is designed to fail visibly when it can no longer be renewed truthfully.Silent compulsion within the signed validity window, and any action a canary cannot lawfully describe.

A canary signals; it does not enforce. An absent, expired, or unverifiable canary must be treated with suspicion rather than dismissed. Inspect the current warrant canary.

Architecture as Mechanism

What the server can and cannot see

Onyx Mail is served as static, inspectable pages. It solicits no account, no mailbox content, and no payment credential, so the data it can observe is narrow by construction.

[RUNTIME ISOLATION]

First-party runtime

One stylesheet and one script serve the interface, both from the same origin. No analytics library, advertising pixel, or externally hosted font is loaded, so no third party observes the reader through this site.

Verify

Inspect the page source and network panel. The document requests only same-origin assets.

[RESPONSE CONTROLS]

Enforced by header

Each HTML response publishes a restrictive Content Security Policy. Object and frame embedding are denied, form actions are denied across the site, and content-type sniffing is disabled.

Verify

Read the response headers for the requested origin. A header cannot protect a compromised client, and this limit is not hidden.

[SIGNING KEY]

Held off the request path

The warrant canary is signed by an out-of-band rotation process. The web application performs no request-time signing and holds no signing secret in the path that serves a page. A page render cannot be coerced into producing a signature.

Verify

The served artifact is static clearsigned bytes. Signature checking is a local operation under the reader's control.

[TOR PATH]

Network path, not identity

Onyx Mail runs a live Tor v3 service, rendered into the first response, so it stays reachable at the "Safest" browser level. Tor changes the network path. It does not establish universal anonymity or protect a compromised browser.

Verify

Compare all 56 hostname characters and the suffix against a trusted source before use.

Operational Posture

Logging, jurisdiction, and legal process

These are statements of principle and present configuration. Where a specific fact cannot be independently verified, it is stated as intent rather than asserted as certainty.

[MINIMAL LOGGING]

Records kept narrow

The structured application logger is designed to record an access event without request bodies, full URLs, cookies, referrers, or raw user-agent strings. The current logging package defines a fourteen-day default retention. Upstream proxy and operating-system layers keep their own separate controls.

Reference

Privacy Policy, data processed.

[JURISDICTION]

Stated in principle

Applicable law governs use of Onyx Mail. Onyx Mail does not invent or advertise a jurisdiction it has not selected and verified, because a fabricated legal claim is the kind of claim this project exists to avoid.

Reference

Site Terms, applicable law.

[LEGAL PROCESS]

Minimization, then the canary

Onyx Mail can disclose only data that exists. It is built to solicit few categories of data, which limits what any compelled disclosure could contain. The warrant canary is the separate, periodic channel through which the operator signals the status of legal process, within the bounds a canary can lawfully express.

Reference

Privacy Policy, legal requests.

[TRANSPARENCY]

Evidence over assurance

Trust state is derived from the rotation-owned canary artifact and fails closed when freshness, signature data, or hash-chain integrity is absent. The site publishes the artifacts and the procedure; it does not publish a browser-generated verdict.

Reference

Verification Registry.

Verify rather than trust

The registry supplies the public values and the local procedure. The warrant canary supplies the current signed statement. The result is established by independent tools, not by this page.

View Verification Registry Inspect Warrant Canary