diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-23 18:16:44 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-23 18:16:44 +0200 |
| commit | 1f6b67c7bfc8078991a4607bb0419aea15bfd54c (patch) | |
| tree | 1cb3d8f7ed754d10de72595a6e88e7bcfe8155c9 /docs/MESHBAY_DESIGN.md | |
| parent | 1d169141f3a5542efda2f7fdb0bb88308c06191b (diff) | |
| download | meshbay-1f6b67c7bfc8078991a4607bb0419aea15bfd54c.tar.gz | |
docs: qualify what an invitation link changes about the code
The security claims table, §3.4's property 2, the protocol's stated
limits, the quickstart and the user guide's defaults now say where a
link's code differs: bound to its account only when redeemed, and held
by the hub when the inviter asks it to mail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index e7d7f0c..a9653b6 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -163,7 +163,7 @@ document uses: | Content cannot be modified | ✅ | ✅ | ❌ by design | ✅ | ✅ | | The node cannot be impersonated | ✅ | ✅ | — | ✅ | ✅ | | Client code integrity | ❌ **T3, accepted** (browser) · ✅ ships in the package (native) | ❌ T3 · ⚠️ native: **detectable, not prevented** | ✅ | ✅ | ✅ | -| The hub cannot obtain the group key | ✅ | ✅ **except** in an open-join group, where it can join legitimately (§7.3) | — | — | ✅ | +| The hub cannot obtain the group key | ✅ | ✅ **except** in an open-join group, where it can join legitimately (§7.3), and for an invitation the inviter asked the hub to mail, whose code it then holds (§3.4) | — | — | ✅ | | Node content authority | ✅ | ✅ | ✅ sovereign | ✅ | ✅ | | Devices cannot be added by the hub | ✅ | ✅ — the hub holds no user key and cannot countersign | ⚠️ a node adds a device only to itself, where it already reads everything | ✅ | ✅ | | Chat senders are authenticated to each other | ✅ | ✅ | ⚠️ only for accounts the reader has already seen (§3.3) | ✅ | ✅ | @@ -374,7 +374,8 @@ Four properties, each load-bearing: 2. **The code binds a key to an account**, and the hub never sees it — unless the inviter ticks *Send the invitation by e-mail* (below). 40 bits, Crockford base32 rendered `XXXX-XXXX`, single use, valid for exactly one - account in one group, stored only as `sha256(code)`. A password KDF over 40 + account in one group — except an invitation link's, which names its account + when it is redeemed (below) — stored only as `sha256(code)`. A password KDF over 40 uniformly random bits would buy nothing. Guessing is bounded by 5 attempts per connection and a node-wide lockout, and every attempt is an audit event. 3. **The node's roster is the authority**, not hub membership. A hub that invents |