diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 20 | ||||
| -rw-r--r-- | docs/MESHBAY_HTTP_API.md | 1 |
2 files changed, 19 insertions, 2 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index f9ceaa2..2174879 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -2533,9 +2533,25 @@ Two things survive on purpose: the nodes refuse the account and close the groups' sessions now. A node that is offline misses it. -Registration is gated by a CAPTCHA whenever one is configured — **unconditionally**, +**Registration and the passphrase-reset request are gated by a proof of work** +(`captcha.py`), on unless `[captcha] enabled = false`, and **unconditionally** — not only when some other field is absent, or the real client's ordinary request -skips it. The desktop client renders the widget too. +skips it. The hub signs a challenge (the SHA-256 of a nonce, an expiry and a +number below `max_number`) with a key derived from its own private key; the page +finds the number while the form is being filled in and sends it with the form. +An answer is checked against the hub's signature, its expiry, and the answers +already spent, so one solve is one form. **No third party is involved**: no +script, cookie or visitor address leaves for anyone else, which is what keeps the +sign-up form free of a consent it could not ask for freely. What it buys is cost +per attempt, not a verdict on who is human; the bound that holds against a +caller with machines to spare is the mail budget (§7.4), since these two routes +are what make the hub send mail. + +**The sign-up form states what the hub keeps**, as a notice and never a checkbox: +the account rests on the terms of use and the connection log on a legal +obligation, so there is no consent to collect, and one that blocks sign-up would +be neither free nor withdrawable. The notice links to the legal pages of the hub +in use (`/legal/`), which are its operator's to write. **Sessions end three ways, all admin settings in hours** (`session.*`, §7.4): diff --git a/docs/MESHBAY_HTTP_API.md b/docs/MESHBAY_HTTP_API.md index 73d079d..be4e7e2 100644 --- a/docs/MESHBAY_HTTP_API.md +++ b/docs/MESHBAY_HTTP_API.md @@ -40,6 +40,7 @@ hub also serves the web application at `/` and `/app/`, which are not listed. | Method | Path | Auth | What | |---|---|---|---| +| GET | `/v1/users/captcha` | none | A proof-of-work challenge for the register and reset-request forms. | | POST | `/v1/users/register` | none | Create an account. | | POST | `/v1/users/verify-email` | none | Verify a registration email with the code received by mail. | | POST | `/v1/users/me/bundle-pepper` | user | The pepper, for a session that has just been given the passphrase again. | |