diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 13 | ||||
| -rw-r--r-- | docs/QUICKSTART.md | 4 | ||||
| -rw-r--r-- | docs/USERGUIDE.md | 14 |
3 files changed, 26 insertions, 5 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index a47cea0..f42fa69 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -371,7 +371,8 @@ Four properties, each load-bearing: 1. **No public key is ever fetched from a directory.** The joiner's keys arrive from the joiner, both signed together in one transcript (`meshbay:join:v1`), so the identity key vouches for the encryption key. -2. **The code binds a key to an account**, and the hub never sees it. 40 bits, +2. **The code binds a key to an account**, and the hub never sees it — unless + the inviter ticks *Send the invitation by e-mail* (below). 40 bits, Crockford base32 rendered `XXXX-XXXX`, single use, valid for exactly one account in one group, stored only as `sha256(code)`. A password KDF over 40 uniformly random bits would buy nothing. Guessing is bounded by 5 attempts per @@ -419,6 +420,16 @@ being bob on his first connection: | Safety-number comparison | Nothing — but it needs two humans reading digits at the worst moment | correct, unusable as a default | | **One-time pairing code** | **Nothing: the code never reaches the hub** | **adopted** | +**Mailing the code is the inviter's choice, and it gives up the row above.** +The Members tab can ask the hub to mail the code to the invitee's address on file +(`invite-notify`); that request carries the code, so an active hub holds it and +can join in the invitee's place. It is offered because a code that arrives on its +own is worth more to most groups than the property, and it is stated rather than +hidden: the box reads *"Send the invitation by e-mail (may land in spam)"*, is +checked by default, and is **remembered per account** (the `invite_email` +preference), so an operator who unticks it once is not asked to again. Unticked, +the hub is never called and the table above holds exactly. The CLI mails nothing. + **Delegation is designed and deferred.** `invite_create` is authorised as a *role* check against the roster rather than an equality test against the operator, and the `delegate` role value is reserved, so a group admin who does not run the node diff --git a/docs/QUICKSTART.md b/docs/QUICKSTART.md index 92a5cad..4da1eff 100644 --- a/docs/QUICKSTART.md +++ b/docs/QUICKSTART.md @@ -319,7 +319,9 @@ works once, for that account only, for that group only, and the hub never sees it. You do not need to be online when they use it. You can do the same thing from the **Members** tab of the group, from the -browser you paired in Step 8. +browser you paired in Step 8. There, **Send the invitation by e-mail** is ticked +by default and has the hub mail the code for you — which means the hub reads it. +Untick it and share the code yourself when that matters; the box remembers. --- diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md index 0dd5819..d7c3430 100644 --- a/docs/USERGUIDE.md +++ b/docs/USERGUIDE.md @@ -220,9 +220,10 @@ Someone who runs a node invites you. You need an account on the same hub first. You will not be asked again on that browser, or on that machine. -**The code never passes through the hub**, and that is the whole reason it -exists: it proves the invitation came from the person running the group, and -not from the service in the middle. +**The code never passes through the hub** — unless whoever invited you asked +the hub to mail it to you — and that is the whole reason it exists: it proves +the invitation came from the person running the group, and not from the +service in the middle. ### Leaving @@ -548,6 +549,13 @@ membership on the hub and produces a code that never goes near it. Send the code out of band; they enter it the first time they open the group. You do not need to be online then. +The Members tab offers **Send the invitation by e-mail**, ticked by default: the +hub mails the code to the address on their account, so nobody has to copy it. +That is a trade: **the hub then holds the code**, and a hub that wanted to could +use it to join in their place. For a group where that matters, untick it and +send the code yourself — the box remembers your choice. The CLI never mails +anything. + ### Seeing who is in ```bash |