Threat model summary
The full threat model is one table: every attacker, what they could do, and either the control that stops it or the word GAP. Most rows still say GAP. We publish that rather than hide it.
The yardstick
The design rule is that Pigeon should be unable to know, not merely promise not to look. Where today's code falls short of that, the row is a gap, not a control. Pigeon never scans, classifies or flags private messages.
Who we defend against
| Attacker | Who |
|---|---|
| Network observer | Anyone on the path between a device and a node: an ISP, a Wi-Fi operator, a state tap |
| Malicious node | Runs one or more swarm replicas |
| Compromised Pigeon server | Any service Pigeon runs: push, the name directory, invites, the key-log publisher, the build machine |
| Coercive state | Compels Pigeon the company to hand over, change or add something |
| Device thief | Holds a user's device, locked or unlocked |
| Malicious group member | A legitimate member of a group |
| Sybil operator | Runs many nodes or identities to capture placement or ordering |
| Supply-chain attacker | Compromises a dependency, the build system or a download channel |
| Log reader | Anyone reading the public key log |
| Media abuser | Fills storage, drains bandwidth, or uses media as a free file host |
| Link phisher | Tricks a user into showing a device-link code |
| Factor thief | Holds a copy of a seed phrase or a hardware key |
| Abusive reporter | Files forged, false or mass reports to get someone removed |
Defended today Built
- Message content on the wire and on nodes: MLS plus a sealed outer envelope; TLS 1.3 with pinned node keys; plaintext HTTP refused.
- Group, epoch and sender hidden from nodes: sealed envelopes and rotating mailbox ids.
- Lost or tampered deliveries: quorum writes, durable storage and read repair.
- Forked group history: the commit slot and fork beacon.
- Local data on a stolen, locked device: an encrypted database (SQLCipher, key from Argon2id).
- A thief with an unlocked device: revoke, rotate and quarantine.
Known gaps
- IP and timing correlation. A network observer, or a node forced to log, can correlate a device's traffic by IP address, timing and size. Onion-style routing is Planned, with no design yet.
- Key transparency. Until the key log ships, a compromised directory could show a false key; keys are marked “pending verification”.
- Release integrity. Alpha installers aren't signed and builds aren't reproducible yet; the checksum on the download page only proves the file matches what we published.
- Sybil nodes. With a static node list this is limited; an open network needs the planned registry and stake.
- Node key at rest. A node's TLS key isn't encrypted on disk, and pin and seal-key rotation aren't built.
- Deposit. Anyone can deposit into a mailbox until deposit tokens ship.
Out of scope, stated
- Malware running on an unlocked device can read whatever the app can read.
- Members of a group can read that group's messages; that's what being a recipient means.
Sources: docs/THREAT_MODEL.md (108 rows, 85 with a gap, as of this page's date), ADR-0001, ADR-0003, ADR-0006, ADR-0008, ADR-0013.