Repository navigation
docs: Define supported threat model - #227
BenWestgate wants to merge 2 commits into
Conversation
This comment has been minimized.
This comment has been minimized.
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
This is not clear and concise enough. I didn't fully review it.
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 645c5a9e77
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
645c5a9 to
67be0b9
Compare
|
Replaced the long general threat-model document with a concise installer-specific model, and based it on the claim-bounding branch. It now identifies only CipherStick-controlled boundaries and explicitly separates inherited Tails, Bitcoin Core, hardware, and operational risks. |
This comment has been minimized.
This comment has been minimized.
1 similar comment
This comment has been minimized.
This comment has been minimized.
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
AI-generated review (Claude), posted at the maintainer's request.
ACK 67be0b9 (content). It needs the same rebase as #226.
- The boundaries are the right four, and the non-goals avoid restating upstream docs.
- The first line ("does not manage wallet keys") becomes false once #230 lands. Reconcile whichever merges second.
8073a8a to
c0609f5
Compare
67be0b9 to
586bf83
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 586bf83f2a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
35bbefe to
93ace5f
Compare
This branch carried old copies of #202, #226 and #227. Take 212's tree and reapply only this PR's change: HANDOFF.md, the README handoff link, the copied-chainstate trust warning and the new FAQ handoff entry, fitted to #226's rewritten FAQ. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PjUU3NvvEE8SGD3RdpXWDr
This comment has been minimized.
This comment has been minimized.
cbd18f8 to
c326dc1
Compare
43e70fc to
3b531b5
Compare
This comment has been minimized.
This comment has been minimized.
1 similar comment
This comment has been minimized.
This comment has been minimized.
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
Codex current-head review at 3b531b5: no findings. The model cleanly separates CipherStick-owned installer/persistence/update boundaries from Tails, Bitcoin Core, hardware, and operator assumptions, and does not overclaim protection from an attacker who already controls unlocked Persistent Storage.
This comment has been minimized.
This comment has been minimized.
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
AI-assisted current-head review, posted at the maintainer's request.
ACK e0c3744. The delivery-boundary comment is now addressed: the threat model explicitly says current repository clones are not authenticated and tracks signed-release work separately. Lint is green.
Describe only the trust boundaries introduced by the CipherStick installer and handoff guidance, then distinguish them from risks that remain the responsibility of Tails, Bitcoin Core, hardware, and the operator.\n\nFixes #212.
e0c3744 to
c8b005a
Compare
c326dc1 to
7b2955e
Compare
This comment has been minimized.
This comment has been minimized.
1 similar comment
This comment has been minimized.
This comment has been minimized.
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
AI-assisted current-head review: ACK c8b005a. The threat model distinguishes installer-owned boundaries from Tails/Core trust assumptions and states the current unauthenticated-clone limitation. No findings.
This branch has not been deployed
1 participant
What
Define the installer-specific trust boundaries and distinguish them from upstream and operator risks.
Why
The threat model should say what CipherStick changes without restating Tails or Bitcoin Core documentation, or claiming it removes their residual risks.
Closes #212
Testing
git diff --check