Security

Every membership change and every edit is signed by its author and checked by every member against the signed membership history. Anyone who forwards data, including other members, the network and our server, can drop messages but cannot forge or change them.

What can go wrong, and what stops it

• A viewer edits the page's JavaScript and sends edits anyway.
  Every member checks the author's role in the signed history. The edits are ignored and not passed on.
• A member or relay rewrites someone else's edit.
  Each edit is signed by its author. A rewritten edit fails the check.
• A member invents edits in another member's name.
  That needs the other member's private key, which the browser never lets anyone export.
• An editor hides changes attributed to someone else inside his own edit.
  Every edit may only contain changes under its own author. Anything else is rejected.
• A relay withholds edits.
  This cannot be prevented, only noticed: a missing number in the author's sequence shows the gap and members ask others for it.
• Our server or the network tampers with the connection setup between two members.
  Both sides sign the connection fingerprints they saw with their member keys, so a middleman is detected.
• Our server reads your documents.
  It never receives them: no text, name, format, members or roles. Content is also encrypted end to end.
• An outsider who knows a document id asks members for data.
  Members serve nobody who has not proven membership. Outsiders can only occupy a small, capped number of waiting slots.
• An invite link leaks.
  The link only lets someone ask. Nothing is delivered until the owner approves after checking the name and safety code. Links are single use and expire.
• A removed member keeps editing.
  Edits after the removal are rejected and backdated edits are dropped. Keys are replaced, so new edits are unreadable to him.
• A removed member keeps reading old content.
  This cannot be prevented: he already saw it. Jot tells you so before you remove someone.
• An owner is taken over through an owner invite.
  Only the root owner, who created the document, can demote or remove other owners.

Known limits

• Members see each other's IP addresses. A relay (TURN) hides them only when it is needed; there is no hide-my-IP mode in version 1.
• Our server sees IP addresses, document ids, timing and the size of encrypted messages.
• If you lose this browser's identity you lose access. There is no recovery in version 1; an owner can invite you again with a new identity.
• Local data is stored unencrypted in this browser's storage, so anyone with access to your device profile can read it.
• An editor can delete all the text. The history exists in the signed edits, but there is no revert screen yet.
• A removed member keeps what he has already seen, and old keys do not protect the past (no forward secrecy against someone who kept them).

How to verify

Jot is open source. The whole security layer lives in one folder of the frontend (src/core): identity, signed log, envelopes, keys, handshake and sync, using only the browser's WebCrypto. Read it, and read the specification it implements, which numbers every rule so you can check each one against the code and its tests.