README.md


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

# 🔐 NoFuture-Memguard-PQ

**Ephemeral Post-Quantum Text Encryption Plugin for Mainstream Chats**

Version 0.5.0 | Built with love and defiance | Privacy is a human right, not a feature

## 🎯 What is it?

NoFuture-Memguard-PQ is a **detached external encryption plugin** for any instant messaging platform. Use it in one browser tab while your mainstream chat (WhatsApp Web, Telegram, Signal, etc.) runs in another.

**Key features:**
- 🛡️ **Memguard-protected memory** - Keys and plaintext secured against root access and memory dumps
- 🔒 **Detached architecture** - Completely isolated from mainstream chat platforms (no backdoors possible)
- 🔥 **Ephemeral by design** - Total key destruction on session end (no future access)
- ⚡ **Post-quantum ready** - Roadmap includes Kyber1024-90s and Dilithium5-AES
- 🖱️ **Anti-keylogger keyboard** - Virtual keyboard with randomized layout

## 🚀 Quick Start

```bash
# Install
git clone <repository-url>
cd nofuture-memguard-pq
go mod download
go build -o nofuture main.go

# Run
./nofuture
# Open http://localhost:8080
```

## 📖 Documentation

For complete documentation, open `https://safecomms.virebent.art/README.html` in your browser.

## ⚠️ Production Deployment

**NEVER expose the Go server directly to the internet without HTTPS.**

Use a reverse proxy (nginx, Caddy) with TLS certificates:

```nginx
server {
    listen 443 ssl http2;
    server_name safecomms.yourdomain.com;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}
```

## 🔐 Security Model

1. **Memguard** (PRIMARY) - Protects keys + plaintext in RAM against dumps, swap, debuggers
2. **Detached Architecture** - Mainstream platforms never see keys or plaintext
3. **AEAD Encryption** - XChaCha20-Poly1305 prevents tampering
4. **Total Destruction** - Keys irreversibly wiped on session end

## 📊 What's Fixed in v0.5.0

✅ Plaintext now protected by memguard (was vulnerable)
✅ Real encryption (XChaCha20-Poly1305 AEAD) instead of XOR
✅ Real key exchange (NaCl box) instead of XOR
✅ HTTPS enforcement (reverse proxy required)
✅ CORS restrictions (no wildcard)
✅ Rate limiting (60 req/min per IP)
✅ Request size limits (1MB max)
✅ Session timeouts (24h max)
✅ Authenticated encryption (prevents bit-flipping)
✅ Session isolation (no cross-contamination)
✅ Secure cleanup on exit

## 🗺️ Roadmap

- ✅ v0.5.0: Memguard + XChaCha20-Poly1305
- 🔄 v1.0.0: Kyber1024-90s + Dilithium5-AES (true post-quantum)
- 🔄 v1.1.0: Per-message ratcheting (forward secrecy)
- 🔄 v2.0.0: Browser extension

## 📜 License

MIT License

## 💬 Support

Report security issues privately. For other questions, open an issue.

---

**One conversation. One key. One chance to read. No future access.**