Taushet Security

Independent audit

Until one has been done, everything on this page is our own description of our own work.

WireGuard

Traffic between your device and a Taushet server is encrypted with WireGuard, a modern, widely reviewed tunnel protocol. An optional obfuscation mode (AmneziaWG framing) makes the connection harder for simple filters to classify; it does not defeat a determined deep-packet-inspection adversary.

Account credentials created on your device

Your account is a keypair generated on your device from the operating system’s random number generator. There is no email, phone number or conventional password, and so no server-side password reset. The recovery phrase shown when you create an account is the account’s master secret: anyone who has it can act as the account.

Device authorization

A new device shows a pairing code and a key fingerprint. The device that created the account compares the fingerprint and approves the new device by signing an authorization and encrypting it to that device. The service that relays pairing sees a random code and ciphertext, not your account. A device can later be revoked.

Multi-hop routing

Private Route and Custom Route send your traffic through two servers, an entry and an exit, each admitted with its own credential. Both servers are operated by Taushet, so multi-hop does not protect against Taushet itself, or anyone who controls both servers on your path, correlating your source and destination.

Signed infrastructure information

The list of servers, with their keys, locations and parameters, is signed offline and checked by the app against a key built into it before it is used; the server-load feed is signed with a separate key. The apps reach Taushet’s account and credential services over Tor, so those services do not see your IP address.

A VPN server boots its memory runtime only from an image signed offline: it checks the signature against the release key and refuses a tampered image or one built for another channel.

Servers that run from memory

VPN servers run a signed image from memory, with no swap and their logs held in memory, and a restart erases what that runtime held. A server admits a connection with a short-lived credential, valid for at most an hour, that names no account.

Where this falls short today: the account and credential services run on disk, and that disk is not yet encrypted at rest. The memory-only properties apply to a VPN server only while it is running the memory image.

Work under way and planned

• Full-disk encryption for the servers that run the account and credential services. Not in place today.
• Keeping the image-signing key in a hardware token. Today it is a file kept off every server.
• A signed in-app updater. Today, app updates are downloaded and checked by hand.
• Hardware-backed (TPM) protection for the Windows app’s recovery secret. Today it is protected by Windows DPAPI only.
• Restoring an account from its recovery phrase on a new device. Not built yet.
• An independent security audit.

Reporting a vulnerability

Send vulnerability reports to security@taushet.com. Please include enough detail to reproduce and understand the issue.

We do not currently offer a bug bounty program.

Our security contact is also published at /.well-known/security.txt.