Paper6 min read
A chat that forgets you.
On purpose.
We built a chat room for the whole world and taught it to have a terrible memory. Here is how, in eight short scenes with pictures.
Abstract
The OmniGet chat lets anyone talk to us without an account, an email, a cookie or a script from another company. The server stores four things per message and nothing that points to a person. Flood control uses a key that dies every hour, a signed ticket and a tiny puzzle the browser solves. Everything melts after 30 days. Below: how each piece works, the threats it covers, and the ones it cannot.
Nothing to take
Most chats start by asking who you are. Ours starts by not wanting to know.
There is no sign up, and no email, cookie or phone number. You open the page and you are in the room, with a silly name like Sleepy Otter 42. Nobody types it: the server makes it from your connection with a key it keeps only in memory and throws away every night, so you keep it all day, nobody can borrow it, and tomorrow it is a new one.
| Kept | Never kept |
|---|---|
| a number, to keep the order | your IP address |
| the minute it arrived, in UTC | your browser and system |
| your name for that day | your language or country |
| the text you wrote | a cookie, an email, an account |
A bouncer who forgets faces
Any open room attracts robots selling SEO. Our old board got more spam than bugs. So the door needs a bouncer, and bouncers count.
Ours counts with a blindfold. Your connection becomes a code made with a secret key (an HMAC). The key lives only in memory and is thrown away every hour, along with every count made with it. Next hour, you are a stranger again.
The code is never written to disk, so it is not in the database, in a log or anywhere a backup could catch it.
A tiny puzzle for every message
Before you can send, the server hands your page a ticket, signed with another key that lives only in memory. A ticket works once, and only a few seconds after it was issued, which is about how long a human takes to type.
While you type, your browser solves a small puzzle on that ticket in the background: find a number that makes its SHA-256 start with 16 zero bits. It takes your computer a moment. It takes a spam farm sending millions of messages a lot of electricity.
So flooding the room costs CPU time, and stopping it costs nobody their privacy. You never prove who you are, only that your browser did a little work.
No JavaScript? Fine. Tor Browser at its safest level still works: the form posts as plain HTML, with stricter limits instead of the puzzle.
Words in a jar
A message is text and only text. No images, no previews, no embeds. A link stays a line of letters and never becomes something you click by accident.
An image in a chat is a tiny request to someone else's server, and that request carries your IP address. Here there is nothing to load, so reading the chat never tells anyone you were reading it.
The whole site loads nothing from another origin: no fonts, no analytics, no CDN. A strict Content Security Policy makes the browser refuse anything else, even if someone tried.
Everything melts
Messages are deleted after 30 days. Not hidden: deleted, with the database set to overwrite what it removes.
Times are kept to the minute, not the second, so a message cannot be matched to a precise moment somewhere else.
The web server keeps a small anonymous log for visit counts. Chat requests are skipped entirely: the log does not even know a message was sent.
When someone misbehaves
Anyone can press Report. When three different connections report the same message, it hides itself until the author looks at it. One angry person cannot erase someone else alone.
The Official badge, with Loop as the avatar, cannot be faked. It is not a name you type: it only comes from a command run on the server. Names like Tonho, OmniGet or Admin are refused from the web.
On a bad day the author can slow the room down or pause it for a while.
What we cannot promise
To answer you, any server has to see your IP address while the request is happening. Ours uses it for that hour's code and forgets it. We cannot make the internet itself forget: your provider, your network or your country may see that you visited getomniget.com.
And words can give you away. If you write your name, your city or a link to your profile, that is now public for 30 days.
Threat model, in one table
| Someone wants to | Covered? | Why |
|---|---|---|
| read the database and find who wrote what | Yes | it holds no IP, browser, email or cookie |
| link two messages to the same person | Mostly | messages from one connection on the same day share a name; across days they do not |
| flood the room with spam | Yes | tickets, puzzles and hourly limits |
| pretend to be the author | Yes | the badge comes only from the server |
| see that you visited the site | No | your network can; use Tor Browser if that matters |
| recognize you by your writing | No | no software can stop that |
Read it yourself
You do not have to trust this page. The chat server is one file of plain Python with no third party libraries, server/contact/contact.py in the site's code, under GPL-3.0. The rules above are written in it, line by line.
Open your browser's developer tools on the chat and watch the network tab. You will see your page talk to getomniget.com and to nobody else.
The chat is open if you want to test any of this. Come say hi.