mirror of
https://github.com/ruvnet/RuView.git
synced 2026-08-30 03:55:55 +00:00
docs(privshield): rebrand project to "WiFi Veil"
Adopt "WiFi Veil" as the product name across all user-facing surfaces, keeping VEIL (Verifiable Emission-shaping for Identity-Leakage prevention) as the technical codename it's built on. Only prose, titles, descriptions, and the console UI change — no code identifiers, file names, crate/npm `name` fields, or the deterministic proof witness are touched, so `cargo test` and the C-core host test are unaffected. - Crate & research READMEs: title + defining line now "WiFi Veil (codename VEIL — …)". - Cargo.toml / package.json / plugin.json descriptions: "WiFi Veil …". - Console UI (veil-console.html): title, brand, and copy say "WiFi Veil". - Firmware tree (README, per-provider READMEs, BUILD/INTEGRATION/MEASUREMENT): "WiFi Veil protector/core/shield". - Harness manifest: recomputed SHA-256 digests for the four changed packaged files (README, package.json, CLAUDE.md, plugin.json) — all verified consistent. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01WEXNqzs7UsfNFBcP5yW21p
This commit is contained in:
Claude
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "wifi-densepose-privshield"
|
||||
description = "VEIL privacy shield (ADR-288): compliant-waveform countermeasure against unauthorized WiFi sensing. Deterministic attacker-vs-protector experiment that drives beamforming-feedback identity inference toward chance while preserving link throughput. Std-only pure-compute leaf, no async/server/RF-hardware deps; SYNTHETIC data only."
|
||||
description = "WiFi Veil privacy shield (ADR-288): compliant-waveform countermeasure against unauthorized WiFi sensing. Deterministic attacker-vs-protector experiment that drives beamforming-feedback identity inference toward chance while preserving link throughput. Std-only pure-compute leaf, no async/server/RF-hardware deps; SYNTHETIC data only."
|
||||
version = "0.1.0"
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
@@ -12,7 +12,7 @@ categories.workspace = true
|
||||
readme = "README.md"
|
||||
|
||||
# Intentionally dependency-free (mirrors `wifi-densepose-aether`, ADR-185 §13).
|
||||
# VEIL is a pure-compute experiment/reference: no `rand` (its own deterministic
|
||||
# WiFi Veil is a pure-compute experiment/reference: no `rand` (its own deterministic
|
||||
# PRNG), no `std::time`/`std::fs`/`std::env`/threads, so it builds unchanged for
|
||||
# `wasm32-unknown-unknown` and can never emit RF or touch a radio. The shield
|
||||
# *models* compliant waveform controls; it does not drive hardware.
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
|
||||
|
||||
|
||||
# wifi-densepose-privshield — VEIL
|
||||
# wifi-densepose-privshield — WiFi Veil
|
||||
|
||||
**VEIL** (Verifiable Emission-shaping for Identity-Leakage prevention) is the
|
||||
compliant-waveform **countermeasure** counterpart to
|
||||
**WiFi Veil** (codename **VEIL** — Verifiable Emission-shaping for
|
||||
Identity-Leakage prevention) is the compliant-waveform **countermeasure**
|
||||
counterpart to
|
||||
[BFLD](../wifi-densepose-bfld) (ADR-118/121). BFLD *detects* when beamforming
|
||||
feedback becomes identifying; VEIL *acts* — it shapes a node's own outgoing
|
||||
feedback becomes identifying; WiFi Veil *acts* — it shapes a node's own outgoing
|
||||
beamforming feedback so that an unauthorized passive sniffer cannot
|
||||
re-identify people or infer activity, while a legitimate receiver (which shares
|
||||
the per-session key) sees an essentially unchanged link.
|
||||
@@ -33,7 +34,7 @@ and the 2025 sensing standard (802.11bf) added the capability but **no privacy
|
||||
protection**. Because the attacker only listens, you get no indication it is
|
||||
happening.
|
||||
|
||||
**The defense — scramble the fingerprint, keep the link.** VEIL adds a secret,
|
||||
**The defense — scramble the fingerprint, keep the link.** WiFi Veil adds a secret,
|
||||
**per-session "twist"** to your own outgoing feedback, built from the same
|
||||
rotation math (Givens rotations) the report already uses:
|
||||
|
||||
@@ -47,7 +48,7 @@ rotation math (Givens rotations) the report already uses:
|
||||
the signal's energy exactly (`energy in = energy out`), so it is **compliant,
|
||||
never jamming.** It never floods the air or blocks anyone else.
|
||||
|
||||
**What it does *not* do (kept honest).** VEIL defends against a *third-party
|
||||
**What it does *not* do (kept honest).** WiFi Veil defends against a *third-party
|
||||
sniffer*, not the access point you are connected to (that party holds the key —
|
||||
protecting against a malicious AP is BFLD's detection job). It targets identity
|
||||
re-identification; coarse motion obfuscation is future work. And every figure in
|
||||
@@ -63,7 +64,7 @@ captured hardware log.
|
||||
|
||||
Identity leaks through the **fine** cross-subcarrier phase structure of a
|
||||
compressed beamforming report; data throughput rides the **dominant** beam
|
||||
direction. These live in (mostly) separable subspaces. VEIL composes extra
|
||||
direction. These live in (mostly) separable subspaces. WiFi Veil composes extra
|
||||
**keyed Givens rotations** — the exact primitive the report is already built
|
||||
from — over the *fine* subspace only:
|
||||
|
||||
@@ -90,7 +91,7 @@ unconstrained model optimum is 3-bit, matching the DySPAN-2026 finding.
|
||||
|
||||
## Threat model & scope (stated plainly)
|
||||
|
||||
VEIL defends against a **third-party passive sniffer** capturing plaintext
|
||||
WiFi Veil defends against a **third-party passive sniffer** capturing plaintext
|
||||
beamforming feedback. It does **not** hide identity from the AP a node is
|
||||
associated with (that party holds the key by construction) — that is BFLD's
|
||||
detection/policy problem, not this shield's. It is **compliant by
|
||||
@@ -123,7 +124,7 @@ cargo run -p wifi-densepose-privshield --bin veil -- doctor # self-check, exit
|
||||
|
||||
```text
|
||||
┌──────────────────────────────────────────────────────────
|
||||
│ VEIL · wifi-sensing privacy shield ● PROTECTED
|
||||
│ WiFi Veil · wifi-sensing privacy shield ● PROTECTED
|
||||
│
|
||||
│ re-ID off 100.0% re-ID on 4.7% (chance 6.25%)
|
||||
│ throughput 97.6% emission 1.000× · not jamming
|
||||
@@ -140,7 +141,7 @@ In the TUI, type commands to steer the shield live: `on`/`off`, `passes <n>`,
|
||||
`preset scif|board|ward|hotel`, `optimize`, `proof`, `quit`. All readouts are
|
||||
**SYNTHETIC / L0**.
|
||||
|
||||
A self-contained graphical **VEIL Console** web dashboard mirrors this same
|
||||
A self-contained graphical **WiFi Veil Console** web dashboard mirrors this same
|
||||
instrument — it ships in [`ui/veil-console.html`](ui/veil-console.html) (open it
|
||||
in any browser; no build, no network). `veil` is the terminal-native version.
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
<title>VEIL Console — WiFi-Sensing Privacy Shield</title>
|
||||
<title>WiFi Veil Console — WiFi-Sensing Privacy Shield</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
|
||||
<style>
|
||||
/* ---- Theme tokens: light is the bare :root; dark redefined twice ---- */
|
||||
@@ -358,7 +358,7 @@
|
||||
<svg viewBox="0 0 24 24" fill="none" stroke="var(--accent-2)" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3l7 3v5c0 4.4-3 7.6-7 9-4-1.4-7-4.6-7-9V6l7-3z"/><path d="M8.5 12.2l2.2 2.2 4.8-4.8"/></svg>
|
||||
</span>
|
||||
<span class="brand-txt">
|
||||
<b>VEIL Console</b>
|
||||
<b>WiFi Veil Console</b>
|
||||
<span>WiFi-sensing shield</span>
|
||||
</span>
|
||||
</div>
|
||||
@@ -419,7 +419,7 @@
|
||||
<div class="how-step how-shield">
|
||||
<span class="ic"><svg viewBox="0 0 24 24" fill="none" stroke="var(--accent-2)" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3l7 3v5c0 4.4-3 7.6-7 9-4-1.4-7-4.6-7-9V6l7-3z"/><path d="M8.5 12.2l2.2 2.2 4.8-4.8"/></svg></span>
|
||||
<span class="eyebrow">The shield</span>
|
||||
<p>VEIL <b>scrambles that fingerprint</b> on every report with a secret twist only your own router can undo. An outside listener sees a <b>different scramble each time</b> and can't tie it to a person — their guess of "who's here" drops to <b>pure chance</b>.</p>
|
||||
<p>WiFi Veil <b>scrambles that fingerprint</b> on every report with a secret twist only your own router can undo. An outside listener sees a <b>different scramble each time</b> and can't tie it to a person — their guess of "who's here" drops to <b>pure chance</b>.</p>
|
||||
</div>
|
||||
<div class="how-step how-honest">
|
||||
<span class="ic"><svg viewBox="0 0 24 24" fill="none" stroke="var(--good)" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M9 12l2 2 4-4"/><path d="M12 3l7 3v5c0 4.4-3 7.6-7 9-4-1.4-7-4.6-7-9V6l7-3z"/></svg></span>
|
||||
@@ -524,7 +524,7 @@
|
||||
identity while the associated receiver, holding the key, decodes normally. All figures are
|
||||
<b>SYNTHETIC / evidence-level L0</b> from the reference model — not measured on hardware.
|
||||
<div class="foot-links">
|
||||
<a href="#" onclick="return false">ADR-288 · VEIL</a>
|
||||
<a href="#" onclick="return false">ADR-288 · WiFi Veil</a>
|
||||
<a href="#" onclick="return false">ADR-289 · harness</a>
|
||||
<a href="#" onclick="return false">docs/research/privacy-shield</a>
|
||||
</div>
|
||||
@@ -559,7 +559,7 @@
|
||||
const clamp = (v,a,b) => Math.max(a, Math.min(b, v));
|
||||
const css = (n) => getComputedStyle(document.documentElement).getPropertyValue(n).trim();
|
||||
|
||||
/* ---------- VEIL model (mirrors the crate) ---------- */
|
||||
/* ---------- WiFi Veil model (mirrors the crate) ---------- */
|
||||
// re-ID collapse vs mixing passes: piecewise-linear over the crate's measured
|
||||
// N=16 shield-on points (optimize.rs). Collapse is ~N-independent (finding),
|
||||
// so other N just shift by the chance-floor difference (1/N − 1/16).
|
||||
@@ -876,7 +876,7 @@
|
||||
return '<div class="modal-h"><span class="mglyph">'+SHIELD+'</span>'
|
||||
+'<div><div class="eyebrow">Welcome</div><h3>Your Wi-Fi privacy shield</h3></div>'
|
||||
+'<button class="m-close" data-act="close" aria-label="Close">×</button></div>'
|
||||
+'<p>Ordinary Wi-Fi can quietly <b>recognise who is in a room</b> — no camera, no app, nothing you carry. VEIL scrambles that leak while your Wi-Fi keeps working normally. This console lets you <b>see it, tune it, and prove it</b>.</p>'
|
||||
+'<p>Ordinary Wi-Fi can quietly <b>recognise who is in a room</b> — no camera, no app, nothing you carry. WiFi Veil scrambles that leak while your Wi-Fi keeps working normally. This console lets you <b>see it, tune it, and prove it</b>.</p>'
|
||||
+'<ul class="points">'
|
||||
+'<li><span class="pi">'+SHIELD+'</span><div><b>Watch it work</b><small>The panel up top shows people as dots. Shield on → they blur together and can\'t be told apart.</small></div></li>'
|
||||
+'<li><span class="pi">%</span><div><b>Read the scorecard</b><small>Live numbers for how well you\'re hidden and how much Wi-Fi speed you keep.</small></div></li>'
|
||||
@@ -888,12 +888,12 @@
|
||||
function openWelcome(){ openModal(welcomeHTML()); markSeen(); }
|
||||
|
||||
const EXPLAIN={
|
||||
protect:{t:"How this protects you",p:"Unauthorized Wi-Fi surveillance, and what VEIL does about it — in plain terms.",pts:[
|
||||
protect:{t:"How this protects you",p:"Unauthorized Wi-Fi surveillance, and what WiFi Veil does about it — in plain terms.",pts:[
|
||||
["What can spy on you","Since Wi-Fi 5, your device tells the router how to aim its signal by sending back “beamforming feedback” — sent unencrypted. Anyone in range can capture it passively and, from the tiny stable details, tell people apart (published work re-identifies individuals, detects occupancy through walls, even reads activity)."],
|
||||
["Why you can't tell","There's no light, no app, no device on you, and the snoop only listens — so this happens silently. The Wi-Fi standard (802.11bf, 2025) added the sensing feature but no privacy protection."],
|
||||
["What VEIL changes","Your router already reshapes its signal legitimately. VEIL adds a secret, per-session “twist” to that feedback (built from the same math the report already uses). Your own router shares the key and undoes it instantly; an outside listener sees a fresh random twist every session and can't average it into a stable fingerprint."],
|
||||
["What WiFi Veil changes","Your router already reshapes its signal legitimately. WiFi Veil adds a secret, per-session “twist” to that feedback (built from the same math the report already uses). Your own router shares the key and undoes it instantly; an outside listener sees a fresh random twist every session and can't average it into a stable fingerprint."],
|
||||
["The result","Across sessions the snoop's identity guess collapses to chance (~1-in-N, no better than guessing), while your link keeps ~98% of its speed — because the twist preserves the signal's energy and the data beam is untouched."],
|
||||
["Not jamming","VEIL only shapes your own, standards-legal transmissions. It never floods the air or blocks anyone (that would be illegal jamming). The energy in = energy out meter proves it."],
|
||||
["Not jamming","WiFi Veil only shapes your own, standards-legal transmissions. It never floods the air or blocks anyone (that would be illegal jamming). The energy in = energy out meter proves it."],
|
||||
["Honest limits","It defends against outside snoops — not the router you're connected to (that party holds the key). It doesn't yet hide coarse motion, and every number here is simulated (evidence level L0) until validated on real hardware."]]},
|
||||
kpis:{t:"Your live scorecard",p:"Four numbers that update the moment you change a setting.",pts:[
|
||||
["Re-ID · off","How often an eavesdropper picks the right person with no shield. 100% = they always win."],
|
||||
|
||||
Reference in New Issue
Block a user