morpheus/docs/threat-model-and-workarounds.md

Morpheus — Threat Model & Workarounds

Legal Posture

Morpheus is a compliant, principled operation:

• We register where required and operate within applicable law
• We respond to lawful data requests with data we actually have
• We use NIP-44 end-to-end encryption for DMs — meaning DM content is not data we have in readable form
• We will never add backdoors, key escrow, or weaken encryption under any circumstances
• We are transparent: if asked for data we cannot provide, we explain why

This is the Apple/WhatsApp model applied to social networking: cooperate fully, but the architecture makes certain requests technically impossible.

---

The Core Distinction: Private ≠ Anonymous

Morpheus is private, not anonymous.

	Anonymous	Private (Morpheus)
Identity	Hidden, disposable	Real, persistent, reputation-bearing
Public content	Untraceable to author	Author known — that's the point
DMs	Nobody can read them	Nobody can read them (NIP-44)
Metadata	Hidden (Tor-level)	Available to relay operators
Legal posture	Evades identification	Compliant; encryption protects content
Vibe	Dark web, paranoia	Normal social life with real protection

Morpheus position: "Everyone knows your name. Nobody reads your messages."

NIP-44 encrypts the content of direct messages. Metadata (who talked to whom, when) is visible to relay operators. This is an honest and defensible position: we protect the conversation, not the fact that it happened.

---

Problem 1: Target Audience vs. Value Proposition Mismatch

Problem: Teens don't buy "privacy." They buy speed, aesthetics, and social status.

Workarounds:

1. Lead with product, not protocol. Marketing never mentions Nostr, relays, or encryption upfront. It says: "the fastest social app" or "group chats that actually work."

2. Privacy as texture, not feature. Instead of a "privacy settings" page, privacy manifests as:

   • A subtle lock icon on DMs (always there, never toggleable — it just works)
   • "Messages are encrypted" shown once during onboarding, then never again
   • No "last seen" or "read receipts" by default (privacy = social comfort for teens)

3. Speed IS the feature. Teens compare apps by how fast they feel. Invest disproportionately in perceived performance: optimistic UI, instant message sending, preloaded feeds, aggressive caching.

4. Social proof matters more than features. Get 5 popular creators on the platform before public launch. Teens follow people, not protocols.

---

Problem 2: Nostr Technical Limitations

Problem: Nostr lacks native support for features teens expect.

2a. Group Chats

Current state: NIP-29 (relay-based groups) is basic. No rich features.

Workaround:

• Build on NIP-29 for public groups (relay-moderated, discoverable)
• For private groups: use NIP-44 encryption with a shared group key, rotated when members change
• Implement group features at the client level: replies, reactions, pins, mentions, threads
• This is custom work but gives competitive advantage — "best group chats on Nostr"

2b. Media Hosting

Current state: Nostr events are text. Media requires external hosting.

Workaround:

• Run managed Blossom (BLOb Simple Storage) servers for media uploads
• NIP-96 file storage as standard — users upload via the app, served via CDN
• Aggressive client-side compression (WebP/AVIF for images, H.265 for video)
• Progressive loading: thumbnail → medium → full resolution
• Storage quota tied to account tier (free = reasonable, Pro = generous)
• Content-addressed storage (deduplication by hash) saves costs

2c. Search & Discovery

Current state: No global search. Relay search is relay-specific.

Workaround:

• Client-side full-text index of followed users' content (SQLite/Realm on device)
• "Explore" powered by curated relay aggregation — Morpheus runs an indexing relay
• Trending topics computed from public event volume across Morpheus community relays
• Hashtag-based discovery (NIP-12 generic tag queries)
• "People you might know" based on social graph overlap (computed client-side, not server-side)
• Human-curated featured accounts and communities (editorial, not algorithmic)

2d. Key Management / Identity Recovery

Current state: Lose your nsec = lose everything. Unacceptable for teens.

Workaround:

• Social key recovery (primary): Shamir's Secret Sharing — split the recovery key among N trusted contacts, require K of N to reconstruct. "Choose 5 friends. Any 3 can help you recover your account."
• Encrypted cloud backup (optional): Encrypt nsec with a user-chosen passphrase, store encrypted blob in iCloud/Google Drive. User controls the encryption key.
• Device-bound keys: Store nsec in device Secure Enclave / Android Keystore. Biometric unlock. Key never leaves the device in plaintext.
• NIP-46 (Nostr Connect): Remote signer pattern — the key lives in a signer app, Morpheus never touches it directly. Advanced users can use this.
• Progressive disclosure: New users get device-bound key + cloud backup prompt. Power users can export nsec and manage it themselves.

2e. Stories / Ephemeral Content

Current state: No native Nostr primitive for disappearing content.

Workaround:

• Use NIP-40 (expiration timestamp) on events — relays delete after TTL
• Client enforces expiration display-side (even if a rogue relay keeps the event)
• Stories rendered as a carousel of kind:20 (short text notes) or kind:1063 (file metadata) events with 24h expiration
• Not truly "disappearing" in the Signal sense — but matches Instagram/Telegram stories UX

---

Problem 3: Government Blocking

Problem: Roskomnadzor can block relay domains and IPs.

Context: Morpheus operates compliantly, but blocking may happen regardless (as it did with Telegram in 2018-2020). The goal is not to evade law enforcement — it's to ensure service availability for users.

Workarounds:

Layer 1: Standard resilience

• WebSocket over TLS (wss://) looks like normal HTTPS traffic to DPI
• Run relays behind Cloudflare or similar CDN — blocking the CDN blocks millions of sites
• Multiple relay domains in different TLDs — redundancy, not evasion
• App automatically falls back to working relays if some are unreachable

Layer 2: Distribution resilience

• Android: available via Google Play, RuStore, direct APK download, F-Droid
• iOS: App Store, PWA as fallback if removed from store
• Web app always available as baseline
• APK/PWA links shared via existing channels (Telegram bots, QR codes)

Layer 3: Proactive engagement

• Engage with regulators proactively — explain what data we have and provide it
• Demonstrate compliance willingness to reduce motivation for blocking
• Maintain dialogue — blocking is often a negotiation, not a binary

Note: If Morpheus is blocked despite compliance, the Nostr protocol ensures users can access their data through any other Nostr client. Their social graph and messages are not locked in our infrastructure. This is the ultimate resilience.

---

Problem 4: Legal Compliance (Yarovaya Law / SORM)

Problem: Russian law requires storing and providing access to user communications.

Approach: Cooperate fully, explain architecture honestly.

1. Register as required. Operate a legal entity (jurisdiction TBD based on legal advice). Register as an information distribution organizer if required.

2. Store what we can store. Public posts, metadata, connection logs — these exist on our relays and we can provide them.

3. Explain what we cannot store. DM content is encrypted client-side with NIP-44. We never hold decryption keys. This is not evasion — it is the documented, auditable architecture. We cannot provide what we do not have.

4. Open source supports our claims. Any technical audit of the codebase will confirm that the server never has access to plaintext DMs. This is verifiable, not just claimed.

5. Legal precedent. WhatsApp, Signal, and iMessage operate E2E encryption in many jurisdictions. The legal landscape for E2E encryption is complex but there is significant precedent.

6. No user registration data collection beyond what's needed. If registration requires phone/email for legal compliance, we collect it. But we don't collect more than required.

The key principle: We never refuse to cooperate. We explain the technical reality. What is encrypted is encrypted — not because we choose not to decrypt it, but because we cannot.

---

Problem 5: Monetization Without Ads

Problem: No ads, ever. Need alternative revenue.

Approach: See monetization.md. Summary:

• Morpheus Pro subscription (premium features, customization, higher limits)
• Sticker/theme marketplace (creator economy with commission)
• Creator tools (paid analytics, subscriber-only content)
• Business profiles (flat monthly fee, organic reach only)
• Managed relay hosting (infrastructure-as-a-service for communities)

All revenue streams are opt-in and require no user profiling.

---

Problem 6: Content Moderation

Problem: Teens on the platform require responsible content moderation without undermining privacy.

Approach:

1. Public content is moderatable. Public posts are... public. We can and will moderate public content on relays we operate. Standard community guidelines apply. This does not conflict with privacy — public speech has never been "private."

2. Encrypted DMs are not moderatable by us — and that's okay. Just like the postal service doesn't read your letters. Client-side safety features (block, report, mute) give users control.

3. Layered moderation for public content:

   • Relay-level: Morpheus-operated relays enforce published community guidelines (no CSAM, no doxxing, no harassment). Content that violates guidelines is removed from our relays.
   • Community-level: Group moderators manage their own spaces. NIP-56 reporting flows to moderators.
   • Client-level: Spam filters, content warnings, mute/block tools.

4. CSAM compliance: Hash-matching (PhotoDNA or equivalent) on media uploaded to Morpheus-operated media servers. This is a non-negotiable legal and ethical obligation. Happens server-side on the media CDN before content is distributed.

5. Transparency reports. Publish quarterly: how many moderation actions, how many legal requests, what data was provided. Build trust through accountability.

---

Problem 7: Cold Start / Network Effects

Problem: A social network with no users is useless.

Workarounds:

1. Launch as a messenger first, social network second. Group chats don't need network effects — they need 5-10 friends. "Move your friend group to Morpheus" is a tractable pitch.

2. Telegram bridge. Bot that cross-posts between Telegram groups and Morpheus groups. Reduces switching cost. Users can migrate gradually.

3. Target specific communities, not "everyone":

   • University student groups
   • Gaming communities
   • Music/art scenes
   • Tech-savvy early adopters

4. Creator partnerships. Get popular Russian content creators to use Morpheus. Their audiences follow.

5. "Import your group" feature. Create a Morpheus group from an existing Telegram/VK group, auto-invite members. Minimize friction.

6. Referral mechanics. "Invite 3 friends → unlock exclusive sticker pack." Simple, proven, no ads needed.

7. Ship a killer feature that doesn't exist elsewhere:

   • Voice messages with automatic transcription (huge in Russian-speaking communities)
   • Built-in meme editor
   • Anonymous Q&A on profiles (like ASKfm — fun and viral)
   • Superior sticker creation tools