DEV Community

Cover image for Z-TEXT Ran Its Own Threat Model. Here's What It Found.
ztext_zksnarks
ztext_zksnarks

Posted on Originally published at z-text.org

Z-TEXT Ran Its Own Threat Model. Here's What It Found.

Most messengers tell you they're secure. Few show their work.

Z-TEXT ran Microsoft's STRIDE threat model against its own architecture — the same framework security teams use internally, not a marketing checklist. Six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.

Every answer got published. Including the one honest weak spot: a bypassed license costs Z-TEXT revenue, not user privacy.

A few highlights:

Spoofing — No phone number, no email. There's no identity to spoof in the first place, because none exists.

Tampering — Messages are shielded zk-SNARKs transactions on the BitcoinZ blockchain. Once confirmed, altering one means rewriting cryptographic math thousands of nodes already agreed on.

Denial of Service — The default messaging server isn't even Z-TEXT's own — it's community-run infrastructure (lightd.btcz.rocks), plus a self-hosted option and a Tor onion service. Nothing centralized to seize or pressure.

Elevation of Privilege — License enforcement is entirely client-side. A determined reverse engineer could unlock premium features on their own device. They can't unlock more privacy — message security was never behind that gate.

This follows the same pattern as Z-TEXT's public bug bounty and its LINDDUN privacy audit: publish the real answer, gaps included, before anyone has to ask.

Full breakdown: https://z-text.org/stride-threat-model-z-text-honest-results/

Top comments (1)

Collapse
 
ztext_zksnarks profile image
ztext_zksnarks •