Threat model
Know exactly what you are trusting.
Ombra hides your IP address from what you run, and your disk from whoever holds it. If a protection is not listed here, Ombra does not provide it.
The trust boundary
Everything inside the desktop is untrusted. The Mac is the trusted base.
Trusted: your Mac
Apple Silicon, macOS, VMware Fusion, the Ombra build
Untrusted
Desktop VM
Apps, files, websites, anything that talks to the network
- one NIC · 10.55.10.100
- LUKS2 disk · encrypted swap
No other route out. Ever.
Ours
Gateway VM
Fail-closed firewall
- Tor only, per uid
- DNS through Tor
If Tor stops, the desktop has no network at all.
Tor network
→ Internet
What an app in the desktop can try
- ✕
App to Internet directly
Blocked. No route exists
- ✕
App to Your local network
Blocked. One NIC, whose only peer is the gateway
- ✕
App to Anything over IPv6
Blocked. Off at every layer
- ✓
App to Gateway, then Tor
The only way out
Who Ombra defends against
Your ISP or network operator
Sees and records all traffic leaving the Mac
Sees Tor connections to guard relays, not your destinations
Sites and services you visit
See the IP address a connection comes from
They see a Tor exit, never your address
A compromised app in the desktop
Full control of the desktop userland
Nowhere to leak to: the only route is the gateway, which forwards only into Tor
A thief with your Mac or disk
Reads the disk while the VMs are off
LUKS2 with argon2id and encrypted swap; the host holds only ciphertext
Who it does not
These are real limits. Ombra does not pretend otherwise.
A compromised macOS host
Logs keystrokes, reads guest RAM, changes VM settings
The Mac is the trusted base. Use dedicated hardware against this adversary
A global passive adversary
Watches Tor entry and exit and correlates traffic
Tor's limit, not Ombra's. Ombra adds no defense beyond Tor
Targeted physical attackers
Evil-maid attacks, implants, coercion
Out of scope; no host secure-boot story
What Ombra itself sends
Status LED
Asks check.torproject.org through Tor whether traffic exits via Tor
About every 30 seconds while logged in
Clock sync
Reads HTTPS Date headers of three sites through Tor; steps the clock only when two of three agree
Every 30 minutes
- No telemetry and no update checks
- Response bodies are dropped
- No exit IP is ever shown or logged
Risks we accept
First-use window
Until first boot completes, the disk opens with the public build passphrase. First use replaces the volume key.
Fresh guards per amnesic boot
Amnesic gateway mode trades Tor's persistent guards for a stateless gateway. Persistent mode keeps them.
Shared private link
Any other VM on Fusion's private network can reach both machines at layer 2.
Seizure while running
Keys live in RAM while unlocked. At-rest protection applies only when the VMs are off.
Recognizable probes
The fixed probe cadence can mark traffic as Ombra-like to a site operator. It does not reveal your IP.
No audit yet
Ombra has not been independently audited.