Abstract
Theseus Navigator is a desktop web browser in which a site's name is a record on the Bitcoin Cash blockchain, not an entry in a registrar's database. The browser resolves those names itself, from several independent sources at once, and fetches the content from decentralized storage or from any server the owner points at. No registrar can seize a name, no resolver sits between the user and the ledger, and the browser ships its privacy protections on by default: request blocking, consent-banner handling, DNS over HTTPS, Global Privacy Control, anti-fingerprinting and a bundled Tor route.
-This paper describes the name system Theseus reads (the Bitcoin Cash Name Registry), how the browser turns a name into content without trusting any single party, how content and DNS-style records are published and verified, the protections and the wallet built into the browser, the extension model, and the companion tools that bring the same names to every other browser and to Android. It closes with the security model as it stands in version 0.3.59, released on 2026-09-28, and with the open questions.
+This paper describes the name system Theseus reads (the Bitcoin Cash Name Registry), how the browser turns a name into content without trusting any single party, how content and DNS-style records are published and verified, the protections and the wallet built into the browser, the extension model, and the companion tools that bring the same names to every other browser and to Android. It closes with the security model as it stands at the time of writing, and with the open questions.
Theseus is built by Silent Mode on Electron, currently for Windows, and is free software distributed with published checksums from two mirrors, one on ordinary DNS and one served over the name system itself.
The problem
A web address is only as free as the weakest party between the user and the page, and today that chain has four parties in it who can each break the link without the owner's consent.
@@ -132,14 +132,14 @@Every source writes the same index, so the browser never depends on one of them; the name's own record then decides where the bytes come from.
Four sources feed the index. They start in a fixed order at launch and none of them is trusted alone.
-- Bundled snapshot. Every build ships a snapshot of the registry's beacon history (44 names and 73 beacon transactions in 0.3.59). The browser prefers a newer snapshot it has saved itself under the profile. Either way the snapshot is a floor: the index is marked stale the moment it loads, so the live sources overwrite it.
- Delta poll. Every 30 seconds the browser opens an Electrum connection, asks for the beacon's transaction history, fetches only the transactions it has not seen, and rebuilds the index. The result is written back as the profile's snapshot, so the next launch starts where this one ended.
- Full walk. On a first launch with no snapshot at all, the browser walks the beacon's entire history before answering.
- Sia snapshot. A published name list is fetched from decentralized storage and saved for the next boot, so a long-offline install catches up in one request.
- Bundled snapshot. Every build ships a snapshot of the registry's beacon history. The browser prefers a newer snapshot it has saved itself under the profile. Either way the snapshot is a floor: the index is marked stale the moment it loads, so the live sources overwrite it.
- Delta poll. Every 30 seconds the browser opens an Electrum connection, asks for the beacon's transaction history, fetches only the transactions it has not seen, and rebuilds the index. The result is written back as the profile's snapshot, so the next launch starts where this one ended.
- Full walk. On a first launch with no snapshot at all, the browser walks the beacon's entire history before answering.
- Sia snapshot. A published name list is fetched from decentralized storage and saved for the next boot, so a long-offline install catches up in one request.
The Electrum servers come from a seed list compiled into the resolver and from the chain itself: the electrum.bch name carries an el record listing servers, refreshed at most every 30 minutes. The browser connects by hostname first and, if that fails, by the server's pinned IP with the hostname as the TLS name, which defeats DNS interference against the resolver's own transport. With Tor on, these connections go through the SOCKS proxy.
Reducing history to an index is deterministic and identical on every client: the first valid registration of a name wins, and an update is honoured only when the transaction carries a proof output of the name's own certificate category, that is, only when the current holder signed it. A client that reaches the same history therefore computes the same index as every other client, with no resolver in between.
Serving the name. Once a host has an entry, the browser loads it through its own bns:// scheme and chooses the source in this order:
- A subdomain rule set by the owner (block or redirect), fetched from the gateway for hosts served directly.
- A subdomain with an
iprecord is served from that IP. - Inline HTML stored on the chain (
h), for the root path only. - A Sia site (
s3), fetched through the public gateway's/bns/mount, which holds the storage keys so the browser never does. - A server address (
ip), fetched directly. If the name also carries atlsrecord, the connection is pinned: the server certificate's SHA-256 fingerprint must equal the record or the socket is dropped, with no fallback to plain HTTP. - A proxied upstream (
p), reverse-proxied by the browser with any path prefix kept. - A redirect (
u). - Failing all of those, the first IPv4 address from the owner's signed DNS records, with the same TLS pin applied.
On-chain records are authoritative. Signed DNS records extend them and never override them. Records for a name are fetched only after the name is known to be registered, so ordinary DNS hosts the user visits are never sent to the gateway.
Collisions. A name that exists both on the chain and in ICANN's root is a collision. The default policy is chain first; the user can choose ICANN first, or ask each time, in which case an in-tab page offers both and can remember the choice per name or per top-level domain. Names under the registry's native top-level domains, listed on the chain by the tlds.bch name, are never treated as collisions.
Limits as of 0.3.59. A lookup miss on an index older than eight seconds waits for one poll before answering, so an unknown host can pause a navigation by the length of one Electrum round trip. History is taken from one server at a time; the resolver library can union several servers but the browser does not yet use that path. The profile snapshot is validated by shape only, not by signature.
+Limits at the time of writing. A lookup miss on an index older than eight seconds waits for one poll before answering, so an unknown host can pause a navigation by the length of one Electrum round trip. History is taken from one server at a time; the resolver library can union several servers but the browser does not yet use that path. The profile snapshot is validated by shape only, not by signature.
Content and records
A name points at content in one of five ways, and the two that matter most, a site on Sia and a pinned server, need no host that can be switched off and no certificate authority that can be fooled.
Sites on Sia. The owner uploads a folder to the Sia network through an S3-compatible endpoint and puts its path in the name's s3 record. The public gateway serves it at navigate.st/bns/<name>/, with the usual conveniences of a static host: index.html for folders, /about for about.html, and a single-page fallback to the root. Theseus reads the same mount through its bns:// scheme, so the storage keys live on the gateway and never in the browser. Sirius Studio and Sirius Press publish straight into that folder through a gateway API where every upload is signed over the name, the path, the file's hash and a timestamp, and the signature must recover to the current holder of the certificate. Nothing else can write there.
Inline, proxied and redirected. A page small enough to fit the payload can live on the chain itself (h), served at the root path only. A p record makes the gateway or the browser reverse-proxy an upstream URL, keeping the path. A u record redirects. On the apex the order is inline, then Sia, then IP, then proxy, then redirect; for a subdomain an ip record wins first and a proxy is not inherited.
Signed records without a transaction. Everything a DNS zone would carry lives in a file the owner signs and stores beside the site: _records.json. It carries a sequence number, a timestamp and A, AAAA, MX, TXT, CNAME, NS, CAA and SRV records, canonicalised with sorted keys and signed with the same key that holds the name. The gateway verifies the signature against the current certificate holder on every read, rejects a sequence number that goes backwards, and answers GET /api/dns/<name> with the verified records and a 30-second cache. Publishing an update is a signed POST, no chain transaction and no fee. Version 2 adds a hosts map: each subdomain can have its own folder in the bucket, a redirect, a block, or its own record set, with a wildcard entry and a depth of up to eight labels. A block beats a redirect beats a folder, and an exact entry beats the wildcard.
On-chain records are authoritative and signed records extend them. A signed A record is used only when the name carries no content record at all, and the on-chain tls pin still applies to it. Theseus fetches these records only for names it already knows are registered, so ordinary hosts the user visits are never revealed to the gateway, and it never waits for the fetch before loading a page.
Subdomain rules apply everywhere. Since 0.3.59 the browser asks the gateway for a host's verified rule before serving a subdomain from an IP or from inline HTML, the two paths it serves without the gateway. A subdomain the owner has blocked or redirected therefore behaves the same whether the name is served from Sia, from the owner's server or through a proxy, and an ordinary subdomain navigation gains no round trip.
+Subdomain rules apply everywhere. The browser asks the gateway for a host's verified rule before serving a subdomain from an IP or from inline HTML, the two paths it serves without the gateway. A subdomain the owner has blocked or redirected therefore behaves the same whether the name is served from Sia, from the owner's server or through a proxy, and an ordinary subdomain navigation gains no round trip.
Certificates for other browsers. Theseus needs no certificate authority because it checks the pin itself. Other browsers do, which is what the system-wide resolver described later provides: a local root constrained to the registry's top-level domains that mints a leaf per name on the user's own machine.
Privacy and protections
Every protection below is on from the first launch. The table gives the mechanism and the default; the paragraphs after it give the detail that matters for a threat model.
@@ -157,7 +157,7 @@DNS over HTTPS has three modes. Automatic uses the encrypted resolver and falls back to the system resolver when it is unreachable. Increased protection never falls back, so a network that blocks the resolver blocks browsing rather than downgrading it. Off uses the system resolver. Providers are Quad9, Cloudflare, Mullvad, AdGuard, or any HTTPS resolver URL. This covers ordinary DNS hosts; chain names never touch DNS at all. With Tor on, hostnames resolve at the exit, not locally.
Identity. Theseus does not announce itself. The user agent drops the Electron and application tokens, the client-hint brands and their order are computed the way Chromium computes them, and both the JavaScript surface and the request headers agree. This is what keeps commercial bot filters from rejecting the browser. A window.chrome shim fills the properties sites test for.
Tor is bundled, not downloaded. One click starts the bundled binary with its own data directory and geoip files and points the session's proxy at it; the Electrum connections, Sia fetches and pinned IP fetches follow the same proxy, and WebRTC is restricted to proxied paths so no UDP leaves directly. Tor state is not remembered across launches. The browser is explicit that this buys IP privacy, not anonymity: it does not change the fingerprinting surface the way Tor Browser does.
-VPN is an add-on rather than a core feature. It runs a pinned build of sing-box speaking VLESS over REALITY with a Chrome TLS fingerprint, verifies the binary's hash before every start, and can use Silent Mode exits, a pasted vless:// URL or a subscription URL. Exits with keys are not yet issued as of this version.
VPN is an add-on rather than a core feature. It runs a pinned build of sing-box speaking VLESS over REALITY with a Chrome TLS fingerprint, verifies the binary's hash before every start, and can use Silent Mode exits, a pasted vless:// URL or a subscription URL. Exits with keys are not yet issued at the time of writing.
What is not done. There is no referrer-policy override, no Do Not Track header, and no third-party cookie blocking beyond what clearing on quit achieves. Four main-process fetches, the gateway record lookups, the Sia snapshot pull, the proxied p upstream and the update check, use the process's plain HTTP client and do not follow the Tor proxy. Fingerprinting defences are opt-in emulation rather than a uniform fingerprint.
Wallet and dapps
Aegis is the wallet built into Theseus as a plug-in. It holds keys for seven chains from one recovery phrase, keeps every secret in memory only, and lets pages transact through injected providers that can do nothing without an approval drawn by the browser itself.
@@ -167,7 +167,7 @@The page bridge. On chain-name sites Aegis injects window.bitcoincash with three calls: get an address, sign and send, sign a message. On every HTTPS page it injects an EIP-1193 window.ethereum provider (announced through EIP-6963 as st.silentmode.aegis), a window.solana provider, and the Tron provider surface, all speaking to the isolated world over tagged messages. Nothing injected can sign, read a balance or read an address on its own.
Approval. Every request from a page lands in an approval sheet the browser draws in its own view, never in the page: it names the plug-in and the requesting origin, one request at a time per origin, with focus on Cancel so Enter never approves a spend by accident. Permissions are remembered per origin: address access can be granted once, and a Bitcoin Cash spending allowance of 0.001, 0.01 or 0.1 BCH lets small payments through without a prompt until it is used up.
Pairing. For wallet-to-app sessions Aegis speaks WizardConnect, the LGPL protocol used by Bitcoin Cash applications, with an explicit pairing approval and no reading of the page to find a session URI. Price lookups are off until the user turns them on, so a fresh install contacts no oracle.
-Limits as of 0.9.0. Siacoin needs a walletd endpoint the user provides, with a public explorer as read-only fallback. WalletConnect is not implemented. The wallet is ordinary JavaScript running with the browser's privileges, which is the trust model of every plug-in and is discussed under Security model.
+Limits at the time of writing. Siacoin needs a walletd endpoint the user provides, with a public explorer as read-only fallback. WalletConnect is not implemented. The wallet is ordinary JavaScript running with the browser's privileges, which is the trust model of every plug-in and is discussed under Security model.
Extensions and plug-ins
Theseus has its own add-on model rather than Chrome's, and it publishes community extensions the same way it publishes sites: signed by a name's owner and stored on Sia, with the browser checking the signature against its own copy of the registry.
The host. An add-on is a folder with a manifest and a main script. The manifest declares an identifier, a version, a category (extension by default, or plug-in for wallets and other trusted components), and the capabilities it needs. Eleven capabilities exist, each unlocking one API:
@@ -180,8 +180,8 @@Plug-ins are the category for components that hold keys or route traffic: Aegis is one, and the system-wide resolver is managed from the same place. They are listed apart from extensions in Settings, their updates wait for a restart, and the toolbar chip that announces a ready update stays silent for them.
Beyond the browser
Theseus needs nothing installed on the machine to resolve names, but everything else on the machine does. Three companions extend the same registry to other browsers, to Android, and to the people who register and publish names. All of them share the resolver code with Theseus, so a name resolves the same everywhere.
-Ariadne's Thread is a Windows service that makes the registry visible to every application. Its installer, version 0.1.9 as of this writing, adds one Name Resolution Policy Table rule per routable top-level domain, so only those names are sent to a local daemon and everything else keeps the system's own DNS; a full mode that repoints the adapters exists but is not the default. The daemon answers DNS on the loopback address, serves HTTP and HTTPS for names, and keeps its own index of the chain by the same Electrum walk the browser uses, refreshed every 30 seconds. For HTTPS it holds a root certificate generated on the machine itself with a critical name-constraints extension limiting it to the registry's top-level domains and excluding every IP range, and it mints a two-year leaf per name on first request; the installer refuses to trust any root without those constraints, and the private key never leaves the machine. Names with an ip and tls record are reverse-proxied through the same fingerprint check Theseus applies. The list of top-level domains is synchronised every six hours from the registry's routable list minus every TLD delegated by IANA, so .com and its kind stay with ordinary DNS; when the list changes, the rules are adjusted and the root is rotated. A collision policy file is re-read every five seconds, so the browser's setting and the system's can agree. Theseus offers install, update, on and off from its Settings and checks the installer's hash before it runs.
Ariadne for Android, version 0.21, is a tabbed browser for phones with the same resolution stack: a bundled index, a snapshot the gateway refreshes every ten minutes, an on-device Electrum walk with a 60-second cache, and a gateway fast path that races the trustless path. It claims the registry's routable top-level domains at start and refreshes them from the gateway. An optional system-wide mode runs a DNS-only VPN service on the device so other apps resolve names too; it tunnels nothing else. The package is signed with Silent Mode's own key, its certificate hash is published in the release manifest, and it is distributed from the download host rather than a store.
+Ariadne's Thread is a Windows service that makes the registry visible to every application. Its installer adds one Name Resolution Policy Table rule per routable top-level domain, so only those names are sent to a local daemon and everything else keeps the system's own DNS; a full mode that repoints the adapters exists but is not the default. The daemon answers DNS on the loopback address, serves HTTP and HTTPS for names, and keeps its own index of the chain by the same Electrum walk the browser uses, refreshed every 30 seconds. For HTTPS it holds a root certificate generated on the machine itself with a critical name-constraints extension limiting it to the registry's top-level domains and excluding every IP range, and it mints a two-year leaf per name on first request; the installer refuses to trust any root without those constraints, and the private key never leaves the machine. Names with an ip and tls record are reverse-proxied through the same fingerprint check Theseus applies. The list of top-level domains is synchronised every six hours from the registry's routable list minus every TLD delegated by IANA, so .com and its kind stay with ordinary DNS; when the list changes, the rules are adjusted and the root is rotated. A collision policy file is re-read every five seconds, so the browser's setting and the system's can agree. Theseus offers install, update, on and off from its Settings and checks the installer's hash before it runs.
Ariadne for Android is a tabbed browser for phones with the same resolution stack: a bundled index, a snapshot the gateway refreshes every ten minutes, an on-device Electrum walk with a 60-second cache, and a gateway fast path that races the trustless path. It claims the registry's routable top-level domains at start and refreshes them from the gateway. An optional system-wide mode runs a DNS-only VPN service on the device so other apps resolve names too; it tunnels nothing else. The package is signed with Silent Mode's own key, its certificate hash is published in the release manifest, and it is distributed from the download host rather than a store.
Sirius is the registrar and the publishing desk, reachable at sirius.x and mirrored on the ICANN site. Registration runs entirely in the page: a built-in wallet unlocked, created or imported there, or a WizardConnect pairing with a mobile wallet, builds the one transaction that mints the certificate and pays the fees. The dashboard manages every name and TLD the wallet holds: DNS records and subdomain rules through the signed manifest at no cost, content and hosting, redirects, transfers, marketplace listings in BCH or USD, TLD policy and pricing with 90% of each sale to the owner, and the co-sign queue for gated TLDs. Sirius Studio is a page builder on GrapesJS that publishes straight to the name's Sia folder through signed uploads and sets the s3 record with one transaction when needed; its optional assistant runs a small language model in the tab over WebGPU or against a local endpoint, and never executes model output. Sirius Press is a WordPress fork whose only change to core is 75 lines: accounts are Bitcoin Cash addresses, sign-in is a signed challenge, and every page is mirrored as static HTML to the name. The registrar speaks seven languages.
Hephaestus hosts the source. It is a Forgejo instance where the account is a Bitcoin Cash address and sign-in is a signed message through an OpenID Connect proxy, with repositories on the server and large files, attachments and packages on Sia. It answers on the ICANN name with a public certificate and on hephaestus.x with the project's own root.
The three resolvers and the registrar all read the chain directly; the gateway is where bytes come from and where signed uploads land, and it reads the same chain to know who may write.
Security model
-The design goal is that no single party between the user and a page can change what the page is. The table says who is trusted for what in 0.3.59; the paragraphs after it say what an attacker in each position can and cannot do.
+The design goal is that no single party between the user and a page can change what the page is. The table says who is trusted for what today; the paragraphs after it say what an attacker in each position can and cannot do.
| Question | Who decides | What Theseus checks |
|---|---|---|
| Who owns a name | The Bitcoin Cash chain | Beacon history from Electrum, reduced locally by fixed rules |
| What a name's records say | The owner, by an on-chain update | Same reduction; an update must carry the name's certificate |
| What a name's DNS records say | The owner, by a signed file | Signature recovered to the current certificate holder, by the gateway |
| Whether a pinned server is genuine | The owner's tls record | Certificate fingerprint compared in the browser, no chain of trust |
| What a Sia site contains | Whoever holds the name's signing key | Gateway checks the upload signature; the browser trusts the gateway for bytes |
| Which extension is genuine | The publisher's name, or the operator key | Publisher signature checked against the browser's own registry index |
| Which browser update is genuine | The ICANN mirror over TLS | SHA-256 from the manifest, no publisher signature yet |
A hostile network can block or delay but not redirect. It sees encrypted DNS to a chosen resolver, TLS to Electrum servers reached by pinned IP if hostnames fail, and, with Tor on, only Tor. It cannot forge a name: the index is computed from chain history, and a fake history would need a valid transaction spending the beacon's coins. It cannot forge a pinned site: the fingerprint is on the chain. It can still see which Electrum servers and which gateway the browser talks to when Tor is off.
A hostile Electrum server can lie by omission, returning a truncated history, which would make a recently registered name resolve as absent and fall through to ordinary DNS. It cannot invent a registration, because every entry is a real transaction the client parses itself. The defence today is the pool with several independent operators and pinned addresses; a union across servers exists in the resolver library and is not yet used by the browser.
@@ -223,8 +223,8 @@Public surfaces
- Theseus: theseus.x through the gateway, silentmode.st/theseus on ICANN DNS
- Downloads and release manifest: dl.silentmode.st, mirrored at silentmode.bch
- Registrar: sirius.x
- Source: code.silentmode.st/silentmode/theseus
- Gateway API root: navigate.st/api/tlds,
/api/registry,/api/dns/<name>,/api/records/<name>,/api/market,/api/cosign,/api/site,/api/ext
Design documents in the repository (paths under the Silent Mode monorepo): Decentralized.DNS/PROTOCOL.md, Decentralized.DNS/DESIGN-tld-registry.md, Decentralized.DNS/DESIGN-signed-records-manifest.md, Decentralized.DNS/INTEGRATION-signed-records-clients.md, Argus/DESIGN-collision-modes.md, TheseusNavigator/docs/ADDON-UPDATES.md, Argus/src/lib/resolver-web.js (the network table and reduction rules), Argus/src/lib/manifest.js (manifest validity), Argus/src/lib/register-tx.js (transaction shapes).
Licensing. Theseus Navigator, Ariadne's Thread and Ariadne for Android are published under the Mozilla Public License 2.0, the file-level copyleft Firefox and Brave use: changes to the project's own files stay open, and anything may be built on the browser. The resolver, gateway and protocol libraries are under the Apache License 2.0, so that other implementations of the registry can reuse them freely; the protocol documents and this paper are under Creative Commons Attribution 4.0. Sirius Press is GPL-2.0-or-later, as WordPress requires. Each build ships a third-party notices file: Chromium via Electron, Tor, DuckDuckGo autoconsent and the Ghostery adblocker (MPL-2.0), EasyList and EasyPrivacy, pdf.js, pdf-lib, mammoth, WizardConnect (LGPL-3.0), and the sing-box binary the VPN add-on fetches (GPL-3.0), whose complete source is published beside the binary. The project's names and marks are reserved and not covered by any of these licenses, so a fork must ship under its own name.
-All facts in this paper were read from the source tree and the live surfaces on 2026-09-28 and describe Theseus Navigator 0.3.59, Ariadne's Thread 0.1.9 and Ariadne for Android 0.21.
+Licensing. Theseus Navigator, Ariadne's Thread and Ariadne for Android are published under the Mozilla Public License 2.0, the file-level copyleft Firefox and Brave use: changes to the project's own files stay open, and anything may be built on the browser. The resolver, gateway and protocol libraries are under the Apache License 2.0, so that other implementations of the registry can reuse them freely; the protocol documents and this paper are under Creative Commons Attribution 4.0. Sirius Press is GPL-2.0-or-later, as WordPress requires. Each build ships a third-party notices file: Chromium via Electron, Tor, DuckDuckGo autoconsent and the Ghostery adblocker (MPL-2.0), EasyList and EasyPrivacy, pdf.js, pdf-lib, mammoth, WizardConnect (LGPL-3.0), and the sing-box binary the VPN add-on fetches (GPL-3.0), whose complete source is published beside the binary. The project's names and marks are reserved and not covered by any of these licenses, so a fork must ship under its own name. The brand kits published at theseus.x/brand and sirius.x/brand carry the same note: their files may be used to refer to the projects, for example on a page that integrates with them, never as another product's mark.
All facts in this paper were read from the source tree and the live surfaces on 2026-09-28. The software moves faster than a paper; the repository and the release notes are the record of what has changed since.