Building a secure OS: the hard list — what I found and what I'm fixing in IONA OS

Short summary

The developer of IONA OS, a sovereign Rust-based operating system, publicly discloses a hard list of security vulnerabilities found in their own code. Issues include plaintext disk writes, recoverable deleted files, a fake XOR-based keystore masquerading as AES/ChaCha encryption, a non-functional onion routing circuit, and missing duress/hidden volume features. Each issue is paired with a concrete remediation plan.

• •IONAFS writes plaintext to disk despite having an encryption engine available; fix in progress
• •Keystore uses trivial XOR instead of real encryption; being replaced with ChaCha20-Poly1305
• •Onion routing circuit is fake with hardcoded IPs and no key exchange; either implementing real circuits or removing the feature

Generated with AI, which can make mistakes.