C2 Forum — Architecture and Trust Boundaries
Summary
A dated description of the C2 Forum trust boundaries, cryptographic choices and anti-automation design.
Document record
- Author
- Eduardo Camarillo [Noir0x63]
- Published
- Version
- v1.0
- Language
- English
Architecture in scope
The reviewed design used browser-generated NIST P-256 signing keys, a web application, server-side authorization logic and an anti-automation challenge during registration. Private keys were stored through WebCrypto and IndexedDB in the client environment.
Trust boundaries
Non-extractable WebCrypto keys limit direct raw-key export through the API, but they do not prevent an active script running in the same origin from requesting cryptographic operations. Content injection, dependency integrity and recovery flows therefore remain part of the key-security boundary.
Server-side code still determines account state, authorization and message acceptance. Client signatures provide evidence tied to a client key; they do not make the server or client environment inherently trustworthy.
Anti-automation mechanism
The SVG challenge attempted to increase the cost of automated registration through randomized geometry and a honeypot field. Later assessments showed why this control should be treated as rate-limiting friction rather than a durable identity or Sybil-resistance mechanism.
Status
This page describes the repository and deployment state reviewed in June 2026. It does not assert that a public deployment or repository remains available today.