cuck.stream

                                                                                   
                        ░░░                 ░░░                                    
                        ▒▒▒                 ▒▒▒                                    
                        ▓▓▓                 ▓▓▓▄▄                                  
▄██▀██▄ ███ ███ ▄██▀██▄ ███ ███     ▄██▀██▄ ███     ▄██▀██▄ ▄██▀██▄ ▄██▀██▄ ▄█▄ ▄█▄
███ ███ ███ ███ ███ ███ ███ ███     ███ ███ ███     ███ ███ ███ ███ ███ ███ ███▀███
███ ▀▀▀ ███ ███ ███ ▀▀▀ ███▀██▄     ▀██▄▄▄  ███     ███     ███▀▀▀▀  ▄▄▄███ ███ ███
███ ███ ███ ███ ███ ███ ███ ███     ▄▄▄ ███ ███ ▄▄▄ ███     ███ ███ ███ ███ ███ ███
███ ███ ███ ███ ███ ███ ███ ███     ███ ███ ███ ███ ███     ███ ███ ███ ███ ███ ███
▀██▄██▀ ▀██▄███ ▀██▄██▀ ███ ███ ███ ▀██▄██▀ ▀██▄██▀ ███     ▀██▄██▀ ▀██▄███ ███ ███
  █▀         ▀█   █▀        █▀        █▀      ▀█     ▀█       █▀         ▀█     █▀ 
  ▄           ▄   ▄         ▄         ▄        ▄      ▄       ▄           ▄     ▄

Paranoid? We don't even trust ourselves.

By cucks, for cucks. a tiny, invite-only mail hideout for friends & family

cuck.stream · development build · localhost-only listeners · ciphertext mailbox storage · no host system changes. Bring your own paranoia, your own authenticator app, and your own encrypted identity backup.

what is cuck.stream

cuck.stream is a small, invite-only webmail project built around a simple idea: the server should be useful, but it shouldn’t be the one holding all the secrets. It’s meant for a trusted circle — friends, family, and people who’d rather have a private little mail nook than a big shiny platform. The vibe is minimal and honest: encrypted mailbox objects at rest, client-controlled mailbox keys, strong sign-in, and no pretending the internet is magically safe.

how it works

1. invitation	...........................	an admin creates a single-use invite. no public signups, no randoms, no mystery meat accounts.
2. registration	...........................	you pick a strong password/passphrase (16+ chars) and enroll TOTP in your authenticator app.
3. identity	...........................	your browser generates keys: an ML-DSA-87 auth key for login signatures and an ML-KEM-1024 + X448 mailbox key for encrypted messages. private keys stay with you; the server stores public keys.
4. activation	...........................	verify TOTP, get recovery codes, and store your local private keys safely on your device(s). Private keys stay in your browser (encrypted in IndexedDB) and are never uploaded; the server stores public keys only. Lose your keys and encrypted mail cannot be decrypted — that’s the deal.
5. login	...........................	three checks: password (Argon2id), signed challenge (ML-DSA-87), then TOTP/recovery. no password-only vibes.
6. mailbox	...........................	messages are stored as encrypted envelope objects. your unlocked identity decrypts in the browser; the mailbox UI renders plaintext/HTML safely (sanitized, sandboxed).

project facts

auth stack

Argon2id password hashing, mandatory TOTP, ML-DSA-87 challenge-response signatures, CSRF checks, HttpOnly/SameSite sessions, rate limits, separate admin auth.

mailbox crypto

Per-message envelope encryption (CME1) with ML-KEM-1024 + X448 hybrid key agreement, HKDF-derived wrapping, AES-256-GCM content encryption, key IDs, ciphertext object storage.

storage model

Database holds metadata/indexes/refs. Ciphertext objects hold encrypted message payloads/summaries. Mailbox storage APIs are ciphertext-oriented. 256 MiB hard quota per account.

mail features

Folders, flags/read state, aliases, compose mock/local encrypted send, export, delete/trash, downloads/attachments handling, quota display, HTML/plain viewing.

transport/dev

Localhost SMTP ingestion abstraction and IMAP ciphertext gateway for development. Conventional IMAP/SMTP clients won’t transparently decrypt custom envelopes. External delivery is mocked in dev.

frontend

Plain HTML, CSS, and vanilla JS (OG.im-style static vibe), Go templates, Go/WASM crypto helper, system monospace font. No React circus.

honest limits

smtp ingestion	...........................	if normal unencrypted SMTP mail arrives and the server encrypts it, the ingestion path can see plaintext before storage. stored encrypted != magically invisible in transit.
custom crypto	...........................	the envelope/hybrid construction is project-specific and needs independent review. it’s built to be careful, not crowned by a wizard.
interop	...........................	custom ciphertext envelopes aren’t drop-in compatible with mainstream clients. for outside email, conventional providers and trust boundaries apply.
metadata	...........................	routing metadata, sizes, timestamps, access patterns, and operational traces can still leak information. encryption-at-rest is not a cloaking device.
clients/backups	...........................	a compromised browser/device, stolen identity backup, bad passphrase hygiene, or XSS/runtime compromise can ruin anyone’s day. protect the keys.
admin	...........................	admin can invite, suspend, delete, and inspect operational status/audit metadata — but has no supported mailbox decryption function.

for friends & family

This is a personal/trusted-circle project. Treat invites like house keys, use a password manager, keep your TOTP device safe, keep your local key passphrase/TOTP/device safe, export a sensitive local key backup only if you understand the risk, and don’t email your nuclear launch codes unless that’s a family tradition. By cucks, for cucks.

use invitation sign in status docs