OBSIDIAN

A free, open source Android system for Google Pixel phones, stripped back to what private communication actually needs and nothing else. There are three apps on it: a chat app, Tor Browser and a camera, plus a Monero wallet you can use or ignore.

Obsidian Chat works over Tor, so messages do not touch the normal internet on their way out. They are end to end encrypted, and new ones arrive sealed until you tap them open. You pick a username, not a phone number, and there is nothing to recover if you lose it, because nothing about you is kept to recover. The app has its own PIN on top of the screen lock, and an emergency wipe that returns the phone to factory settings in three seconds.

What is not there matters as much: no dialler, no text messages, no app store and no side loading. Location is switched off and the switch is taken away, and a screen lock is required before the chat app will open at all.

This repository contains everything that makes the phone OBSIDIAN: the chat app, the changes applied to the operating system, and the module the chat server uses.

Get it

Test releases run on the Google Pixel 6, 7, 8, 9 and 10. The Pixel 8 is the one they are built and tested on; the rest are built and their install checked end to end, but nobody has run them on that hardware yet. Installing one erases the phone.

• Install from your browser, in Chrome, Edge or Brave on a computer. It finds the release for your phone, checks it and installs it.
• Downloads: every release with its size and SHA-256, for installing from a computer or keeping a copy.
• How to install, step by step, including how to go back to normal Android.

Releases are signed with test keys for now, so the bootloader stays unlocked and the phone shows a warning each time it starts. Do not lock the bootloader: a phone locked to an operating system it cannot verify refuses to start.

Screenshots

Three apps, nothing else	Create an account	New messages arrive sealed	Tap to open
OMEMO, over Tor	Security status	Verify in person	App PIN lock

_{Screenshots are from the emulator build.}

What's here

Folder	What it is
obsidian-chat/	Obsidian Chat, the messaging app (Kotlin, Jetpack Compose)
obsidian-os/	Scripts that turn an Android Open Source Project source tree into the OBSIDIAN image
obsidian-server/	The Prosody module the chat server uses to look up usernames
branding/	Boot screen artwork

The phone

• Three apps: Obsidian Chat, Tor Browser and the camera, plus Settings. Cake Wallet is there for Monero if you want it, and nothing else is.
• No calls or texts: the dialler and messaging apps are removed from the image.
• Location off, for good: Obsidian Chat is the phone's device owner and holds location switched off, with the switch taken away.
• A screen lock is required: the app will not open until the phone has a PIN.
• No side-loading: installing apps from unknown sources is disabled.
• Emergency wipe: hold the button on the chat screen for three seconds to erase the phone and return it to factory settings.
• Three-button navigation, so Back and Home are always visible.

Obsidian Chat

• Tor only. Every connection goes through Tor, including DNS, and the server is reachable only as an onion service. The app refuses to start if a network DNS resolver could leak a lookup.
• End-to-end encrypted. Messages use OMEMO, the Signal protocol. Each person's identity is a PGP key created on the phone and never leaves it. The OMEMO devices are bound to that key and can be compared in person.
• Add people by username. No phone numbers or email addresses.
• Sealed messages. Messages arrive closed and open only when tapped. The chat list shows how many are waiting.
• Photos without metadata. Photos are re-encoded to remove location, camera and other metadata before they are encrypted and sent. If that cannot be confirmed, the photo is not sent.
• Encrypted at rest. The database is SQLCipher, and its keys are sealed by the Android Keystore.
• App PIN. The app locks itself whenever you leave it.
• Delete for both sides. Deleting a message also retracts it on the other phone.

What the server can and cannot see

The server runs Prosody as a Tor onion service, with no message archive.

• It cannot read messages or photos. They are end-to-end encrypted before they leave the phone.
• It does know which usernames exist and who has added whom. It also holds each account's public keys, which is necessary for delivery.
• It does not know a phone's IP address, because every connection arrives over Tor.

Accounts cannot be recovered, by design

An account's keys and password exist only on its phone. If the phone is wiped, including by the emergency wipe, or lost, that account is gone for good. Register a new one.

Building

Obsidian Chat

You need JDK 21 and the Android SDK with the android-37.0 platform.

Point the app at your server in obsidian-chat/local.properties. This file is never committed, so no server address appears in the source:

obsidian.serverDomain=<your server's .onion address>
obsidian.serverSpkiSha256=<base64 SHA-256 of the server's TLS public key>

The key pin can be computed from the server's certificate:

openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform der \
  | openssl dgst -sha256 -binary | base64

Then run the tests and build:

cd obsidian-chat
./gradlew testDebugUnitTest assembleDebug

tools/emulator-test/ has scripts for trying two phones against each other on emulators.

The OS image

obsidian-os/scripts/obsidian-os-changes.sh applies the OBSIDIAN changes to a synced source tree. It works for the emulator, and for the Pixel 8 (shiba) after that device's vendor files have been generated. The header of the script describes each step and why it is done the way it is. Building a phone image needs a Linux machine with a lot of disk space (plan for 300 GB or more), and takes many hours.

Test builds are signed with test keys, which means the phone's bootloader stays unlocked. They are for development only. Release builds must be signed with keys that are generated and kept offline.

Server

Install Prosody, publish it as a Tor onion service, and load mod_obsidian_lookup from obsidian-server/prosody/. Leave out message archive (MAM) and offline storage modules.

Status

Early development. The chat app and the OS changes have been tested end to end on emulators, and the first Pixel 8 build is under way.

License

GPL-3.0. Obsidian Chat uses the Signal protocol library through smack-omemo-signal, which is licensed under GPLv3, so the app is GPLv3 as well. Third-party components keep their own licenses.