Desktop Privacy Stack

HASENPFOTE

Your VPN hides your IP. Your ISP still sees every DNS query. Your tunnel gets flagged by deep packet inspection. And everything you encrypt today can be harvested now and cracked once quantum computers land. Hasenpfote closes those network gaps from a single system tray icon.

See the Three Modes → Architecture ↓
12
Rust Crates
3
Privacy Modes
61
Tasks Shipped
13
Days Built

? The Problem

  • > You run a VPN, a DNS app, a fingerprint blocker, and maybe a mixnet client. Four tools, four trust models, four points of failure — and none of them know the others exist
  • > Your VPN hides your IP, but websites still identify you. Canvas rendering, WebGL shaders, AudioContext, font enumeration, TLS ClientHello — your browser leaks a unique signature regardless
  • > Current defenses don't hold up. Randomization? Defeated by majority voting across sessions (WWW '25, "Breaking the Shield"). Uniformity? Breaks half the web. Neither approach scales
  • > Standard WireGuard is a neon sign for DPI. A 148-byte handshake init and four fixed packet type identifiers — censorship systems flag it in milliseconds
  • > Harvest now, decrypt later. State actors are recording encrypted traffic today, waiting for quantum computers to crack it — and most of that captured traffic carries no post-quantum protection at all

+ The Solution

  • > One privileged daemon orchestrates DNS, tunnel, fingerprint defense, and mixnet routing. Everything coordinates — firewall rules match the active tunnel, DNS resolves through the right path, fingerprints stay consistent per session
  • > Three modes mapped to real threat models — daily browsing, sensitive work, high-risk communication. You pick the situation, not the protocol
  • > Fingerprinting is the one gap hasenpfote doesn't solve itself — it points you to a hardened browser (Mullvad or Tor), where your fingerprint matches thousands of others. Faking values in-app was a dead end: lies are detectable and real GPU/font rendering can't be spoofed from JavaScript, so we don't pretend otherwise
  • > AmneziaWG 2.0 strips WireGuard's tell-tale signature — junk packets, randomized magic headers, no fixed handshake sizes. To signature-based DPI it's just generic UDP, not a classifiable tunnel. Measured on public WiFi: 120 packets to the relay, 0 with a WireGuard signature
  • > X-Wing hybrid KEM (X25519 + ML-KEM-768) on every tunnel. Pre-shared keys rotate every 90 seconds via the relay. If classical crypto breaks, the lattice layer holds. If the lattice breaks, X25519 holds
Pick Your Threat Model

Three modes. You choose the trade-off.

Basis

~5ms overhead — unnoticeable

For: everyday browsing, coffee shop WiFi, ad-tech tracking. No tunnel, no slowdown — your DNS stays private and tracker domains never resolve.

  • DNS-over-QUIC + DoH fallback (Quad9)
  • Tracker & malware DNS blocklist
  • IPv6 & WebRTC/STUN leak blocking
  • System DNS forced through local resolver

Stark

~50ms overhead — barely noticeable

For: banking, sensitive email, corporate networks, restrictive ISPs. Full encrypted tunnel — and to deep packet inspection it carries no WireGuard signature, just generic UDP.

  • Everything in Basis
  • AmneziaWG 2.0 obfuscated tunnel
  • X-Wing post-quantum key exchange
  • pf/nftables kill-switch (no leak on drop)

Maximum

~500–800ms overhead — noticeable

For: journalists, activists, whistleblowers, anyone whose traffic pattern is itself a risk. Sender anonymity through 5-hop mixnet routing. Your ISP can't see where you're going. The destination can't see where you came from.

  • Everything in Stark
  • Nym 5-hop mixnet routing
  • Continuous cover traffic (even when idle)
  • Mix-level sender anonymity
Under the Hood

Architecture

hasenpfote — system architecture 
  Tauri GUI (Svelte 5, 1.6KB bundle, user process)
       |
       | gRPC over Unix Domain Socket
       |
  hp-daemon (root, privileged orchestrator)
       |
  -----+------+--------+--------+-----------+
  |         |        |        |           |
hp-mixnet  hp-tunnel  hp-dns  hp-fingerprint  hp-pqc
(Nym 5-hop) (AWG 2.0)  (DoQ/DoH) (browser)      (X-Wing)
              |         |
         -----+---------+------
         |              |
    hp-routing     hp-firewall
    (TUN device)   (kill-switch)

Strict privilege separation. The Tauri GUI runs as a normal user — it never touches the network stack. All privileged operations (TUN device creation, firewall rules, DNS interception, route table changes) are isolated in the root daemon. The two communicate over gRPC through a Unix domain socket with peer-credential authentication. Why gRPC over D-Bus or REST? Typed contracts via protobuf, server-streaming for real-time status events, and forward-compatible versioning. If the daemon panics, a registered cleanup hook tears down firewall rules and restores system DNS before the process exits.

How Each Layer Works

Five problems. Five subsystems.

<>

Traffic Obfuscation

AmneziaWG 2.0 removes everything DPI keys on: the fixed 0x01–0x04 message types become randomized magic headers, the tell-tale 148/92/64-byte handshake sizes are padded away, and junk packets muddy the flow start. DPI that flags standard WireGuard in milliseconds sees only generic UDP. Confirmed with a packet capture on public WiFi — 120 packets to the relay, zero carrying a WireGuard signature. (Honest limit: this defeats signature-based DPI, not a determined statistical flow analysis — that's what Maximum mode is for.)

{Q}

Post-Quantum Key Exchange

Every tunnel uses X-Wing — a hybrid KEM that derives keys from both X25519 (classical, proven) and ML-KEM-768 (NIST-standardized, lattice-based). The derived secrets are combined via HKDF-SHA256. Pre-shared keys rotate every 90 seconds through the relay. If either algorithm is broken, the other still holds. This protects against harvest-now-decrypt-later attacks that are already happening.

@

Encrypted DNS

A local stub resolver binds to 127.0.0.1:53; system DNS is redirected via launchd/systemd so no query leaves the machine in cleartext. Upstream it uses DNS-over-QUIC to Quad9 with a DoH fallback — your ISP can't read what you resolve. (Oblivious DoH, which would also hide queries from the resolver itself, is on the roadmap, not shipped.)

||

Firewall Kill-Switch

When a tunnel is active, pf (macOS) or nftables (Linux) rules default-deny all outbound traffic except the tunnel interface and essential system services. If the tunnel drops, traffic stops — it doesn't fall back to cleartext. During mode transitions, rules are updated atomically before the new tunnel is established. On daemon crash, a panic hook removes rules and restores DNS.

***

Mixnet Anonymity

Maximum mode routes traffic through Nym's 5-hop mixnet via a local SOCKS5 proxy. Unlike a VPN, where the provider sees both sides, each mix node only knows its predecessor and successor. Continuous cover traffic defeats timing analysis even when the user is idle. Current integration is PoC-level (SOCKS5 to nym-socks5-client binary); production path is direct integration with nym-vpnd.

"Every privacy tool asks you to make a permanent choice: maximum protection with broken websites, or fast browsing with no protection. That's a false trade-off. A lawyer reviewing contracts and a journalist meeting a source have different threat models — but they shouldn't need different software."

— The design principle behind three modes

Honest Assessment

Ups & Downs

+ Engineering Wins

  • Clean privilege separation — the attack surface of the GUI is zero network operations. Root access is confined to the daemon behind authenticated UDS
  • 12-crate workspace with clear boundaries — hp-dns knows nothing about hp-tunnel. Each crate compiles and tests independently
  • One integrated daemon coordinates DNS, tunnel, PQC, kill-switch and mixnet — standalone tools can't keep firewall, routing and DNS consistent with each other the way this does
  • Claims are measured, not asserted — obfuscation verified by packet capture, IP-masking by an outbound check through the tunnel, DNS routing traced end-to-end
  • Panic-safe networking — registered cleanup hooks guarantee firewall and DNS restoration even on unrecoverable errors
  • 10 research documents back every architectural decision. Not opinions — cited papers, benchmarks, and adversarial analysis

! Honest Limitations

  • macOS-only in practice — Linux crate scaffolding exists but is untested. Windows support not started
  • Single-user exit = an anonymity set of one. Stark gives strong privacy from your ISP, but not anonymity — the exit IP is still linkable to one operator. Real anonymity needs a shared community relay or the mixnet
  • Fingerprint defense relies on pairing with a hardened browser (Mullvad/Tor). The old JS-injection approach was abandoned as structurally detectable
  • Post-quantum and obfuscation are table stakes now — Mullvad, Windscribe and others ship PQC too. The edge here is the integrated stack, not any single primitive
  • Not independently audited yet — vetted primitives, but a third-party security audit is still outstanding
  • Nym integration is PoC-level — a SOCKS5 sidecar binary, not the production nym-vpnd daemon. No installer or account system: a working proof of concept, not a shipped product
Built With

Technology Stack

Rust Tauri 2.x Svelte 5 gRPC (tonic/prost) Protocol Buffers Tokio boringtun (Cloudflare) AmneziaWG 2.0 Nym SDK X-Wing (X25519 + ML-KEM-768) DoQ / DoH (Quad9) wreq (BoringSSL) pf / nftables tun-rs Mullvad / Tor Browser Self-hosted relay

Privacy that adapts
to the situation.

12 Rust crates. Privilege-separated daemon. Post-quantum by default. Open source, self-hostable, research-backed — don't trust it, verify it.

Let's Talk →