Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Stock network panel: enterprise PEAP profile without CA validation allows rogue-AP credential capture
Reported by WokoFlipper · filed Oct 1, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Problem
Stock omarchy.network panel creates enterprise Wi-Fi profiles (PEAP/MSCHAPv2) without a CA certificate, system CA validation, or an authentication-server name constraint (default/hypr Model enterpriseConnectScript: nmcli connection add ... 802-1x.eap peap 802-1x.phase2-auth mschapv2 with no ca-cert).
A rogue access point using the same SSID can impersonate the authentication server and capture the user's MSCHAPv2 challenge-response (offline-crackable). NetworkManager documents this exact exposure for unset CA blobs.
Found via
Marketplace security review of a fork submission (wifi-dns #9486, reviewer HANCORE-linux). The fork has removed EAP support entirely; filing here because every fork and stock itself carry it.
Suggestion
Either constrain the profile (require CA cert + auth-server match before connecting, refusing otherwise) or gate enterprise connect behind an explicit warning. Happy to test a fix against a live WPA-EAP network if hepful.
View raw text
## Problem Stock `omarchy.network` panel creates enterprise Wi-Fi profiles (PEAP/MSCHAPv2) without a CA certificate, system CA validation, or an authentication-server name constraint (`default/hypr` Model `enterpriseConnectScript`: `nmcli connection add ... 802-1x.eap peap 802-1x.phase2-auth mschapv2` with no `ca-cert`). A rogue access point using the same SSID can impersonate the authentication server and capture the user's MSCHAPv2 challenge-response (offline-crackable). NetworkManager documents this exact exposure for unset CA blobs. ## Found via Marketplace security review of a fork submission (wifi-dns #9486, reviewer HANCORE-linux). The fork has removed EAP support entirely; filing here because every fork and stock itself carry it. ## Suggestion Either constrain the profile (require CA cert + auth-server match before connecting, refusing otherwise) or gate enterprise connect behind an explicit warning. Happy to test a fix against a live WPA-EAP network if hepful.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 20:22 UTC