Is this an acceptable All-or-Nothing Transform?
Have I missed something? is this really an AONT?


An iterated hash doesn't make a secure stream cipher. If the attacker can guess $m_i$, they can calculate $w_i \oplus m_i = H^i(m_0)$, then decrypt the rest of the message by taking hashes of that value.

An option would be to use the hash function like a block cipher in counter mode $w_i = H(m_0||i)$. That should be secure.


  I'm sure there are faster / better approaches to AONTs, but is this terribly bad? is it any better than others in any respect?


If will likely be significantly slower than just using AES or a stream cipher for the encryption and a hash to make the key depend on the rest. Hash functions don't always produce a lot of output fast.

The advantage is that you only depend on one primitive. If you wanted that, you could use a hash function with a stream cipher mode, like Keccak (which SHA-3 is based on). That should be faster.


  What should be asked of the hash function H? collision resistance? pre-image resistance?


The hash function should be (first) preimage resistant and a PRF. Collision resistance doesn't matter unless the attacker can control or at least predict the random $m_0$.


  Is it having a (pseudo-)random source a bad thing? would it be any better if the construction above were to replace m0 (randomly generated) by H(m)? would it be any worse? (at the very least, it would make the wrappings of two identical messages the same).


No, it's a good thing. A deterministic $m_0 = H(m)$ would, for example, let an attacker verify any guess of the message $m$ with high likelihood from just a single $w_i$. Just transform the guess message and see if any block matches.