Post by @nullagent@partyon.xyz

2025-08-20 01:19 UTC

By January of this year I had run out of personal interest and free resources to devote to the project of meshtastic given the lack of security focus I'd seen in the prior six 6 months. I wrote a final writeup on my meshtastic experiences and wrote a complete listing of the security issues I and others had already informed meshtastic of at that time. My last post on the topic fully outlined the PKI poisoning we demo'd a DEFCon's CTF back in January of 2025. https://partyon.xyz/@nullagent/113862707600980520

Replies (2)

@nullagent@partyon.xyz 2025-08-20 01:33

So I'm not sure how to say it in a more concise way but YES meshtastic direct messages are at risk of MITM (man-in-the-middle) if your public key can be replaced by an attacker who spoofs the PKI. Due to the way DMs and adverts work I believe this risk likely exists for any device on meshtastic regardless of whether they are on public channels or not. #privacy #cybersecurity #meshtastic

Open ##3059396
@Willow@blahaj.zone 2025-08-20 01:47

@nullagent@partyon.xyz so, a lot of your thread talked about MeshCore. Are you still happy about it? I was starting to build up some infrastructure with it Meshtastic, but I got similar techbro spidey-sense tingles you did, so I'm reticent about it. It sounds like MeshCore is better in that respect. I do have an openmodem, so I'm curious about reticulum, too. Basically, my biggest concern is that of network effects and trying to be efficient in that respect without wasting my time and resources on shitty solutions.

Open ##3059423