Post by @nullagent@partyon.xyz

2025-08-20 01:33 UTC

So I'm not sure how to say it in a more concise way but YES meshtastic direct messages are at risk of MITM (man-in-the-middle) if your public key can be replaced by an attacker who spoofs the PKI. Due to the way DMs and adverts work I believe this risk likely exists for any device on meshtastic regardless of whether they are on public channels or not. #privacy #cybersecurity #meshtastic

Replies (2)

@nullagent@partyon.xyz 2025-08-20 01:37

This segment of meshtastic's DEFCON post are sadly not correct. I can't tell you why how exactly the firmware and phone app work but I can tell you that if you are near someone PKI spoofing it absolutely does replace the users private key on BOTH the app and the firmware. The only pub keys that are pinned are your favorites list. It doesn't matter what -type- of AES is used after the public key is replaced you're already MITMd. https://meshtastic.org/blog/that-one-time-at-defcon #privacy #cybersecurity #meshtastic

Open ##3059397
@alex02@cyberplace.social 2025-08-20 01:36

@nullagent@partyon.xyz so, you could in theory sniff for pki or how would it work exactly? is there a poc that exists and is there a way to mitigate it via something like wrapping communications in some sort of encrypted tunnel like tls?

Open ##3059406