4 ms·

Web site says: > does not reveal any identifying information about Alice or Bob In my opinion this is not really true, any radio transmitter can be triangulat

by ale42 2y ago

Web site says: > does not reveal any identifying information about Alice or Bob In my opinion this is not really true, any radio transmitter can be triangulated (see also https://en.wikipedia.org/wiki/Direction_finding https://en.wikipedia.org/wiki/Direction_finding), and once the position is known, the identity of the user can possibly be inferred. Of course the transmitter can be concealed, or operated from a remote location, but this might cancel the benefits of using no infrastructure.

Bluestein 2y ago
I think you are entirely correct in that assessment, that the physical layer is vulnerable ... A different question - one I am curious about - is what can be known: Just the fact that A and B are running a transmiter -or- their identities ...
- mfro 2y ago
  Not an expert by any means but there are a few factors: 1) the data sent between two nodes should be encrypted. As stated by reticulum and nomad devs, the software is in beta so privacy-violating bugs are possible, but theoretically the messages and identities can't be read by an outside agent. 2) the 33cm band[1] is not, from my brief research and basic knowledge of amateur radio, in wide use outside of hobbyists. It may be that in some places you would be the only person within a large radius actually using the band, meaning your signals stand out quite a bit to an astute observer. They would be able to triangulate the location of the transmitters with some work, but again, theoretically they could not read the communications. So there are several opsec concerns for someone who doesn't want to draw attention to themselves. [1]: https://en.wikipedia.org/wiki/33-centimeter_band https://en.wikipedia.org/wiki/33-centimeter_band
jonhohle 2y ago
Is there enough data in the mesh to conceal where a message is coming from? If only Alice and Bob have devices, that may be true, but if the messages are low bandwidth enough to be hidden in amongst the rest of the mesh communication nodes could be found but it wouldn’t necessarily identify where the message originated or was received.
commandlinefan 2y ago
The only way any communications medium will ever become truly uncensorable will be when it becomes ubiquitous. If everybody were using this approach, it wouldn't matter who could triangulate who, because you could never pinpoint exactly who you triangulated. I don't have much hope that we'll ever get to that point, though - lots of uncensorable (with enough adoption) approaches have been proposed like Freenet, I2P, and Tor, but the pushback on adoption has always been: "wait, this is actually uncensorable. I'm not going to support that."
- Bluestein 2y ago
  Am afraid you are correct, but we might (might?) see pockets of adoption in jurisdictions under information duress like Venezuela, etc.-
- generalizations 2y ago
  If monitoring devices were also ubiquitous, then the system would still be vulnerable to timing attacks.
  - extraduder_ire 2y ago
    I think LoRA in particular is TDMA, but I believe a CDMA radio system is much less vulnerable to timing based attacks, since multiple users can broadcast at once.
jszymborski 2y ago
This is not my area of expertise, but I feel like a really nice property of the LoRA mesh is that they are low-power and come in a small form factor. I feel like it can be kinda hard to enforce a crack down on a mesh like this when people can stick a small solar panel and throw a gajillion of them atop buildings or on/under apt'mt balconies w/o even the building owners necessarily knowing they are there.
- Bluestein 2y ago
  > w/o even the building owners necessarily knowing they are there. The "plausible deniability" aspect you rightly posit is very interesting, and a feature indeed.-
denysvitali 2y ago
But if it's a mesh, how do you know whether the transmitter generated the message or it is just relying it? Edit: assuming you don't have only two transceivers
- ale42 2y ago
  > But if it's a mesh, how do you know whether the transmitter generated the message or it is just relying it? I didn't check the protocol in detail so I don't know for sure, but I assume it's possibly impossible to know if you observe a single message. But if relayed messages are retransmitted immediately you can probably figure it out if there's not too much traffic.

by ale42 2y ago

Bluestein 2y ago

I think you are entirely correct in that assessment, that the physical layer is vulnerable ... A different question - one I am curious about - is what can be known: Just the fact that A and B are running a transmiter -or- their identities ...

mfro 2y ago
Not an expert by any means but there are a few factors: 1) the data sent between two nodes should be encrypted. As stated by reticulum and nomad devs, the software is in beta so privacy-violating bugs are possible, but theoretically the messages and identities can't be read by an outside agent. 2) the 33cm band[1] is not, from my brief research and basic knowledge of amateur radio, in wide use outside of hobbyists. It may be that in some places you would be the only person within a large radius actually using the band, meaning your signals stand out quite a bit to an astute observer. They would be able to triangulate the location of the transmitters with some work, but again, theoretically they could not read the communications. So there are several opsec concerns for someone who doesn't want to draw attention to themselves. [1]: https://en.wikipedia.org/wiki/33-centimeter_band https://en.wikipedia.org/wiki/33-centimeter_band

jonhohle 2y ago

Is there enough data in the mesh to conceal where a message is coming from? If only Alice and Bob have devices, that may be true, but if the messages are low bandwidth enough to be hidden in amongst the rest of the mesh communication nodes could be found but it wouldn’t necessarily identify where the message originated or was received.

commandlinefan 2y ago

The only way any communications medium will ever become truly uncensorable will be when it becomes ubiquitous. If everybody were using this approach, it wouldn't matter who could triangulate who, because you could never pinpoint exactly who you triangulated. I don't have much hope that we'll ever get to that point, though - lots of uncensorable (with enough adoption) approaches have been proposed like Freenet, I2P, and Tor, but the pushback on adoption has always been: "wait, this is actually uncensorable. I'm not going to support that."

Bluestein 2y ago
Am afraid you are correct, but we might (might?) see pockets of adoption in jurisdictions under information duress like Venezuela, etc.-
generalizations 2y ago
If monitoring devices were also ubiquitous, then the system would still be vulnerable to timing attacks.
- extraduder_ire 2y ago
  I think LoRA in particular is TDMA, but I believe a CDMA radio system is much less vulnerable to timing based attacks, since multiple users can broadcast at once.

jszymborski 2y ago

This is not my area of expertise, but I feel like a really nice property of the LoRA mesh is that they are low-power and come in a small form factor. I feel like it can be kinda hard to enforce a crack down on a mesh like this when people can stick a small solar panel and throw a gajillion of them atop buildings or on/under apt'mt balconies w/o even the building owners necessarily knowing they are there.

Bluestein 2y ago
> w/o even the building owners necessarily knowing they are there. The "plausible deniability" aspect you rightly posit is very interesting, and a feature indeed.-

denysvitali 2y ago

But if it's a mesh, how do you know whether the transmitter generated the message or it is just relying it? Edit: assuming you don't have only two transceivers

ale42 2y ago
> But if it's a mesh, how do you know whether the transmitter generated the message or it is just relying it? I didn't check the protocol in detail so I don't know for sure, but I assume it's possibly impossible to know if you observe a single message. But if relayed messages are retransmitted immediately you can probably figure it out if there's not too much traffic.