Private, Secure and Uncensorable Messaging over a LoRa Mesh (2022) | Hacker News Reader

Private, Secure and Uncensorable Messaging over a LoRa Mesh (2022)

unsigned.io

99 pointsBluestein42 comments

Any significant differences from Meshtastic other than a console PC app?

There is a similar thread up here on HN: https://news.ycombinator.com/item?id=41253922

The author of this blog post is the developer of Reticulum, which is a complete network stack and full-fledged alternative to TCP/IP. (https://reticulum.network/). Reticulum is capable of operating over not just LoRa, but bluetooth low energy, standard WiFi, Packet Radio, and overlay networks like Tor and I2P.

Reticulum seems like a promising protocol but I doubt it can be used practically as a mesh over packet radio at low baud rates given its asymmetric encryption suite.

Constant key exchanges, message acknowledgements, and large payloads over standards like AX.25 or FT8 would quickly congest a given frequency using off-the-shelf analog equipment that requires audio mod/demod. But it would probably work fine for more traditional, client-server traffic or simplex traffic.

It seems much better suited to digital traffic in the 900mhz+ range a-la Meshtastic or Arednmesh.

In my opinion, all these types of projects (Meshtastic, etc) fail at their goal of working "completely offline" as I discovered when I brought a bunch of Meshtastic stuff with me on vacation to a place with very limited internet.

If I need to do a bunch of pip install instead of a zip file I can thumb drive around to anyone who needs it, it isn't really that useful.

Even the documentation is on a web site; I would have loved a PDF, or at least a single file HTML, so I could at least learn about how to use the system while being offline. Sure, you can download it all yourself, but that requires you to know what you'll need beforehand.

In short, we need a "click here before going offline" button.

If the internet is still working, you probably would just use it for your messaging instead.

It looks like the RNode firmware does exactly what you're looking for with its "RNode Bootstrap Console": https://unsigned.io/rnode_bootstrap_console/

Documentation is surprisingly hard to find, but from blog posts on the site it looks like if you press the reset button twice within one second, an RNode will turn into a WiFi access point and host this website. From there, you can download everything you need to create and use another RNode (including Reticulum, Nomad Network, and Sideband). I find this notion of RNodes being self-propagating really compelling!

You can `pip install` from the filesystem just as easily as you would over the internet, either from wheels or source folders. I'm sure if you wanted to you could write a quick script to download all of the packages and dependencies you need and then zip it all up for you.

I'm considering it. Of course, the whole argument could then be extended all the way to "does your computer have an OS installed?" and that can of worms is something I think most would agree is outside of the scope of the original project.

Bootstrapping can be tricky.

Yeah but given that the default is apparently not to do that... kind of shows that these things are just a fun theoretical exercise rather than a serious attempt to solve a problem that actually exists.

Web site says:

> does not reveal any identifying information about Alice or Bob

In my opinion this is not really true, any radio transmitter can be triangulated (see also https://en.wikipedia.org/wiki/Direction_finding), and once the position is known, the identity of the user can possibly be inferred. Of course the transmitter can be concealed, or operated from a remote location, but this might cancel the benefits of using no infrastructure.

The only way any communications medium will ever become truly uncensorable will be when it becomes ubiquitous. If everybody were using this approach, it wouldn't matter who could triangulate who, because you could never pinpoint exactly who you triangulated.

I don't have much hope that we'll ever get to that point, though - lots of uncensorable (with enough adoption) approaches have been proposed like Freenet, I2P, and Tor, but the pushback on adoption has always been: "wait, this is actually uncensorable. I'm not going to support that."

If monitoring devices were also ubiquitous, then the system would still be vulnerable to timing attacks.

I think LoRA in particular is TDMA, but I believe a CDMA radio system is much less vulnerable to timing based attacks, since multiple users can broadcast at once.

Am afraid you are correct, but we might (might?) see pockets of adoption in jurisdictions under information duress like Venezuela, etc.-

Is there enough data in the mesh to conceal where a message is coming from? If only Alice and Bob have devices, that may be true, but if the messages are low bandwidth enough to be hidden in amongst the rest of the mesh communication nodes could be found but it wouldn’t necessarily identify where the message originated or was received.

This is not my area of expertise, but I feel like a really nice property of the LoRA mesh is that they are low-power and come in a small form factor. I feel like it can be kinda hard to enforce a crack down on a mesh like this when people can stick a small solar panel and throw a gajillion of them atop buildings or on/under apt'mt balconies w/o even the building owners necessarily knowing they are there.

> w/o even the building owners necessarily knowing they are there.

The "plausible deniability" aspect you rightly posit is very interesting, and a feature indeed.-

But if it's a mesh, how do you know whether the transmitter generated the message or it is just relying it?

Edit: assuming you don't have only two transceivers

> But if it's a mesh, how do you know whether the transmitter generated the message or it is just relying it?

I didn't check the protocol in detail so I don't know for sure, but I assume it's possibly impossible to know if you observe a single message. But if relayed messages are retransmitted immediately you can probably figure it out if there's not too much traffic.

I think you are entirely correct in that assessment, that the physical layer is vulnerable ...

A different question - one I am curious about - is what can be known: Just the fact that A and B are running a transmiter -or- their identities ...

Not an expert by any means but there are a few factors:

1) the data sent between two nodes should be encrypted. As stated by reticulum and nomad devs, the software is in beta so privacy-violating bugs are possible, but theoretically the messages and identities can't be read by an outside agent.

2) the 33cm band[1] is not, from my brief research and basic knowledge of amateur radio, in wide use outside of hobbyists. It may be that in some places you would be the only person within a large radius actually using the band, meaning your signals stand out quite a bit to an astute observer. They would be able to triangulate the location of the transmitters with some work, but again, theoretically they could not read the communications.

So there are several opsec concerns for someone who doesn't want to draw attention to themselves.

[1]: https://en.wikipedia.org/wiki/33-centimeter_band

I have been dreaming about something like this for a while.

Depending on local laws and regulations different technology could be utilized to optimize coverage.

If one would like to interconnect various meshes, I can't think of a way to avoid using the Internet to trunk traffic across the Atlantic let's say. Should that ever be done is a most excellent question.

perhaps proximity and a local mesh is where it should stop.

In general, most high-band UHF RF is constrained by earths curvature.

Hams that operate in HF/CW bands simply rely on atmospheric or moon bounce to exchange Morse-code over long distances.

Amateur radio is a great way to gain a different perspective on electronics, physics, and our sun.

Have a great day, =3

> If one would like to interconnect various meshes, I can't think of a way to avoid using the Internet to trunk traffic across the Atlantic let's say.

Radio links with a regular 'ol dipole antenna? Although I think most countries prohibit encrypted traffic for amateur radio purposes, plus the link would be kinda spotty and depend on ionospheric weather

Crossing the Atlantic with radio is totally doable, even with low power if you accept communicating at a few bits per second (see for example https://en.wikipedia.org/wiki/FT8 and https://wsjt.sourceforge.io/wsjtx.html). As it's time-of-day dependent you'd need to have a way to switch bands (daily propagation patterns on 7 MHz are totally different from 14 MHz for example) depending on the ionospheric conditions, and a multi-band antenna. I'd rather use a pair of beams (this kind of thing: https://en.wikipedia.org/wiki/Yagi%E2%80%93Uda_antenna#/medi...) pointing to each other rather than a dipole, gain is much higher so you need less power. But even using multiple bands, there will be moments where no connection is possible at all.

There's also a satellite... https://en.wikipedia.org/wiki/Es%27hail_2, but of course it would be a single point of failure.

> different technology could be utilized to optimize coverage.

One of the nicest advantages of the underlying network stack here is that it can run over almost anything (Ethernet, I2P, internet, WiFi ...)

> Should that ever be done is a most excellent question.

Baring your, indeed very valid question, I am sure some enterprising soul would come up with a way to run some microwave trunk or some such, if needed.-

You generally need line-of-sight for microwave links and the longest known link is something like 350km, and even using tropospheric scatter you can't go over ~500km, so you'd need multiple relay stations with microwaves.

Using a lower band and bouncing off the ionosphere gets you much further but only works if ionosphere weather is OK, and it'll have lower bandwidth (not necessarily a problem though), and encryption is a no-no for amateur radio in most countries

What would it be like - heaven forbid - to have weather-dependant transatlantic links?

(Decently fast, just ... periodically off ...)

I have one of these. My hacker friend gave it to me to help expand the network in Austin. Unfortunately, it's very much a tinkering, hacky, hobbyist thing.

It's extremely exciting to get any kind of communication. It would be interesting to see how well it works in a more densely packed area where people are really using it. For me, it's been, unfortunately, useless.

Thanks for sharing your experience ... ... mass adoption is a thing - a prerequisite. But it is kind of a chicken and egg problem ...

It might unfortunately take some CME event or the like - a severe disruption for people to consider these alternatives, am afraid.-

'Uncensorable' yes, but still vulnerable to novel government regulation, jamming, rubber hose attack, etc. Folks using Meshtastic in Ukraine rapidly found out that they were advertising their positions, as well, resulting in being struck by opposing forces. I enjoy LARPing as a prepper, but I'm afraid this technology has been demonstrated to fall short in times and places where people really needed to use it in anger.

The moment this sort of technology begins to pose a real threat to the control soft-authoritarian governments like the EU and UK have over the populace, they'll simply ban or regulate it the way they already do guns and large cash transactions, and are currently considering doing with Twitter[1]. Once you break that law, you'll be doing 18 months in prison for your ham hobby.

I suspect we will just have to go back to talking to each other in the pub :-(

[1] https://youtu.be/mrTj6XdpXPM

This is when you put up a very low to the ground HF dipole and operate the mesh in NVIS (near vertical incidence scattering) donut mode. Your node won't be able to contact anything local but it will contact a ring region about 100 miles around you with a many tens of miles gap. It is much harder to find an NVIS transmitter with multi-lateration which is why it is the mode most commonly used in military operations (for ground troops).

The network stack used in this article is called Reticulum. Reticulum can operate over really any medium that has a MDU of 500 bytes, and a throughput greater than 5 bits.

I've performed this exact test using two HF radio nodes equipped with NVIS antennas operating on the 40 meter band, with each radio 144 km (90 miles) separate in distance. Node 1 was out in the field while Node 2 was back at my house. Node 2 was able to act as a bridge to the outside TCP Testnet. https://www.youtube.com/watch?v=blwNVumLujc

You live in the Western world buddy. You're not going to jail for playing with mesh network gadgets and Twitter isn't going anywhere. There will be the threat of a huge fine for non-compliance, Twitter will threaten to leave the market, users (voters) will freak out, politicians will be like "Crap I'm gonna lose my job" a wrist slap will ensue and we'll all move on.

You guys should really campaign to get real freedom of speech like... properly on the books. Dunno why that isn't a thing.

Look at what's happening in the UK right now to see how illiberal Western democracies can be when up against the wall. Don't forget that it was only about 2-3 years ago that there were temporary going-outside-without-a-good-reason bans in the USA, while Irish police were inspecting people's shopping to make sure they weren't buying anything non-essential[1]. Most recently, the UK has now jailed several people for significant periods for being racist on Twitter. Ireland won't be far behind, because we're not clever enough to write our own laws, preferring to crib from the UK and then ratchet up the severity and hand-wringing during implementation.

Broad liberty is not a thing because people don't know anything different, prefer safety to opportunity, and don't want it badly enough to be willing to clog the courts and jails until the economy suffers. And the power that has become entrenched is more interested in maintaining maximum control/the appearance of harmony, and punishing severely any who dissent, than in doing anything that might see their control diminished. The EU is pushing for 'chat control' (invasive surveillance of all encrypted instant messaging) again, despite it having been defeated previously. Why would encrypted RF comms be treated any differently, especially when it's as simple as passing a law saying 'not permitted without a license as of 1 Jan' and then refusing to issue any licenses?

God's sake, they're lowering all our non-motorway speed limits to 37MPH in October. That's not something esoteric or technical, and in a country with as poor public transport as Ireland, affects pretty much everyone for the worse-- and yet I can't find a single person who has even complained to their representative! Worse, they all seem to be OK with it. Nobody actually asked for this, and everyone is both powerless and uninterested in doing anything about it.

[1] https://extra.ie/2020/04/16/news/irish-news/gardai-inspectin...

How does this compare to CB radio in terms of the distance it can operate over? The two radio boards seem a lot less capable but looks can be deceiving given how ignorant I am over these matters.

Basic LoRA can do >7km in the 25mW ranges, but the bandwidth is minimal. Note, under some situations the range can hit hundreds of km.

CB/11meter range depends on many parameters, but even at 4W you would be lucky to reach beyond 80km.

The main difference is Lora Gateways receiver sensitivity is <-139dBm, and can recover data from what looks like the noise floor in most hardware.

If Lora had at least 3 manufacturers, I would have stuck it in every station years ago.

Cheers, =3

There are some amateur radio operators who operate in QRP (max. 5 W power) and have a DXCC award (so they have contacted at least 100 different countries). So the range is much more than 80 km, especially if you use digital modes able to recover signals you can't even hear (like FT8 or WSPR)... but bandwidth will be very low.

Tropospheric ducting is rare on 11meter, but indeed Hams have achieved some pretty creative antenna setups in HF. It is a deep rabbit hole, but in the spirit of comparing apples-to-apples...

Also, the ERP limits on FCC stamped consumer modules is fairly low for unlicensed users. i.e. many Lora modules have iffy certified antennas for compliance reasons.

Cheers, =3

Well the range of packet radio over CB in the US is "We will hunt you down and arrest you".

In general, the links supported range from line-of-sight to a few miles. If it can move 5 bits/second and you can make a link-layer abstraction (outputs the packet from 1 sender at a time) Reticulum will make the rest of the network work as intended.

I know it's against the spirit of the thing (and probably against the law somehow), but I wonder what a path of data -> encode to text -> text to speech -> radio -> speech to text -> decode -> data would be like?

We call it a "numbers station" right now.

Honestly LLMs might make for an interesting means of stenography. Encoding encrypted data in vectors that can be rendered to coherent statements and back.

Lots of complexity with that question. CB is voice, this is digital. Typically, digital communications can "travel further for a given watt" because the power is "focused" on a smaller amount of bandwidth.

CB can propagate (be bounced off of layers of the atmosphere) to get a significant distance, but it depends on atmospheric conditions, time of day, etc. So not reliable.

I've talked to Uruguay on my ham radio on 4 watts (HF, 10-meter band), but once again, I can't do that reliably/every day.

LoRA is 900mhz (in the US) so you don't get atmospheric propagation.. but with the right antenna (height is might!), you can get several miles in a city environment with only a watt or two... so forming a mesh is what allows you to achieve further distances.

It is not legal to encrypt CB or ham radio communications.

Reply on news.ycombinator.com