Meshtastic

I'm not familiar with the design philosophy of the original protocol, or if they decided the protocol should or should not attempt to impose any kind of a security model, but given that the project grew out of the same kind of ethos as HAM, I'd bet it was never a high priority.

That said, these exploits make the mesh untrustable and should be mitigated. If the devs don't want to implement fixes, maybe the answer is stripping out all encryption entirely and adding a plugin system that allows anyone to implement a solution themselves. They could even move the current broken implementation to a plugin and make it the default.

In the future, they'd only ever need to handle requests for maybe new entry points or tweaks to the plugin system.

If I'm understanding correctly, they are actually addressing security issues. For example, they have a blog post called that one time at DEF CON where they discussed what happened and how they mitigated it in firmware 2.7.5.

2. I believe every single exploit we demo'd was previously documented in meshtastics bug tracker 1yr+ ago and were closed by the MT devs and largely ignored for a year.

3. When I began trying MT in 2024 the devs shutdown convos asking for security fixes saying people should use other comms tools if they wanted security. Rather than address fixable security bugs.

Well, that pretty much settles the Devs don't care about security.

Is it legal to encrypt communications in the spectrum meshtastic is using?

I had thought it was not and therefore could not be built into the protocol and so securing communications (potentially illegally) is left as an exercise for the reader.

Is that not so?

this is never going to be and was not designed to be a secret spy movie text network anymore than it is an instant messager replacement. the encryption has a ways to go yes but its also come a long way. the benefit of the platform is zero licensing entry with cheap gear. that communities can stand up together and use. or organizers can flash devices between uses and swarm a mesh if needed.

its fun building meshes that can cover a hundred miles but, to function like that you have to drastically shorten the messages. and repeat messages to deal with drops. the encryption overall is fine for what the mesh can do and what the appropriate use cases could be. not great but it'll do.