Mastodawn

futo_tech Jul 20, 2023

NEOPASS/HARBOR - Harpo Roeder Discusses a New Verification App

https://peertube.futo.org/videos/watch/ecb1f70e-e42f-429f-b536-cbfe4490339e

NEOPASS/HARBOR - Harpo Roeder Discusses a New Verification App

PeerTube

TheSecondVariation 3d ago

Is there a possibility to decrypt a luks #encrypted sd card with #android ?

E2EE P2P Messaging App

I recently introduced [metered.ca](http://metered.ca) for the STUN/TURN servers and the stability has hugely improved and so i'd like to ask for your feedback if you'd like to try it out.

Demo: https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story

Data isnt persisted (yet), so each page refresh will clear all keys.

(IMPORTANT: For testing and demo purposes only. This is a work-in-progress and far from finished. It has not been reviewed or audited. Do not use it for sensitive data.)

#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #Encrypted #infosec #cryptography #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #WebDev #TechDevelopment #ChatApp #javascript #InstantMessaging

Video Call SDK and Screen Sharing API | Metered

Add one-to-one or Group Video and Audio Calling to your app or website with Metered Video Call SDK

0xKaishakunin Oct 22

#FHE #SQL: Fully #Homomorphic #Encrypted #SQL #Database

FHE-SQL is a privacy-preserving database system that enables secure query processing on encrypted data using Fully Homomorphic Encryption (FHE), providing privacy guaranties where an untrusted server can execute encrypted queries without learning either the query contents or the underlying data.

https://arxiv.org/abs/2510.15413v1

FHE-SQL: Fully Homomorphic Encrypted SQL Database

FHE-SQL is a privacy-preserving database system that enables secure query processing on encrypted data using Fully Homomorphic Encryption (FHE), providing privacy guaranties where an untrusted server can execute encrypted queries without learning either the query contents or the underlying data. Unlike property-preserving encryption-based systems such as CryptDB, which rely on deterministic or order-preserving encryption and are vulnerable to frequency, order, and equality-pattern inference attacks, FHE-SQL performs computations entirely under encryption, eliminating these leakage channels. Compared to trusted-hardware approaches such as TrustedDB, which depend on a hardware security module and thus inherit its trust and side-channel limitations, our design achieves end-to-end cryptographic protection without requiring trusted execution environments. In contrast to high-performance FHE-based engines-Hermes, which target specialized workloads such as vector search, FHE-SQL supports general SQL query semantics with schema-aware, type-safe definitions suitable for relational data management. FHE-SQL mitigates the high cost of ciphertext space by using an indirection architecture that separates metadata in RocksDB from large ciphertexts in blob storage. It supports oblivious selection via homomorphic boolean masks, multi-tier caching, and garbage collection, with security proven under the Universal Composability framework.

arXiv.org

New #privatbin Instance is up!

🔒 Keep your Notes private and safely hosted in #europe at my own #Privatebin Instance:

https://secrets.lifianvtuber.de

#it #opsec #encryption #encrypted #free #foss

lifBin

Visit this link to see the note. Giving the URL to anyone allows them to access the note, too.

lifBin

@Em0nM4stodon I've installed #CryptPad, and #Nextcloud, #immich as well as other services on #encrypted #ZFS on my #linux server. Nextcloud was a bit of a pain, CryptPad was painless, Immich, yeah kind of a real pain. But if you want help getting off of BigTech and supplying your own services, controlled by you, encrypted by you, #AMA.

🦄 🅃🅁🄰🄽🅂🄸🄲🄾🅁🄽 🏳️‍⚧️Oct 21

3.) For those who aren't using #encrypted #CloudStorage, #Veracrypt is an easy way to create an encrypted container you could then upload to the cloud.

4.) For added security, even on an already encrypted system drive, you can place personal documents inside of a Veracrypt container you've created that can otherwise be inaccessible. Useful for an added layer of #security or on shared workstations depending on scenario.

#GlobalEncryptionDay #Infosec #Encryption

🦄 🅃🅁🄰🄽🅂🄸🄲🄾🅁🄽 🏳️‍⚧️Oct 21

Some things to note and some use cases for #Veracrypt:

1.) #LUKS provides a way to #encrypt #linux drives. Veracrypt is not the answer for your system drive, but additional drives can be fully #encrypted and mounted using it.

2.) #PlausibleDeniability is what #HiddenContainers offer by having one #password that opens the outer container where you can store files, with a secondary container accessible with a different password.

#GlobalEncryptionDay #Infosec #Security #Encryption

🦄 🅃🅁🄰🄽🅂🄸🄲🄾🅁🄽 🏳️‍⚧️Oct 21

October 21st is #GlobalEncryptionDay

For those who aren't yet aware of this application that's #CrossPlatform, easy to use, has a helpful #FAQ guide if need be, i'll briefly describe #Veracrypt

With Veracrypt you can create #encrypted containers, hidden secondary containers within encrypted containers, #encrypt drives and it also offers an alternative to #Bitlocker if desired if running a #Windows OS that is NOT a #DualBoot scenario

https://veracrypt.io/en/Downloads.html

#Linux #MacOS #Infosec #Security

VeraCrypt - Free Open source disk encryption with strong security for the Paranoid

VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files.

For context this is what the whole #Boston #MeshCore map looks like right now.

The bulk of all traffic is concentrated around the area of #NoKings downtown.

The #mesh is certainly doing its job right now.

Community run, #decentralized, #encrypted, open-access #infrastructure at work.

×

For context this is what the whole #Boston #MeshCore map looks like right now.

The bulk of all traffic is concentrated around the area of #NoKings downtown.

The #mesh is certainly doing its job right now.

Community run, #decentralized, #encrypted, open-access #infrastructure at work.

Cities around the country should be thinking about how projects like #Meshtastic and #MeshCore fit into events such as #NoKings.

It requires the support of technical members of the community taking the time to set up this infrastructure, which has a cost and is certainly not free.

I’d estimate some members of the #Boston MeshCore network have spent thousands of dollars on equipment.

Jérôme Oct 18

@occult it’s actually what got me into mesh and motivates me to continue. Been worried about tech/communication being banned or surveilled at certain type of protests.

Alec Perkins Oct 23

@jerome @occult they are well suited as substitute communications channels when cell is unavailable, but I would be very careful with assumptions of how anonymous and untraceable these meshes are.

@alec @jerome it’s the same as using a cell phone in that you must understand the hardware/software stack, your threat model and practice good operational security at all times.

Just like with any other communications technology.

Alec Perkins 6d ago

@occult @jerome right exactly. I worry people think the mesh radios are automatically less traceable and more secure in protest conditions. Using them safely in adversarial conditions requires understanding and consideration. Never mind they are trivial to jam.

Jérôme 6d ago

@alec @occult Concretely, what is a security problem you see with meshcore? Because we talk in "theory" here, but what is the exact concern?

Of course it requires understanding and consideration, just like any other tech, but it's important to know what those are really.

Alec Perkins 6d ago

@jerome @occult they are trackable transmitters that typically require a smartphone itself to be in a radiating mode. Their transmissions inherently include unencrypted routing and addressing info. It would not be difficult for a motivated actor with even modest resources to document which transmitters are seen where and when (particularly at repeat protests), which nodes communicate with each other, and correlate these with other records. All without knowing any message content.

@alec @jerome I'd love to see someone narrow down who in a crowd of 1000s is holding a MeshCore radio and tie that to any specific transmission. They are only emanating when you send a message in short blips.

LoRa devices that are standalone and come with keyboards can be operated without the need for a smartphone companion.

You can buy these devices very anonymously, you can buy them at the MIT swap in cash if you wanted to.

I think your threat modeling may be a bit extreme.

@alec @jerome that said, no one is saying these are a magic solution to anonymity and security.

I certainly think that a cell phone gives out way more information about your location, who owns the phone (IMSI / IMEI registered with one of a few centralized cell phone providers) and we know IMSI catchers exist for direction fining cellphones which are way more talkative than LoRa radios.

@alec @jerome the decentralized nature of mesh network repeaters (being owned and operated by private individuals) with their location reporting being completely optional and arbitrary (they do not have to report their exact location) on top of the whole system being E2EE. I'd say they definitely serve a purpose.

Alec Perkins 6d ago

@occult @jerome I agree they can lend some degree of conditional anonymity. But going back to the post I was responding to: if the concern is comms being surveilled or banned at “a certain type of protest”, then I think it is important to consider the implications of carrying a jammable transmitter beaconing an identifier. I’m not saying “don’t”, just check assumptions.

It’s trivial to slurp it all up for later analysis. My work now for building out our mesh processes a few M packets in seconds

@alec @jerome any RF device can be jammed, so I guess what's the point in your threat model?

That's why I say it's too extreme. No one is disagreeing with you that any RF spectrum can just be jammed.

What specific identifying beacons are being transmitted in the context of Meshtastic or MeshCore protocols?

Slurp up what exactly? A bunch of encrypted packets? At any point one can simply regenerate their private / public keys.

What mesh are you building? Would love to hear more.

Alec Perkins 6d ago

@occult @jerome I’m just saying it’s not uniquely resistant to malicious interference and surveillance compared to other methods someone might be concerned about. You can do a lot just with the headers. I can tell who is dm’ing who in nyme.sh or roughly where in the city they are at the time without seeing any message content. If I were a state actor with access to other data, that becomes really powerful. Heck I found node owner personal addresses through Google just by making some inferences.

@alec @jerome if your threat model is "state actor can do all and see all" yeah I guess you're right. Zero technology passes that test.

Throw it all out and attend protests like they used to for all time prior to the invention of the modern cell phone and just take a sign and nothing else.

Alec Perkins 6d ago

@occult @jerome I mean yeah. Again, the original post I was responding to heavily implies a state actor since who else can “ban” comms methods. And again, all I’m saying is if that’s the concern, apply those concerns to mesh radios also. If you wouldn’t bring your phone, consider not carrying a mesh node either. Or at least be mindful of exactly how it works and what kind of trail it leaves. One intriguing option is disable transmit on most and flood only, to use them like pagers.

Alec Perkins 6d ago

@occult @jerome something to consider is the nodes can’t be tied to an individual up front. But if someone is picked up with one, suddenly they are matched to it and there is evidence placing them at certain locations at certain times, who they are associated with, etc. The afterward is just important to think about as the real time of the action.

Justin Derrick Oct 19

@occult The snag for using it during protests is that Meshtastic is profoundly insecure, and the dev team doesn’t seem concerned about improving it. Spoofing attacks have been demonstrated, as well as rebroadcasting public keys, making impersonation of specific nodes invisible to end users.

Not sure about Meshcore or the others.

frater mus Oct 20

@JustinDerrick @occult

Layman here, but unless I am misreading it there are no NIST entries for meshtastic that have not been fixed in firmware or official software. The most serious issue I am aware of (PKI goat rodeo) was fixed in 2.6.11, back in June. Did you have something specific in mind by "Meshtastic is profoundly insecure, and the dev team doesn’t seem concerned about improving it"?

https://nvd.nist.gov/vuln/search#/nvd/home?keyword=meshtastic&resultType=records

NVD - Search and Statistics

Justin Derrick 6d ago

@fratermus @occult This might be old news, but...

https://github.com/datapartyjs/meshmarauder

GitHub - datapartyjs/meshmarauder: LoRa mesh radio pentesting tool

LoRa mesh radio pentesting tool. Contribute to datapartyjs/meshmarauder development by creating an account on GitHub.

GitHub

@JustinDerrick @fratermus Yep, that only affects Meshtastic. Sucks for them.

@nullagent did some quality work on that and LoRa pipe.

Jérôme Oct 18

@occult what app are you using to make that map?

@jerome we feed the live map at https://map.w0z.is/?lat=42.38847&lng=-71.2199&zoom=12 with sensors in our area.

MeshExplorer

A real-time map, chat client, and packet analysis tool for mesh networks using MeshCore and Meshtastic.

Jérôme Oct 18

@occult So it seems to be mesh explorer? that's awesome, did not know the project, will have to check it out if we can set that up in Toronto..

https://github.com/ajvpot/meshexplorer

#meshexplorer #meshcore

GitHub - ajvpot/meshexplorer: Real-time map, chat client, and packet analysis tool for mesh networks using MeshCore and Meshtastic.

Real-time map, chat client, and packet analysis tool for mesh networks using MeshCore and Meshtastic. - ajvpot/meshexplorer

GitHub

@jerome hop into the MeshCore Discord, they're quite friendly and other locations are feeding into their map.

You can, of course, host your own local map.

It's really nice just for troubleshooting.

@occult i had no idea this existed! very cool especially seeing that the antenna dongles use bluetooth and could be used with a phone in airplane mode 🛫 📡

Institute of Diagram Studies Oct 20

@occult I don't know much about this mesh technology so pardon my ignorance but: can you see the location of all the nodes in the mesh network? would seem like a big liability in a protest context?

@diagram_studies users on the ground are not required to report their location.

Locations of repeaters are set by operators, and I personally fudge my location to some nearby park or intersection.

The reason we want relatively accurate repeater locations is for generating a map of our infrastructure to help with troubleshooting and coverage of dead areas.

Repeaters are not required to transmit their location at all, so on my map above, there are more than a few repeaters absent.

Institute of Diagram Studies Oct 20

@occult thanks for explaining! 🙏

@diagram_studies sure thing! I’m not making a claim that MeshCore is magic. Good OpSec hygiene is still necessary just like anything else.