Threat model / Limits
What Nucleus protects, and what it doesn't
Nucleus encrypts traffic on the mesh and keeps local communication off carriers and cloud services. It doesn't make you invisible, and it can't stop someone who holds a node or a phone.
01Protects
What it protects against
| Threat | How |
|---|---|
| Reading traffic on the WiFi meshes | Both the 2.4 GHz and HaLow meshes are encrypted with WPA3 on every link between nodes. |
| Reading Reticulum messages | End-to-end encryption with forward secrecy. Nodes in between carry ciphertext. See field operations. |
| Depending on carriers or cloud services | Local communication runs on your own nodes, with no internet connection and no accounts. |
| Losing one path | Text goes out over WiFi and LoRa. If one is down, the other can still deliver it. |
02Limits
What it doesn't protect against
| Threat | Why |
|---|---|
| RF detection and direction-finding | Every transmitter can be detected and located, including WiFi and LoRa. |
| Jamming | A radio path can be jammed. Traffic can move to another path, but the jammed one is denied. |
| LoRa readers on your channel | Any Meshtastic radio on the same channel can read and answer your messages. Packet headers, such as the sending node, are not encrypted. |
| Tailscale metadata | If you log in to Tailscale, its coordination server sees which devices are in your network. |
| A seized node | Assume whoever holds a node can read its configuration and the messages stored on it. |
| A compromised phone or laptop | Encryption ends on the device. If the device is compromised, so are its messages. |
03Report
Report a security issue
Email nathan@natakmesh.com, or send an LXMF message to 11efea534593c763cd173f7d62123bff.