rns.recipes

Hi all

I was recently browsing through the discussion threads on Mark's github page when I came across a message from user 'skyguy' that read:

"Sender Anonymity is an important feature of Reticulum and possibly a large drawcard for participation. However the current implementation doesn't provide this feature for anyone who connects over the Internet for their 'first hop'. Anyone packet-sniffing a well-known Transport Node is be able to log the source IP address for every Announce."

Now this makes sense. The same perhaps famously is the case for Tor entry and exit nodes. But in the case of Nomad and Reticulum I overlooked this, what with the focus on Reticulum being a completely new entirely encrypted network stack from the ground up.

Being seen to be connecting to Nomad is not an issue (right now, anyway), and I would not be concerned with my ISP or anyone else monitoring known Transport Nodes. I do use a VPN when using the internet anyway.

My question is - is there plans to address this "first hop anonymity" situation? Or is it an accepted fact that internet traffic via the first hop will be unencrypted purely by design of TCP/IP networks?

Couldn't find anything with the search function regarding this so it would be excellent to hear some thoughts on this from others who are more experienced with Reticulum.

you can use a VPN or i2p if you want true anonymity. if its a tcp interface no matter what the isp will know WHERE you are going and WHAT PORT but not the content. Protecting the content is more important imo and if you want to obfuscate all of it look at DNS tunnels on the forums here

There are kinda two meanings for first hop anonymity problem:

• the first node to receive your packet can tell it originated from you instead of only being transported because of the hop count on the packet.
• connections over mediums like the internet expose connection metadata to each side like the IP address

Psst... waves from the alley

There's local_hops_delta = yes in [reticulum] section of config (or "Obfuscate Hop Counts" in Sideband connectivity settings on Android).

And static_transport_identity = no (now default, it seems, not sure since when).

Those are undocumented, but work they do.