Possible privacy leak: node location visible via private channels when not shared on public channel #116

New Issue

2026-10-04T23:01:13+02:00

adam commented

2026-10-04 23:01:13 +02:00

Location Leak of Nodes via Private Channels

Summary:

I observed on the map that the location of some nodes appeared even though they had not shared their position on the public (whitelisted) channel. It seems their location is being exposed unintentionally via another node (the ingestor) that does have a private channel with them.

Details:

The ingestor node is accidentally leaking the location information of a node through the map if it receives that data on a private channel.
Alternatively, the leak may occur because the ingestor node can see the real location (and exposes it), as it has access to the private channel—possibly one that Potato Mesh considers "blacklisted."
I haven't traced the root cause yet, but it seems likely to be one of the two scenarios above.

Privacy Consideration/Question:
Should we allow blacklisting the location of specific nodes for privacy reasons? This could address the problem in both cases, as the ingesting node would need to blacklist (not share) the locations of its own private nodes that it does not want to share publicly.

This is to discuss potential privacy improvements around node location sharing and to seek advice on sensible safeguards to prevent unintentional location exposure via private channels.

## Location Leak of Nodes via Private Channels **Summary:** I observed on the map that the location of some nodes appeared even though they had not shared their position on the public (whitelisted) channel. It seems their location is being exposed unintentionally via another node (the ingestor) that does have a private channel with them. **Details:** - The ingestor node is accidentally leaking the location information of a node through the map if it receives that data on a private channel. - Alternatively, the leak may occur because the ingestor node can see the real location (and exposes it), as it has access to the private channel—possibly one that Potato Mesh considers "blacklisted." - I haven't traced the root cause yet, but it seems likely to be one of the two scenarios above. **Privacy Consideration/Question:** Should we allow blacklisting the location of specific nodes for privacy reasons? This could address the problem in both cases, as the ingesting node would need to blacklist (not share) the locations of its own private nodes that it does not want to share publicly. --- This is to discuss potential privacy improvements around node location sharing and to seek advice on sensible safeguards to prevent unintentional location exposure via private channels.

adam closed this issue

2026-10-04 23:01:13 +02:00

adam commented

2026-10-04 23:01:14 +02:00

That's not possible as we cannot tell which channel a position packet came from.

That's also the reason why I personally oppose whitelist or blacklist. You should not use the ingestor device for sensitive tasks or other means, ingesting basically means publicating everything to a public web dashboard.

Here is a POSITION_APP packet:

{
  "from": 3121393592,
  "to": 4294967295,
  "decoded": {
    "portnum": "POSITION_APP",
    "payload": {
      "__bytes_b64__": "DQAAVB8VAAAUCBiG//////////8BJfN3QmkoAj3zd0JpWKABeAmAAYjTG5gBBrgBDQ=="
    },
    "bitfield": 0,
    "position": {
      "latitudeI": 525598720,
      "longitudeI": 135528448,
      "altitude": -122,
      "time": 1765963763,
      "locationSource": "LOC_INTERNAL",
      "timestamp": 1765963763,
      "PDOP": 160,
      "groundSpeed": 9,
      "groundTrack": 453000,
      "satsInView": 6,
      "precisionBits": 13,
      "raw": {
        "latitude_i": 525598720,
        "longitude_i": 135528448,
        "altitude": -122,
        "time": 1765963763,
        "location_source": "LOC_INTERNAL",
        "timestamp": 1765963763,
        "PDOP": 160,
        "ground_speed": 9,
        "ground_track": 453000,
        "sats_in_view": 6,
        "precision_bits": 13
      },
      "latitude": 52.559872,
      "longitude": 13.5528448
    }
  },
  "id": 3301756749,
  "rxTime": 1765963764,
  "rxSnr": 6.25,
  "hopLimit": 5,
  "rxRssi": -82,
  "hopStart": 7,
  "relayNode": 97,
  "transportMechanism": "TRANSPORT_LORA",
  "raw": {
    "from": 3121393592,
    "to": 4294967295,
    "decoded": {
      "portnum": "POSITION_APP",
      "payload": "DQAAVB8VAAAUCBiG//////////8BJfN3QmkoAj3zd0JpWKABeAmAAYjTG5gBBrgBDQ==",
      "bitfield": 0
    },
    "id": 3301756749,
    "rx_time": 1765963764,
    "rx_snr": 6.25,
    "hop_limit": 5,
    "rx_rssi": -82,
    "hop_start": 7,
    "relay_node": 97,
    "transport_mechanism": "TRANSPORT_LORA"
  },
  "fromId": "!ba0cafb8",
  "toId": "^all"
}

There is on way to distinguish this packet from any channel.

That's not possible as we cannot tell which channel a position packet came from. That's also the reason why I personally oppose whitelist or blacklist. You should not use the ingestor device for sensitive tasks or other means, ingesting basically means publicating everything to a public web dashboard. Here is a POSITION_APP packet: ``` { "from": 3121393592, "to": 4294967295, "decoded": { "portnum": "POSITION_APP", "payload": { "__bytes_b64__": "DQAAVB8VAAAUCBiG//////////8BJfN3QmkoAj3zd0JpWKABeAmAAYjTG5gBBrgBDQ==" }, "bitfield": 0, "position": { "latitudeI": 525598720, "longitudeI": 135528448, "altitude": -122, "time": 1765963763, "locationSource": "LOC_INTERNAL", "timestamp": 1765963763, "PDOP": 160, "groundSpeed": 9, "groundTrack": 453000, "satsInView": 6, "precisionBits": 13, "raw": { "latitude_i": 525598720, "longitude_i": 135528448, "altitude": -122, "time": 1765963763, "location_source": "LOC_INTERNAL", "timestamp": 1765963763, "PDOP": 160, "ground_speed": 9, "ground_track": 453000, "sats_in_view": 6, "precision_bits": 13 }, "latitude": 52.559872, "longitude": 13.5528448 } }, "id": 3301756749, "rxTime": 1765963764, "rxSnr": 6.25, "hopLimit": 5, "rxRssi": -82, "hopStart": 7, "relayNode": 97, "transportMechanism": "TRANSPORT_LORA", "raw": { "from": 3121393592, "to": 4294967295, "decoded": { "portnum": "POSITION_APP", "payload": "DQAAVB8VAAAUCBiG//////////8BJfN3QmkoAj3zd0JpWKABeAmAAYjTG5gBBrgBDQ==", "bitfield": 0 }, "id": 3301756749, "rx_time": 1765963764, "rx_snr": 6.25, "hop_limit": 5, "rx_rssi": -82, "hop_start": 7, "relay_node": 97, "transport_mechanism": "TRANSPORT_LORA" }, "fromId": "!ba0cafb8", "toId": "^all" } ``` There is on way to distinguish this packet from any channel.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/potato-mesh#116