Protect (yourself)

Two separate identities

On this site, we talk about two separate identities: your civil identity (phone, carrier) and your radio identity (public key on the mesh). In MeshCore, only the latter exists: the protocol knows no name, SIM, or phone number. Confusing them is a common source of false security. Everything below is about what can be protected on each side.

Using MeshCore does not anonymise you to your carrier if the phone stays connected to cell towers, even without sending a single radio message. The mesh, however, does not transmit your civil identity to other participants or observers: a public key and radio activity are visible there, not your name.

Classic messaging: what is exposed

Everyday tools (Signal, WhatsApp, Telegram) depend on the Internet, commercial mobile networks (4G/5G), and central servers. Under heightened surveillance, those networks can be cut, towers saturated, or metadata (who talks to whom, where, and when) collected.

Even for a contact a few steps away, a WhatsApp or Signal message usually travels over 4G or Wi‑Fi, through your mobile operator (who is also your ISP on the cellular network), then a transatlantic link to a remote server (often in the United States) before coming back to the recipient. Your IP address (and in practice your digital identity and communication habits) can be known at each step and under several jurisdictions, while your phones are metres apart.

Detailed diagram (problem vs local mesh): Taking back control of our communications on Discover.

Smartphone and metadata

Outside airplane mode, your smartphone searches for cell towers and registers with them. On each connection, the carrier receives two identifiers: the IMEI (factory device number) and the SIM card identifier (linked to your number and subscription). In Belgium, every SIM (prepaid or contract) is tied to a civil identity at activation. The carrier therefore records which device and which subscription connect, and can infer who you are, plus an approximate location (which tower serves you). Airplane mode cuts cellular radio: no more IMEI or SIM sent to towers. To limit exposure of your civil identity to the carrier (stop sending IMEI and SIM to towers), this is in practice the right measure but not an absolute guarantee; see the airplane mode Q&A.

To limit this exposure during MeshCore use: enable airplane mode, keep Bluetooth for the radio companion, and follow the smartphone hygiene described in Securing your data in the field. Other risks remain possible (GPS, apps, carrier / radio correlation); see the airplane mode Q&A.

MeshCore: visible vs protected

Every radio message carries two distinct things: an envelope (the activity) and a letter (the content). The envelope is always readable by anyone who captures the signal; the letter may be plain text or unreadable without the right key (encryption). Encryption protects the text, not the fact that communication happened.

Three concrete cases

Here is what a mesh observer sees, compared to what an authorised recipient reads:

Which mode for what sensitivity

MeshCore offers several ways to exchange (details on Discover: the modes). For confidentiality and collective protection, what matters is mainly who must receive the information, not only how serious it is:

No encryption is unbreakable: an adversary with significant means or physical access to an unlocked device can bypass radio protection. Encryption protects content in the air, not what appears on your screen or an seized, unlocked terminal.

Mesh observers

Observers illustrate what “activity is always visible” means in practice: they are not documented MeshCore roles, but a community convention. Participants configure nodes in listen-only mode: no packet relaying, no application messages, no joining a conversation.

This is a form of benevolent surveillance, serving the collective rather than targeted individual listening. These nodes record metadata, paths, and raw message payloads within range, then often share analyses publicly: mapping the mesh, spotting poorly covered areas, detecting duty cycle abuse or public-key collisions. A line on this role also appears in A mesh made of nodes on Discover.

Even a benevolent observer is limited by encryption: on a private channel or direct message, they see that a conversation happened, between which nodes and how often, but not the decrypted text. Only a public channel exposes plain content to anyone who captures the signal.

Captures are available via community tools.

Technical anonymity

LoRa and MeshCore are not a closed network: the same frequencies carry radio amateurs, sensors, tinkering projects, citizen or community networks, and other LoRa stacks (Meshtastic, telemetry…). That heterogeneous background noise complicates profiling: the more varied the traffic, the harder it is to tie an emission to a specific profile or use.

Anonymity through numbers

On a shared band, the best technical protection is not absolute invisibility (impossible over the air), but the ability to blend into a crowd. An observer capturing LoRa sees signals, timing, activity patterns: if everyone looks alike, any atypical use stands out quickly. If the mesh has only a few dozen very homogeneous nodes, a handful of traffic patterns is enough to isolate a profile.

Conversely, a lively network where neighbourhood chats, radio tests, exchanges between neighbours, activist messages, or simply curious newcomers learning the ropes all mix together blurs the profiles: each extra transmission dilutes the signatures. Cultivating that diversity of use means cultivating collective protection. This does not contradict encryption and private channels (see Securing your data in the field): it is the radio context that gives them their full meaning.

No gatekeeping, no niche network

Some decentralised networks tend to close ranks: technical jargon, implicit requirements, the feeling of belonging to a small circle that "gets it". MeshCore in Brussels has no interest in staying a confidential subculture. The more varied the people the mesh attracts, the better it protects everyone.

This is not about pushing anyone to install hardware without support, or imposing a single use case. It is about welcoming the curious, sharing the guide, encouraging legitimate and varied uses: staying in touch with neighbours, trying radio as a family, hosting a repeater, joining a neighbourhood public channel. Everyone who uses MeshCore "ordinarily" strengthens the cover for those who need it at sensitive moments.

Refusing gatekeeping also means avoiding lines like "this isn't for you" or "come back when you can configure a repeater". The Join and Discover pages exist to lower the barrier; a well-configured companion is often enough to contribute useful background noise, with no obligation to become a relay installer.

Securing your data in the field

Our behaviour is half the network's security. Encryption is robust, but it depends on our collective discipline.

1. Private by default for coordination: names, numbers, detailed plans, and channel keys → private channel or exchange off the public channel (face to face, MeshCore private message, classic messaging…). Legitimate exception: an urgent alert meant for the widest audience (ongoing danger, call for help, timestamped report) may and sometimes should go on a public channel, without adding unnecessary personal detail. Delete the private channel once coordination is done. For a disposable identity before an event, see Multiple identities on the mesh. See Which mode for what sensitivity.
2. Smartphone hygiene: airplane mode on + Bluetooth on. Disable face recognition and fingerprint unlock. Use a strong password, not a 4-digit PIN. Encryption protects the message in the air, not what appears on your screen (shoulder surfing, seized unlocked device). In Belgium, you can in principle refuse to give your unlock code when a device is seized; the concrete situation may vary (legal explanation, French). Airplane mode cuts carrier exposure; for other risks, see airplane mode Q&A.
3. Camouflaging enclosures: weatherproof box, garden lamp, flower pot. Advertise the node on the network or not, depending on your strategy.
4. Geolocation: typical enclosures have no GPS and the app does not transmit your coordinates. Radio direction finding can nevertheless estimate an emission zone. In Brussels, signals bounce off concrete; client repeater mode in a dense group makes identifying a single emitter harder (see Coordinating a group on the move).

Multiple identities on the mesh

MeshCore lets you create as many radio identities (public keys) as you want. In practice, two profiles are enough for most uses: an everyday identity and a disposable one for a one-off event. For routine mesh communication (outside an exceptional event), keep that everyday identity stable.

Switching to a disposable identity

The simplest way, without a second device:

1. Export your everyday identity (Companion settings → Identity → Export), if you have not already.
2. Regenerate the key (new public key) and change the pseudonym to an obscure name, not the default pseudonym often tied to the device.
3. Do not advert on this disposable identity.

Step-by-step in the app: your radio identity.

During the event: what stays, what breaks

In a march or dense group, a private channel or room server often works better than a private message: participants are rarely isolated, and someone can relay a message by voice to members within earshot. See Coordinating a group on the move and Q&A group without repeaters.

Returning to your everyday identity

As soon as the event is over, return to your everyday identity: that is what lets your contacts resume normal communication without chasing a new public key for every message.

1. Import the Export file (Companion settings → Identity → Import).
2. Check that the public key matches the one from before; your everyday private messages and contacts work again.
3. Stop using the disposable identity. It may remain visible for a while in observer histories (a “ghost” node), as after replacing a device without re-import (see Build: public key).

On a group private channel, you can identify yourself to trusted contacts, for example: E46F3A> Hi group, it's Garance! You can update my contact once you've added me (after restoring your everyday identity or adding off-radio).

Coordinating a group on the move

When a group moves outside fixed repeater coverage (hike, festival, poorly meshed area), companions carried by members can form an ephemeral mesh among themselves.

• Private channel
• Client repeater
• Airplane mode + Bluetooth

Share the private channel key face to face before you leave. Delete the channel once coordination is done. To create a private channel, see Join: private channels. To enable client repeater mode, see Q&A group without repeaters.