★ NEW in v0.6.8 · KERBEROS FIDO2 SECURITY KEY
The Cardputer as a real hardware passkey
Brand new and the headline of this release. The U2F and CTAP2 stacks are hand written on the ESP32-S3 and passed against Yubico's python-fido2 here, but it needs eyes on more machines, browsers, and real sites.
- Press
k from the root menu · confirm the KEY MODE prompt · ENTER to reboot into it
- Confirm the screen shows FIDO security key active and the PC sees a security key (Windows shows a
HID-compliant fido device; the browser offers a security key option)
- Register + sign in on a real site · GitHub (Settings → Passkeys / Security keys) or webauthn.io · approve with ENTER on the device
- Try a passkey: register a resident / discoverable credential where the site offers it, then sign in with no username
- Press
` to exit · confirm it reboots to normal and BadUSB + the serial port come back
Report: does the OS recognise it as a security key at all; do register and authenticate succeed; any USB weirdness switching in and out of key mode; whether BadUSB still works after you exit.
Known caveats: key mode reboots the device (FIDO must be the sole USB HID device). Adblockers can break webauthn.io, so use a real site or an incognito window. Local Windows account login is not FIDO reachable (Microsoft / Entra accounts only). PIN and user verification are Phase 3; today it is presence only (the ENTER press).
★ Priority 1 · C5 WEB FLASHER (just deployed)
End-to-end browser flash of a TRIDENT satellite
The flasher at /flash/ is the first time we've had a one-click install path for the ESP32-C5 satellite. esp-web-tools 10.2.1 on jsdelivr (the unpkg edge cache was serving an old bundle with no C5 support — that's now fixed). We need real-board confirmation.
- Open generaldussduss.github.io/poseidon/flash/ in Chrome / Edge / Opera
- Plug the C5 module directly via USB-C (not through the Cardputer)
- Click Install TRIDENT · pick the C5's COM port (NOT the Cardputer-Adv's)
- Confirm the flow: erase → bootloader (0x2000) → partition-table (0x8000) → app (0x10000) all green
- Boot it · pair it to a POSEIDON Cardputer ·
Radio → C5 → Status should show C5 x1 within a few seconds
Known gotcha: If "Failed to initialize" appears, hold the C5's BOOT (GPIO 9), tap RESET, release BOOT — then click Install. Some C5 dev boards lack auto-reset wiring.
★ Priority 2 · LoRa + Meshtastic full sweep
SX1262 stack on the CAP-LoRa1262 hat
LoRa is the band with the most surface area and the most regression risk — nine features touching the SX1262 driver, antenna-switch GPIO sequencing, HSPI-shared-with-SD, GNSS UART, and Meshtastic protobuf encoding. Hit each leaf and confirm none reboot the device.
- Attach the CAP-LoRa1262 hat with sky view (GPS needs it). Verify
System → About reports "Adv" board.
- LoRa → Scan · switch bands with TAB (433 / 868 / 915 / US LongFast) · each retune should be instant, no crash
- LoRa → Beacon · press TX · nearby SDR / Meshtastic device should see the packet
- LoRa → Analyzer · cycle Bar / Waterfall / Oscilloscope renders · "RX N" overlay should tick when real traffic is in range
- LoRa → Mesh Nodes · leave running ~2 min near Meshtastic activity (check meshmap.net) · roster should populate with real names, not garbage
- LoRa → Mesh Chat · press T, type, ENTER · message should appear on a phone Meshtastic app from POSEIDON's
!xxxxxxxx ID
- LoRa → Mesh Page · pick a node, send a DM · destination should receive direct, not broadcast
- LoRa → Mesh Pos · press T to toggle reporting · wait for GPS fix · you should appear as a pin on other apps
- LoRa → GPS Fix · live NMEA, baud auto-detect, sat count + HDOP
- Range test: from your house outward in increments, note last RX confirmed (RSSI/SNR in Analyzer) by band. Report in feet or meters.
Report: any feature that reboots, any band that doesn't retune, RX-works-TX-doesn't-or-vice-versa (encryption / header bug signal), nodes with garbage names (protobuf decode), position at wrong lat/lon (sfixed32 sign bug).
Known caveats: Leaf-only Meshtastic (we don't forward other nodes' packets). No CAD before TX (collides slightly more in dense mesh). NodeInfo broadcasts every 30 min regardless of Mesh Pos toggle.
Priority 3 · IR Samsung Smart Remote rebuild
Active-LOW LED + bit-bang carrier + full ~40-button layout
Every IR feature was silently no-op'ing. Two stacked bugs: GPIO 44 is UART0 RX by default and pinMode(OUTPUT) doesn't fully detach the matrix in Arduino-ESP32 v3 (fix: gpio_reset_pin), AND the Cardputer-Adv's IR LED is active-LOW which LEDC's output_invert can't handle correctly at duty=0 (fix: bit-bang the carrier in CPU). Plus the Samsung protocol byte order was NEC, not Samsung32. Plus TV-B-Gone was stealing the display backlight's LEDC channel.
- IR → LED Test · point a phone camera at the LED · step 2 (GPIO 44 inverted) should light it purple/white. Useful for verifying any board variant.
- IR → Remote against a Samsung TV · press
p for power, then u/d volume, m mute, c/v channels · no modifier keys should be required for any binding
- D-pad: press
; (up), . (down), , (left), / (right) · ENTER for OK · should navigate Samsung menus
- If power toggle (
p) doesn't respond, try o (discrete on) or q (discrete off). Modern Smart TVs sometimes ignore IR power.
- IR → TV-B-Gone at a busy TV wall · should cycle Sony / Samsung / LG / Panasonic / Philips / Vizio · display backlight should stay on (was blanking before the channel-3/timer-3 fix)
- IR → Clone · Samsung / LG / Sony preset profiles · basic vol+mute should work for each
Report: any button that doesn't fire IR (use the LED Test diag to confirm hardware first), any TV that responds to volume but not power (might be a model-specific Power code), and any other-brand TVs that the Samsung sender unexpectedly controls.
Priority 4 · WiFi Beacon Spam new path
Raw-IDF recipe replaces the Arduino path that crashed
The Arduino WiFi.softAP() crashed in ieee80211_hostap_attach (LoadProhibited, +0x2c null deref) on Bruce's pinned esp32-arduino-libs. New path: esp_bt_controller_mem_release → manual esp_netif + esp_wifi_init with shrunk dynamic bufs (16/16) → STA mode + promiscuous + raw esp_wifi_80211_tx on WIFI_IF_STA. Sustained ~1200 frames/sec.
- WiFi → Beacon spam → Meme · open WiFi scan on a phone · meme SSIDs (FREE WIFI - CLICK HERE, NSA Surveillance Van, etc.) should appear within a few seconds
- The scanner UI should show a KITT-style sweep header, live big SSID, fading 5-line recent feed, fps counter, and a hex stream · channel should rotate 1→11 once per full list pass
- Leave running 30+ seconds · uptime should keep ticking, no reboot
- Press ESC · should exit cleanly back to the menu with heap recovering to >50 KB
- Side effect to verify: after exiting Beacon Spam, BLE features won't work until reboot (BT memory was released to make room for WiFi). Confirm a fresh boot brings BLE back.
Report: phones that see < 5 SSIDs (range / RF environment issue), any feature that's opened AFTER Beacon Spam and fails (state leak), and whether Rickroll + Custom lists also work.
Priority 5 · TRIDENT 5 GHz operations
Once a C5 is flashed (P1), exercise the actual attacks
TRIDENT's job is the RF territory the S3 physically can't touch — 5 GHz WiFi, 802.15.4 Zigbee. The whole point of the C5 satellite. Each command rides ESP-NOW back to the Cardputer over channel 1.
- C5 → Scan · full dual-band scan · APs from both 2.4 + 5 GHz with auth column (WPA3 rows red)
- C5 → Deauth → broadcast on a 5 GHz channel you own · frames counter ticks · target reconnects
- C5 → PMKID · M1 capture against a 5 GHz AP · .22000 hashcat-format file on SD
- C5 → Zigbee sniff · channels 11-26 · pcap dump compatible with Wireshark
- After every C5 attack:
C5 → Status should still show the satellite present and pinned to channel 1 (so POSEIDON keeps hearing HELLOs)
Priority 6 · Regression sweep (broad surface)
Every menu leaf still enters without crashing
164 features. Hit each one once, even if just to enter and back out. Anything that crashes or reboots is a regression we want to know about now. Sub-GHz gets its full pass once the Hydra hat is on the bench.
- WiFi (17): Scan / Clients / Deauth / Deauth All / Detector / AP Clone / Evil Portal / Karma / Beacon Spam / Probe Sniff / PMKID / Spectrum / Wardrive / CIW / Connect
- BLE (16): Scan / Spam / Bad-KB / Tracker Detect / Tracker Finder / Sniffer / iBeacon / Clone / GATT / Flood / Karma / Sour Apple / Find My / Toys / Drone RID / WhisperPair
- Defensive (3): Surveillance Hunter, Defensive Monitor, SATCOM Tracker
- Sub-GHz (9): Scan / Spectrum / Brute / Jammer / Broadcast Library / Record / Replay / Finder / Jam Detect
- nRF24 (6): Sniffer / MouseJack / BLE spam / Spectrum / Jammer / Finder
- Network Attacks (18): Port Scan / Ping / DNS / Connect / Responder / SSDP / LAN Recon / UART Shell / Reverse TCP / Telnet HP / Dead Drop / Printer / SSDP Poison / DHCP Starve / Rogue DHCP / Hijack / WPAD / Autodiscover
- IR (4): TV-B-Gone / Remote / Clone / LED Test — covered separately in Priority 3
- Tools + System: Flashlight / Stopwatch / Dice / Morse / MAC Random / Calc / Screen Test / SD Format / Theme Picker / Ambient Preview / Carousel toggle / Screensaver settings