13

I'm concerned about storing my funds on this website. How can I know they are safe?

  • I read this topic to late.. My monero's where stolen from my account. I looged in with my private key, made a little payment and one hour later my total amount in monero's went gone. Stolen. And it wasn't me who did the payment. I mailed support but I didn't receice any reaction. SO BE WARNED. DONT use mymonero.com. – Cobus Bocktor May 24 '17 at 12:20
  • 1
    So either your Operating System is compromised or you have been on a phishing site claiming to be mymonero.com. That's not at all mymonero.com's fault but yours. – janowitz May 24 '17 at 16:16
  • 1
    sounds like you are a victim of a keylogger. mymonero doesn't have your spend key at all – samwellj May 24 '17 at 16:59
  • 1
    I'm not removing this post to keep it as a warning: Make sure your devices and systems are in a good shape when using cryptos! – Waqar Lim May 24 '17 at 18:24
15

The fact that it never gets access to the your private spend key. The workings of the site are explained here.

Your monero are "kept" on the blockchain and not on the site itself. The site is just an interface to tell the network you want to move your monero, where all the cryptography to spend the coins (using your private spend key to sign the transaction) is performed by your computer. By logging-in, you're giving the program (javascript code running locally on your browser) your secret spend key so it can do its magic.

However, it's important to note that the site does store one piece of information: your private view key. Because of this, the site can see all your incoming transaction and provide you with the convenience of having your balance visible immediately.

Possible attack vectors include:

  1. A hacker spoofing the site somehow, so you would load a different "program" (code running in your browser) which would steal your keys after you type in the mnemonic.
    • You could protect against this by always checking the correct site address and https certificate.
  2. A hacker hacking the site server, changing the program delivered to the users and being able to steal the keys of whomever logs in after that point
    • You could protect against this by inspecting the code of the site. Let's say you make a snapshot of the site, and copare the newly downloaded one vs the old one. Not very practical to do, though.
  3. Site owner going rogue and doing the same
  4. Key logger on your PC
  5. Browser extension malware
    • You could protect against this by disabling all addons/extensions ...

The important takeaways are:

  • If you have used the site in the past, and someone hacks it afterwards or the owner goes rogue, they won't be able to steal your funds.
  • Due to how it works, even if someone hacks the site, he would be able to steal only the funds of those who log in during the time the site is hacked
  • If the owner would go rogue, the word would soon go out. Highly unlikely considering the massive credibility of the current owner (one of core team).
  • Considering all above, it's recommended to keep larger amouts using simplewallet or cold storage. The site should be used for pocket money, like what you would normally keep in your physical wallet.
  • 3
    In other words every time you login mymonero.com you are playing dice, its a handy service but you can't be totally sure it won't be compromised ever, it has a solid record so far but I ask to everyone reading this to learn the basics of the Monero CLI wallet and transfer the bulk of your funds offline to a cold wallet. – user20 Sep 10 '16 at 17:24
  • 4
    Like I always tell people: treat it like you would your actual wallet. Do you walk around with $20 000 cash in your wallet? If so, then storing a few thousand XMR on MyMonero is for you! :-P – fluffyponyza Sep 11 '16 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.