3

xmr.to recommends to always use Tor or I2P to cover the ip address. I've tried to inform myself on that topic, but to be true it is to complicated for me. Is it right that, in the future, a possible Kovri implementation would solve that problem?

For now, do I really have to use Tor or I2P? Which steps would a vendor have to do to reveal my IP address to find out my identity? In which way could paying via mymonero until the Kovri implementation solve my problem?

I know these are noob questions, thank you in advance for explaining it as easily as possible.

|improve this question
4

If the vendor also runs a Monero node, and is currently connected to your own node, then their node will see your transaction being forwarded to their node.

If they set things up to keep track of IPs through which they seem transactions come in, they can determine which IP forwarded each transaction to them. This may or may not be the originating node (they'd have to be connected to every single node in order to determine which node is the originating one). But if they somehow were connected to the whole set of nodes, they could determine the originating node.

Now, most merchants aren't running a node. Most, in fact, accept Bitcoin, and accept Monero only due to paymene systems, shapeshift, xmr.to, or similar services.

Using mymonero would sidestep this, as the merchant's node would see the mymonero node's IP (or one of them, if mymonero uses several).

Using Tor or I2P negates this problem altogether.

Note: the above assumes you're using your own node. If you're using a public node, then the usual privacy guidelines matter: use Tor between your wallet and the public node, instead of between nodes.

|improve this answer
  • "But if they somehow were connected to the whole set of nodes, they could determine the originating node." What does that mean and what is the probability of this scenario? – ldtorre Jan 9 '17 at 18:27
  • I am using the GUI. So that means that to hide my ip I have to use tor or I2P. To be true I am a complete noob. What I have read is that 1st it is better to use I2P and that 2nd using tor or I2P can bring other vulnerabilities to the system if you don't know exactly what you are doing...which I don't. Is there any way to weighing up the need to use tor/I2P vs. the risk for noobs to use it? – ldtorre Jan 9 '17 at 18:29
  • This is the same as for Bitcoin, so you can look for issues to do with Bitcoin and IP linking. Probability it happens is... not much for now, but I know that, for Bitcoin, some company (or companies) are try to connect to as many node sas possible just for this purpose. As for dangers of I2P/Tor, IIRC Tor has a good overview of generic pitfalls in their FAQ (basically, don't do anything that might identify you while over Tor, ie don't use your name, connect to sites logging in as you, etc). – user36303 Jan 9 '17 at 18:48
2

I had missed the question earlier, sorry for late reply. I run xmr.to and the only reason we advise to connect to us via TOR is to protect your IP address from us knowing it. It has nothing to do with the vendor that anyway only receive BTC from us and never sees your IP whatsoever.

In other words:

  • There is nothing that links the vendor to you even if you do no use TOR.
  • If you do not trust us or the connection to us, use TOR to viste our website (or use our API) so we do not know your IP address.
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.