Questions tagged [security]

Security issues with the design or implementation of Monero and related crypto-currencies.

Filter by
Sorted by
Tagged with
2
votes
1answer
950 views

Difference between --rpc-bind-ip 0.0.0.0, or loopback, or actual IP

I run a node from home. I use --rpc-bind-ip as a daemon flag, with my internal/LAN IP address as the argument. With this setup, I can access my node from wallets on different computers inside my LAN....
4
votes
3answers
2k views

Trouble restoring FreeWallet account

Just after updating the FreeWallet app I lost my passwords book. The FreeWallet app is asking to restore my wallet. I've used the "email restore" option + "forgot password " but I never received the ...
1
vote
1answer
75 views

Should I keep monerod instances active on mining rigs?

Does it help the Monero network if I keep monerod instances active on different rigs? Or is it not useful?
9
votes
1answer
516 views

Are Confidential Transactions in Monero perfectly binding or hiding?

Bitcoin contributor Pieter Wuille recently commented on Reddit: Bulletproofs and the Pedersen commitments they operate on are perfectly hiding, but not perfectly binding. This roughly means that ...
2
votes
1answer
201 views

Is it easily provable by a third party that the key image used in a transaction is associated with the spent output without revealing the (P,I) pair?

What I'm getting at is I'd like to know how the Monero network can know that a key image used in a transaction is not either forged (probably an easy answer) or created from a different output owned ...
59
votes
3answers
8k views

How does Monero privacy and security compare to Zcash?

How does Monero privacy compare to Zcash? What are the key security risks associated with each design? Since important Monero improvements are in active development and Zcash has yet to launch, ...
23
votes
3answers
8k views

Does Monero have any mobile wallets available?

Mobile usage is growing very fast worldwide. Monero transactions should be easy to conduct from any device Does Monero have any Android or iOS wallets available? If there are no mobile wallets today,...
1
vote
0answers
52 views

Borromean signatures in monero commiting to an empty string?

In the codebase, the Borromean signatures to reduce the size of range proofs seem to sign an empty string,which is different from the paper by Maxwell et al. Is it true? Thanks for any answer.
3
votes
1answer
2k views

How can I change the wallet password?

I'm curious if there is a way to change the official CLI or GUI wallet password.
6
votes
1answer
400 views

Is CryptoNight the hash function which plays the role of the “random oracle”?

Is CryptoNight the hash function which plays the role of the "random oracle" in the random oracle model under which certain properties of CryptoNote are mathematically proven in the original paper? Or ...
27
votes
3answers
7k views

What are the primary differences between Monero and Bitcoin?

Addressing each of the following factors, what are the major differences between Monero and Bitcoin? Privacy (including any limitations privacy may have on auditability) Scaling (including blockchain ...
2
votes
0answers
202 views

2-factor authentication key format for Kraken

Does anyone know how to format the string that you type into the Google Authenticator app in order to generate 2FA codes for Kraken? For context, the following URL is highly relevant:— https://github....
11
votes
2answers
377 views

What type of security audits has Monero received?

What type of security audits has Monero received? Since this question already addressed cryptographic review of the Monero protocol, I am primarily interested in Monero source code and ...
3
votes
1answer
66 views

Backward compatibility and updates

The current plan is for bi-annual updates (hard forks) "for the forseeable future". What is the policy or plan for: Backward compatibility for existing daemons and wallet versions? For how long will ...
4
votes
1answer
137 views

Do multisig addresses share the same space as regular addresses and produce the same types of keys?

Let me word it another way. Can a normal Monero seed produce the same address as a multisig wallet? And, if so, would that mean that the private spend key generated by that wallet would be able to ...
18
votes
2answers
4k views

How do I use cold transaction signing?

Cold transaction signing was recently merged into master. How would one go about using it? For those who don't know, this feature allows you to: Create and export an unsigned transaction on an ...
4
votes
1answer
144 views

Proof of payment method comparison

How does the method of proofing a Monero payment following this pull request differ from the former process? Is revealing key derivation easier or more difficult than revealing the tx secret key? ...
4
votes
1answer
124 views

Drawbacks of running a RPC-enabled node

Besides increased resource requirements, why would someone not want to run a RPC node?
2
votes
0answers
133 views

Will the MyMonero app support Android versions older than 6.0 (Marshmallow)?

I understand that the Bitcoin Breadwallet only supports Android versions 6.0 and above because of its support for hardware encryption inside the device. With privacy and security being a core focus ...
6
votes
1answer
353 views

How to Connect a a Monero Wallet to a Monero-Based Website and How to Keep it Safe?

I'm hoping to create a Monero-based website based on the work by 'TheKoziTwo' (https://github.com/TheKoziTwo/xmr-integration). I'm nearing the end of the project and I'm now hoping to connect the ...
4
votes
2answers
208 views

Cryptonote bug question

Assume someone is exploiting DigitalNote, Dashcoin, or Bytecoin. Apparently, they could issue large amounts of those coins to manipulate that individual coin value. But what keeps them from ...
3
votes
1answer
241 views

Can someone spend my xmr if they steal my Wallet folder?

Assume they don't know anything about my password and seeds.If a hacker opens my windows account and copy the monero wallet folder,can they steal my monero coins?
7
votes
3answers
972 views

Can a One-Time public key be used for more than one payment?

If I understand correctly, every new payment will ideally have a different one-time public key for increased privacy. However, could a one-time public key receive Monero more than once (as in ...
3
votes
2answers
275 views

Is a mnemonic seed wallet just as secure (random)

I understand you can use a 24+1 word mnemonic seed to generate your 256 bit private key. Is the number of possibilties of the 24 words the same as the 256 bits? So: are there 2^255 possible 24 word ...
7
votes
7answers
641 views

What are the most secure options for backing up your mnemonic seed?

You can gpg encrypt a text file or write it down on a piece of paper, but what are other good options to secure your mnemonic seed? I want to hear your ideas :)
7
votes
2answers
983 views

How can we be sure that monero wallet addresses are unique?

This question is probably not necessarily limited to monero wallets, but I have been playing around with the Monero Offline Wallet Generator and wanted to know how anyone could ever be sure that a ...
5
votes
3answers
763 views

Is making a key image public equal to giving the monero in that output away?

So I read about proving your balance to an auditor, and someone suggested that you can share your view key, exposing all outputs that you received on that address. If you then give out all key images ...
15
votes
2answers
2k views

What is Monero's mechanism for defending against a double-spend attack?

The title says it all, but I want to frame the issue two ways, in hopes of a slightly more in-depth answer. With Bitcoin, the blockchain is transparent. In the "ordinary course of business" in the ...
7
votes
1answer
345 views

How can I spend coins if other people can't see my balance?

So I have 5 monero, but if nobody else can see my balance, how can I prove that these coins are in my posession, and that they have not been spent yet. I just fail to see how Monero can ensure that ...
6
votes
1answer
67 views

What is to stop an adversary from inserting malicious code through Monero's compiling software?

I know Monero typically uses things like the make command to compile its software, and I assume that these compilers are software themselves. What is to stop this compiling software from getting ...
4
votes
1answer
108 views

Do nodes authenticate other nodes for p2p purposes? (re: incoming connections)

What I'm getting at is... what happens if an attacker/bad actor/etc were to see that I'm running a node and that I'm allowing incoming connections? To what extent is my computer exposed by port ...
2
votes
1answer
87 views

Is Hybrid mobile wallet is as just secure than native

For example in the future we will be able to have an implementation that would allow a light wallet to connect to a remote server. Does a hybrid appp (e.g. Ionic ) is just safer than native? One good ...
70
votes
2answers
9k views

What advantages does Monero offer that are not provided by other cryptocurrencies?

What are the advantages provided by using Monero compared with other popular cryptocurrencies such as Bitcoin? Specifically, what unique features does Monero have relating to privacy, PoW security ...
6
votes
1answer
320 views

Monero wallet packet sniffing

I've been comparing the weaknesses of Monero and Bitcoin. Following from this about bitcoin packet sniffing. I'm just wondering what an attacker can do if he's on my LAN and can sniff packets on the ...
7
votes
3answers
1k views

How to change password on a wallet created with simplewallet?

I have created a wallet using simplewallet, but I am not satisfied with the password. How do I go about changing the password on the wallet? (I am running monero.linux.x64.v0-9-4-0)
5
votes
2answers
315 views

Does Monero implement voting of any sort?

Currencies like Etherium and Dash pride themselves on having implemented voting in their system so they could make changes faster than bitcoin. Where does Monero stand on this? Are there any ...
8
votes
1answer
90 views

A SHA-1 collision has been found. Does that mean the Monero repositories on Github can be compromised?

Git (and thus Github) relies on the SHA-1 hash function to guarantee that files can't be secretly changed. Now a collision has been found: two different files that produce the same hash. The ...
2
votes
1answer
387 views

Monero RPC over SSL for client and server

I am trying to setup an RPC connection between monerod and monero-wallet-cli over SSL. For monerod, the recommended way seems to be to use nginx as a reverse proxy and add SSL support there. How do I ...
23
votes
3answers
741 views

Monero private key collision

Assuming a properly working RNG what are the chances of creating a Monero private key that is identical to one created by someone else (it corresponds and controls funds sent to the same XMR address)? ...
8
votes
3answers
3k views

Is the GUI Safe for storing thousands of monero?

How safe is it to store 5,000 monero on the GUI? I know it's beta though others have stated that it is safe to store there.
11
votes
5answers
1k views

Can we practically compensate full nodes

Is it practical to compensate full nodes in the Monero network? The nodes that aren't mining The primary issue with non-Proof of Stake methods is the sybil attack, but requiring full nodes to already ...
3
votes
2answers
193 views

Gui wallet seed imported into mymonero web wallet.Any possible security risks?

I have a mymonero web wallet that has some moneros in it I recently downloaded the new GUI wallet and sent some monero to it from exchanges. The other day I went to the web wallet but I put in my seed ...
13
votes
3answers
636 views

Is there any way of changing the password of an existing wallet?

Let's assume that my wallet's password was compromised. Is there any way of changing the password or do i have to create a new wallet and transfer all the funds there?
2
votes
1answer
69 views

PoloniexTradeGUI trading application

What features does PoloniexTradeGUI offer? How does it secure login credentials? Have any Monero core team members reviewed the code?
9
votes
1answer
147 views

What are specific security threats to a Monero GUI?

As the release of the official Monero GUI approaches, I would like to ask the best ways to secure our systems against possible theft. Apart from keyloggers catching your mnemonic seed or password, I ...
2
votes
1answer
134 views

Features and security of new GUI compared to the command line wallet

For those that like the official command line wallet and are comfortable using it, is there any reason to switch to the GUI once released? Does the GUI contain any new features that the command line ...
15
votes
2answers
8k views

What is the safest method to create a Monero wallet for cold storage?

If I want to create a Monero wallet in the most secure manner possible, what are the best practices in doing so? Are there any written user guides or video demonstrations of this process?
2
votes
1answer
113 views

data stored in the wallet cache

According to the Wolfram Warptangent, Point Release 1 notes, there is now an expansion of the data stored in the wallet cache, including the GUI address book Is the new data being stored there ...
7
votes
1answer
294 views

Can I avoid Javascript poisoning when using MyMonero.com?

I read this from fluffyponyza regarding safety of his site MyMonero.com: There's simply no way I can control and guarantee the JavaScript delivery from the server to your computer, so you can be ...
4
votes
2answers
247 views

How is Monero's network less secure than Bitcoin?

How is Monero's network less secure than Bitcoin's network? Are there any plans in work to increase the security of Monero's network and will it ever match Bitcoin's network or surpass it?