Questions tagged [security]

Security issues with the design or implementation of Monero and related crypto-currencies.

Filter by
Sorted by
Tagged with
3
votes
1answer
70 views

Backward compatibility and updates

The current plan is for bi-annual updates (hard forks) "for the forseeable future". What is the policy or plan for: Backward compatibility for existing daemons and wallet versions? For how long will ...
4
votes
1answer
138 views

Do multisig addresses share the same space as regular addresses and produce the same types of keys?

Let me word it another way. Can a normal Monero seed produce the same address as a multisig wallet? And, if so, would that mean that the private spend key generated by that wallet would be able to ...
4
votes
1answer
146 views

Proof of payment method comparison

How does the method of proofing a Monero payment following this pull request differ from the former process? Is revealing key derivation easier or more difficult than revealing the tx secret key? ...
2
votes
0answers
136 views

Will the MyMonero app support Android versions older than 6.0 (Marshmallow)?

I understand that the Bitcoin Breadwallet only supports Android versions 6.0 and above because of its support for hardware encryption inside the device. With privacy and security being a core focus ...
6
votes
1answer
355 views

How to Connect a a Monero Wallet to a Monero-Based Website and How to Keep it Safe?

I'm hoping to create a Monero-based website based on the work by 'TheKoziTwo' (https://github.com/TheKoziTwo/xmr-integration). I'm nearing the end of the project and I'm now hoping to connect the ...
4
votes
2answers
210 views

Cryptonote bug question

Assume someone is exploiting DigitalNote, Dashcoin, or Bytecoin. Apparently, they could issue large amounts of those coins to manipulate that individual coin value. But what keeps them from ...
3
votes
1answer
243 views

Can someone spend my xmr if they steal my Wallet folder?

Assume they don't know anything about my password and seeds.If a hacker opens my windows account and copy the monero wallet folder,can they steal my monero coins?
3
votes
2answers
287 views

Is a mnemonic seed wallet just as secure (random)

I understand you can use a 24+1 word mnemonic seed to generate your 256 bit private key. Is the number of possibilties of the 24 words the same as the 256 bits? So: are there 2^255 possible 24 word ...
7
votes
3answers
1k views

Can a One-Time public key be used for more than one payment?

If I understand correctly, every new payment will ideally have a different one-time public key for increased privacy. However, could a one-time public key receive Monero more than once (as in ...
5
votes
3answers
777 views

Is making a key image public equal to giving the monero in that output away?

So I read about proving your balance to an auditor, and someone suggested that you can share your view key, exposing all outputs that you received on that address. If you then give out all key images ...
7
votes
1answer
347 views

How can I spend coins if other people can't see my balance?

So I have 5 monero, but if nobody else can see my balance, how can I prove that these coins are in my posession, and that they have not been spent yet. I just fail to see how Monero can ensure that ...
6
votes
1answer
68 views

What is to stop an adversary from inserting malicious code through Monero's compiling software?

I know Monero typically uses things like the make command to compile its software, and I assume that these compilers are software themselves. What is to stop this compiling software from getting ...
4
votes
3answers
2k views

Trouble restoring FreeWallet account

Just after updating the FreeWallet app I lost my passwords book. The FreeWallet app is asking to restore my wallet. I've used the "email restore" option + "forgot password " but I never received the ...
4
votes
1answer
111 views

Do nodes authenticate other nodes for p2p purposes? (re: incoming connections)

What I'm getting at is... what happens if an attacker/bad actor/etc were to see that I'm running a node and that I'm allowing incoming connections? To what extent is my computer exposed by port ...
2
votes
1answer
88 views

Is Hybrid mobile wallet is as just secure than native

For example in the future we will be able to have an implementation that would allow a light wallet to connect to a remote server. Does a hybrid appp (e.g. Ionic ) is just safer than native? One good ...
9
votes
1answer
146 views

How is code reliability improved?

It seems that blockchain code written in C++ is prone to obscure but serious bugs such as recently seen in Zcoin. I know that rewriting Monero in a safer language is not practical in the short-term, ...
6
votes
1answer
325 views

Monero wallet packet sniffing

I've been comparing the weaknesses of Monero and Bitcoin. Following from this about bitcoin packet sniffing. I'm just wondering what an attacker can do if he's on my LAN and can sniff packets on the ...
2
votes
1answer
409 views

Monero RPC over SSL for client and server

I am trying to setup an RPC connection between monerod and monero-wallet-cli over SSL. For monerod, the recommended way seems to be to use nginx as a reverse proxy and add SSL support there. How do I ...
8
votes
1answer
91 views

A SHA-1 collision has been found. Does that mean the Monero repositories on Github can be compromised?

Git (and thus Github) relies on the SHA-1 hash function to guarantee that files can't be secretly changed. Now a collision has been found: two different files that produce the same hash. The ...
7
votes
1answer
208 views

Connecting Kovri through a VPN vs using Kovri directly

In terms of privacy and security what are the differences between to connecting Kovri through a VPN compared running Kovri directly? Would home, business or VPS IP addresses be better protected if a ...
3
votes
2answers
195 views

Gui wallet seed imported into mymonero web wallet.Any possible security risks?

I have a mymonero web wallet that has some moneros in it I recently downloaded the new GUI wallet and sent some monero to it from exchanges. The other day I went to the web wallet but I put in my seed ...
8
votes
3answers
3k views

Is the GUI Safe for storing thousands of monero?

How safe is it to store 5,000 monero on the GUI? I know it's beta though others have stated that it is safe to store there.
4
votes
1answer
128 views

Drawbacks of running a RPC-enabled node

Besides increased resource requirements, why would someone not want to run a RPC node?
4
votes
1answer
129 views

Securely funding a Monero physical coin

Assume that someone who ordered a physical coin from smoothie either: Lost the funding instructions Received the instructions but wants to verify them in case they were replaced in a MITM attack ...
2
votes
1answer
70 views

PoloniexTradeGUI trading application

What features does PoloniexTradeGUI offer? How does it secure login credentials? Have any Monero core team members reviewed the code?
2
votes
1answer
140 views

Features and security of new GUI compared to the command line wallet

For those that like the official command line wallet and are comfortable using it, is there any reason to switch to the GUI once released? Does the GUI contain any new features that the command line ...
2
votes
1answer
116 views

data stored in the wallet cache

According to the Wolfram Warptangent, Point Release 1 notes, there is now an expansion of the data stored in the wallet cache, including the GUI address book Is the new data being stored there ...
5
votes
1answer
430 views

Pin Entropy of Trezor versus Ledger Nano S

There have been discussions of adding hardware support for Monero, specifically for Trezor and Ledger wallet. How much more entropy does a 9 digit pin (Trezor) offer compared to a 4 digit pin (Ledger ...
7
votes
1answer
295 views

Can I avoid Javascript poisoning when using MyMonero.com?

I read this from fluffyponyza regarding safety of his site MyMonero.com: There's simply no way I can control and guarantee the JavaScript delivery from the server to your computer, so you can be ...
7
votes
2answers
991 views

How can we be sure that monero wallet addresses are unique?

This question is probably not necessarily limited to monero wallets, but I have been playing around with the Monero Offline Wallet Generator and wanted to know how anyone could ever be sure that a ...
5
votes
2answers
317 views

Does Monero implement voting of any sort?

Currencies like Etherium and Dash pride themselves on having implemented voting in their system so they could make changes faster than bitcoin. Where does Monero stand on this? Are there any ...
4
votes
2answers
251 views

How is Monero's network less secure than Bitcoin?

How is Monero's network less secure than Bitcoin's network? Are there any plans in work to increase the security of Monero's network and will it ever match Bitcoin's network or surpass it?
4
votes
0answers
212 views

Security risk due to bad random number generator when creating transactions

I've noticed such risk mentioned in this answer to another question, where a presentation (page 28) by Nicolas T. Courtois, studying Monero cryptography, was referred to. I'm interested to better ...
11
votes
2answers
380 views

What type of security audits has Monero received?

What type of security audits has Monero received? Since this question already addressed cryptographic review of the Monero protocol, I am primarily interested in Monero source code and ...
9
votes
1answer
3k views

How does Monero privacy and security compare to ZCoin?

How does Monero (XMR) privacy compare to ZCoin (XZC)? Can ZCoin protect the privacy of transaction amounts like Monero will do with RingCT, or are ZCoin transaction amounts visible similar to Monero ...
5
votes
1answer
64 views

What is novault and what is its connection to Monero?

What is the primary purpose of novault? Is it safe to use? Is the tool meant to be used just Monero or does it had wider applications?
10
votes
1answer
359 views

How does TumbleBit privacy and security compare with Monero?

How would a Bitcoin implementation of a TumbleBit payment hub compare with Monero? What are the important differences between the two in the areas of privacy and security?
7
votes
1answer
148 views

Issue with unforgeability proof of ASNL in RingCT paper

In the RingCT paper, proof of theorem 5.1 (The Aggregate Schnorr Non-linkable ring signature is unforgeable under the discrete logarithm assumption), it is assumed by contradiction that there exists ...
4
votes
2answers
162 views

If I'm running a full node and wallet on my local network can someone get my wallet information?

If someone connected to my WIFI could they get information about my wallet or steal from me?
9
votes
1answer
475 views

Is it possible for an adversary to shut Monero down?

Imagine a government wants to ban XMR. Is it possible for them to do so? Only possible options, nothing like turning off the internet. And if it is possible, what could be done against that? Thank ...
70
votes
2answers
10k views

What advantages does Monero offer that are not provided by other cryptocurrencies?

What are the advantages provided by using Monero compared with other popular cryptocurrencies such as Bitcoin? Specifically, what unique features does Monero have relating to privacy, PoW security ...
7
votes
5answers
448 views

Does having a separated daemon add security risks to Monero?

For example, what if someone created malware to get in between the two programs (wallet and daemon), pretending to be the daemon and logging all the info before sending it along to the real daemon? I ...
10
votes
4answers
785 views

Is a Monero key backdoor possible?

Recently an article was published stating the possibility of the NSA or some other malicious organization creating backdoor undetectable Diffie-Hellman keys (source) to allow snooping. Is Monero at ...
18
votes
2answers
4k views

How do I use cold transaction signing?

Cold transaction signing was recently merged into master. How would one go about using it? For those who don't know, this feature allows you to: Create and export an unsigned transaction on an ...
15
votes
2answers
3k views

What is Monero's mechanism for defending against a double-spend attack?

The title says it all, but I want to frame the issue two ways, in hopes of a slightly more in-depth answer. With Bitcoin, the blockchain is transparent. In the "ordinary course of business" in the ...
17
votes
1answer
362 views

Can Kovri be blocked in e.g. China?

And if so, is there a way around it with something like the meek pluggable transport from the Tor project?
13
votes
3answers
645 views

Is there any way of changing the password of an existing wallet?

Let's assume that my wallet's password was compromised. Is there any way of changing the password or do i have to create a new wallet and transfer all the funds there?
4
votes
1answer
84 views

Code that checks for 'rogue block'

I read recently about, for lack of a better term, a rogue block that was recorded into the blockchain that forked the chain but it didn't split exactly. I read that there is some code in later ...
2
votes
2answers
191 views

Monero Wallet with Key File

I have been using KeePass password manager, and one option for login is a password + a key file. Would it be possible to incorporate this layer of protection to monero-wallet-cli as a safer ...
4
votes
2answers
782 views

How to Properly Generate a Monero Brain Wallet?

I remember reading somewhere, I think it was fluffypony mentioning one could use for example words from a letter to a loved one seed for a Monero wallet. But from playing with https://xmr.llcoins.net/...