Questions tagged [security]

Security issues with the design or implementation of Monero and related crypto-currencies.

Filter by
Sorted by
Tagged with
2
votes
1answer
79 views

Estimating anonymity set size?

Is there any way to at least estimate what kind of anonymity set a user would have after churning Monero X times assuming the anonymity set of each individual transaction is the ringsize (i.e. there ...
3
votes
1answer
46 views

Security model for new auto update feature in GUI v0.16.0.2 'Nitrogen Nebula'

What steps are taken to verify the binaries via the new GUI auto update feature? How does it compare to downloading the them and manually verifying the hash as GPG key as was required for previous ...
5
votes
2answers
578 views

Security differences between using Monero on PureOS and QubesOS

The new Librem laptops available for purchase with Monero offer an option to add a QubesOS operating system to any order. For Monero use exclusively, what are the security differences between PureOS ...
0
votes
1answer
29 views

I sent a transaction and it gave me an error then went through

I was sending some XMR using XMR.to XMR.to gave me the address to send to in my monero wallet. The monero wallet went white and started thinking. It took along time. Then I'm not real clear on what ...
1
vote
1answer
85 views

Is there any evidence of Bitcoin being “Tainted”?

Monero claims to be fungible, meaning every XMR is worth the same as another XMR. But I've also people say this isn't true about Bitcoin - and that Bitcoin can be tainted. Is there any evidence of ...
5
votes
1answer
155 views

Securely funding a Monero physical coin

Assume that someone who ordered a physical coin from smoothie either: Lost the funding instructions Received the instructions but wants to verify them in case they were replaced in a MITM attack ...
14
votes
2answers
89 views

What security risks are associated with accepting Instant Transactions?

If a merchant decides to accept a Monero payment the moment it appears in the memory pool (before confirmation) what risks are being assumed? Based on the probability of these risks being exploited, ...
0
votes
1answer
35 views

What sort of deanonimization attack could someone controlling the majority of nodes pull off?

In the era of Docker containers and how easy it is to spin up potentially thousands of nodes in a minute, what kind of attack could some malicious actor pull off if they performed this? Would ...
0
votes
0answers
31 views

How was the official Monero website hacked to deliver malware at the end of 2019?

According to arstechnica, on November 18th 2019 the official Monero website was hacked to deliver compromised binaries. Is any information available on how this attack occurred? Was it the website ...
0
votes
1answer
59 views

Does the Monero executable for Windows not have a code signing certificate?

I was getting really nervous about using the Monero wallet. It seemed like the download page was ww.getmonero.org/downloads, which I thought was weird. Additionally, the executable for Windows wasn't ...
27
votes
1answer
330 views

How would Monero verify transactions on a 2-way pegged sidechain?

From my understanding, in order to retrieve tokens on a side-chain, you would have to send your XMR to some address that would then be unlocked when you burn the side-chain tokens. How could Monero ...
0
votes
0answers
38 views

Understanding a security proof of RingCT 3.0

I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions....
0
votes
2answers
885 views

How to set up password on xmrpool.net mining pool?

I'm new to mining and I don't know how to set up a password and a username on xmrpool.net mining pool. Can anyone help me to do this?
15
votes
2answers
3k views

What is Monero's mechanism for defending against a double-spend attack?

The title says it all, but I want to frame the issue two ways, in hopes of a slightly more in-depth answer. With Bitcoin, the blockchain is transparent. In the "ordinary course of business" in the ...
6
votes
2answers
428 views

Why does Monero use a 256 bit seed?

Apparently, ECC 256 bit keys have a bit strength of 128 bits. See https://crypto.stackexchange.com/questions/26791/how-many-bits-of-entropy-does-an-elliptic-curve-key-of-length-n-provide And ...
2
votes
1answer
141 views

Does using a remote node compromise the whole wallet?

If I'm using Tails and I use a remote node, does that compromise the whole wallet at some point in the future? For example, can the node determine my Monero wallet address or identify my wallet ...
0
votes
1answer
91 views

Monero transfer privacy

If I want a transaction to be private, is it safe to follow a path like: Coinbase > MorphToken (using Windows) > Official Monero (using Tails) > destination
0
votes
1answer
47 views

Would an attacker knowing the block-heights of my wallet's transactions weaken my privacy/security?

Let's say I'd go through all the transactions in my wallet, write down their block-heights and store this list somewhere insecure. Could my privacy or security be compromised by this in any way (...
1
vote
1answer
64 views

Will the Multisig Messaging System improve Monero security and performance?

I'm trying to understand the incoming MMS (Multisig Messaging System) in Monero. Reading the MMS User Manual, I am thinking that MMS could improve both the security and performance in the next Monero ...
9
votes
1answer
149 views

How is code reliability improved?

It seems that blockchain code written in C++ is prone to obscure but serious bugs such as recently seen in Zcoin. I know that rewriting Monero in a safer language is not practical in the short-term, ...
6
votes
1answer
111 views

How was the generator H for the RingCT scheme chosen?

I'm reading the RingCT whitepaper by Shen Noether. The scheme requires a second random generator H such that its discrete logarithm w.r.t. G is not known. Paragraph 3.2 suggests two variants to ...
1
vote
0answers
133 views

Why did I get an 'using an untrusted daemon' warning?

I'm running a full node and I followed every security step to set up the node on my computer. Everything was going great until today when I realized that a view-only wallet created the day before was ...
1
vote
1answer
73 views

Should I use a hardware wallet?

I hear a lot about hardware wallets and I would like to know if, in terms of security and functionality, it makes sense to switch to one of them. Thanks in advance for answers.
2
votes
1answer
1k views

Is it safe to use a remote node?

I started using Monero from now and my laptop takes a lot of time to download the blockchain. Also, my SSD is small and nearly full. I was reading about the use of a remote node to sync my wallet, ...
6
votes
1answer
638 views

Is Monero in I2P secure now, and how do I do it?

First I'd like to say I love this project and I wanna support it and use it as best I can, but I'm a little bad with computers, and with English, so please excuse me. I am interested to set a Monero ...
1
vote
1answer
44 views

Suspicious connections - Having issues with the GUI under Debian by connection to a public remote node - PC hangs

Having a Windows client with local node - works perfect. When trying to connect with the Debian client to a remote node (eu.node.moneroworld.com at port 18089) the pc hangs immediately and cinnamon ...
1
vote
1answer
242 views

Does Monero (XMR) or Pirate (ARRR) offer better privacy and security?

I have read several comparisons between Monero and Pirate. Can someone please explain to me the objective pros and cons about their privacy offerings? Is one more secure than the other? What are the ...
2
votes
1answer
53 views

Migrating Monero Fork from Test to Production

When migrating from Test to Production of a Monero Fork, what needs to be considered? For example, launching the Seed Nodes in "--restricted-rpc" mode.
1
vote
1answer
40 views

Is it okay to host a node that connects on the clearnet?

There is some concern in regulatory bodies about governing Monero in the future. Does this have implications for people hosting nodes at home on personal computers and connecting on the clearnet, ...
7
votes
2answers
753 views

How do full nodes vs miners secure the network differently?

If I run a full node I am supposedly contributing to network security by keeping a copy of the blockchain If I mine (via pool or solo) I contribute to the network through verification of blocks How ...
2
votes
1answer
2k views

Can I run monero desktop wallet over Tor?

Can I use desktop version of monero wallet https://getmonero.org/downloads/ over Tor ? I read Web version mymonero.com is rejecting Tor connections. Does desktop wallet work over Tor ?
1
vote
1answer
93 views

Offline Signing 2/3 Multisig

Interested in weather offline signing for 2/3 Multisig wallets is possible in this setup. I have three computers Airgapped from the internet, and a USB. I imagine i can pull down some outputs for ...
1
vote
1answer
45 views

Backup and Disaster Recovery for Monero Fork

For a clone of Monero in a production environment, what files/directories to be backed up and and what intervals?
1
vote
1answer
66 views

Mitigating Risks of Forking Monero

When Forking Monero on GitHub, the code base becomes a public repository. The benefit of Forking as opposed to cloning into a private repository is that the link to the original code base is ...
15
votes
2answers
4k views

How can individuals safeguard themselves and the community against a key reusing fork?

Regardless of the true intention behind the MoneroV developers, it forking off the existing Monero blockchain poses danger to the privacy of Monero users. While the MoneroV forking date has been put ...
0
votes
1answer
68 views

lost my phone with 2FA code

I lost my phone, so I lost my 2FA code too. Now I have new phone and I cant to login to the my wallet in step 2. where I need to get 2FA code from Authenticator. I am using Monero app on iphone. I ...
2
votes
1answer
142 views

What is an airdrop attack?

I just came across this thread on Twitter discussing Zcash and Monero usage in Dark-Net Markets. This quote bothers me: too much risk that an "airdrop attack" deanonymizes a chain like ...
5
votes
1answer
442 views

Pin Entropy of Trezor versus Ledger Nano S

There have been discussions of adding hardware support for Monero, specifically for Trezor and Ledger wallet. How much more entropy does a 9 digit pin (Trezor) offer compared to a 4 digit pin (Ledger ...
4
votes
1answer
90 views

Kovri operational security example(s) - file permissions

The Kovri User Guide has a Step 2. (Recommended) Operational security. It is currently as follows: Consider creating a designated kovri user and run kovri only using that user If using Linux, ...
0
votes
2answers
134 views

SSL usage in Sumokoin/Monero

There is this merge: https://github.com/sumoprojects/sumokoin/pull/63 that enables SSL for Sumokoin (can be used also for Monero). What is it used for? I guess For SSL communication between RPC-...
0
votes
1answer
542 views

monerov windows wallet gui.exe showing up as Trojan

Why is moneorv windows wallet gui.exe being quarantined as Trojan.BitCoinMiner by malwarebytes ?
15
votes
2answers
4k views

What is MoneroV, and how is it different than Monero?

I have heard of an upcoming airdrop called MoneroV. Can someone explain the relationship between Monero and MoneroV, and explain their differences?
1
vote
0answers
53 views

Improvements on generating monero wallets securely?

My current process of generating monero wallets: Use an air-gapped RaspberryPi Use monero-wallet-cli to generate a wallet Record mnemonic on paper only Record partial address for reference on paper (...
0
votes
1answer
176 views

Monero Gui didn't create .keys file for wallet, it crashed, wasn't able to restore wallet, is it lost?

My Monero Gui was freezing every 10 seconds when I clicked on it so I just killed the process, after trying to reopen multiple times I killed the monerod daemon process as well When opening again the ...
3
votes
1answer
122 views

Where can I find the random public key R=rG in a Tx?

I've read the white paper of Monero(CryptoNote v2.0) and a problem confuses me. This paper says that when Alice sends coin to Bob, she uses P = Hs(rA)G + B as a destination key and packs value R = rG ...
7
votes
1answer
219 views

Connecting Kovri through a VPN vs using Kovri directly

In terms of privacy and security what are the differences between to connecting Kovri through a VPN compared running Kovri directly? Would home, business or VPS IP addresses be better protected if a ...
1
vote
2answers
64 views

Why AVs reject miners?

I have been trying to install miners on my windows, but mostly detected as a threat by AVs. Why are most of the miners blocked by Antivirus programs? Is there any miner which has no problem with ...
1
vote
1answer
61 views

Will there be security vulnerable if you left your wallet address and password in public?

So usually we got no password or x as password but my wallet got an password but since usually there isn't a password for wallet I'm wondering if I left my wallet address and its password in public ...
10
votes
1answer
373 views

How does TumbleBit privacy and security compare with Monero?

How would a Bitcoin implementation of a TumbleBit payment hub compare with Monero? What are the important differences between the two in the areas of privacy and security?
6
votes
1answer
229 views

Can a remote node know my wallet address?

When I connect my wallet to a remote node, does it know my wallet address? What information about a connecting wallet is revealed to the remote node?