Questions tagged [security]

Security issues with the design or implementation of Monero and related crypto-currencies.

Filter by
Sorted by
Tagged with
6
votes
1answer
68 views

What is to stop an adversary from inserting malicious code through Monero's compiling software?

I know Monero typically uses things like the make command to compile its software, and I assume that these compilers are software themselves. What is to stop this compiling software from getting ...
6
votes
1answer
216 views

Can a remote node know my wallet address?

When I connect my wallet to a remote node, does it know my wallet address? What information about a connecting wallet is revealed to the remote node?
6
votes
1answer
404 views

Is CryptoNight the hash function which plays the role of the “random oracle”?

Is CryptoNight the hash function which plays the role of the "random oracle" in the random oracle model under which certain properties of CryptoNote are mathematically proven in the original paper? Or ...
6
votes
1answer
355 views

How to Connect a a Monero Wallet to a Monero-Based Website and How to Keep it Safe?

I'm hoping to create a Monero-based website based on the work by 'TheKoziTwo' (https://github.com/TheKoziTwo/xmr-integration). I'm nearing the end of the project and I'm now hoping to connect the ...
6
votes
2answers
400 views

Why does Monero use a 256 bit seed?

Apparently, ECC 256 bit keys have a bit strength of 128 bits. See https://crypto.stackexchange.com/questions/26791/how-many-bits-of-entropy-does-an-elliptic-curve-key-of-length-n-provide And ...
6
votes
0answers
130 views

Can we use Coinshuffle++ insights to improve privacy in relaying Monero transactions? [closed]

Coinshuffle is a communication protocol that allows for a number of peers to privately collaborate in making a Bitcoin coinjoin transaction in such a way that they all provide their addresses for the ...
5
votes
3answers
776 views

Is making a key image public equal to giving the monero in that output away?

So I read about proving your balance to an auditor, and someone suggested that you can share your view key, exposing all outputs that you received on that address. If you then give out all key images ...
5
votes
1answer
95 views

LMDB conversion vs downloading from scratch

What are the speed and security differences between a pre LMDB (0.8.6) to LMDB (0.9.4) conversion vs syncing the blockchain from scratch? I have a Linux Ubuntu desktop with 8GB RAM a 512 GM SSD and a ...
5
votes
2answers
317 views

Does Monero implement voting of any sort?

Currencies like Etherium and Dash pride themselves on having implemented voting in their system so they could make changes faster than bitcoin. Where does Monero stand on this? Are there any ...
5
votes
1answer
94 views

What potential security risks are associated with sharing my view key?

Is it safe to share my view key with my accountant or business partner? Can a view key be used to steal my funds?
5
votes
1answer
182 views

Hard Fork Replay Attacks? [duplicate]

When the Ethereum fork happened a few months ago, users were cautioned to protect against so called "replay attacks". A replay attack, as far as i understand it, is when a transaction occurs on one ...
5
votes
1answer
186 views

If I have a vanity address does it decrease my wallets security?

I've seen some people with vanity Monero addresses like 43COINxxxxxx. Does having a vanity address like this increase its susceptibility to getting cracked and view/spend keys getting found?
5
votes
1answer
640 views

When will KeepKey support Monero? [closed]

I asked this of keepkey about a year ago and I only have gotten a standard response saying they are evaluating the support of alts. Is anyone aware of progress made to support Monero?
5
votes
1answer
562 views

Is Monero in I2P secure now, and how do I do it?

First I'd like to say I love this project and I wanna support it and use it as best I can, but I'm a little bad with computers, and with English, so please excuse me. I am interested to set a Monero ...
5
votes
1answer
90 views

What technique(s) should be used to secure funds in my wallet(s)?

So I know that there might not be a straight forward answer besides having a cold and hot wallet available that you can access with your own daemon and simplewallet. But I feel like there might be ...
5
votes
1answer
302 views

Is the entropy for the mnemonic seed and the private spend key exactly the same?

Since one is just another representation of the other, is the entropy for the mnemonic seed and the private spend key exactly the same? Are there any security benefits of using one over the other for ...
5
votes
1answer
64 views

What is novault and what is its connection to Monero?

What is the primary purpose of novault? Is it safe to use? Is the tool meant to be used just Monero or does it had wider applications?
5
votes
1answer
88 views

Can I enter a password & wallet file name through JsonRPC?

This would be the ideal circumstance for programming monero-wallet-cli - however, this raises the same concern that running the client with the password supplied via an argument monero-wallet-cli --...
5
votes
1answer
430 views

Pin Entropy of Trezor versus Ledger Nano S

There have been discussions of adding hardware support for Monero, specifically for Trezor and Ledger wallet. How much more entropy does a 9 digit pin (Trezor) offer compared to a 4 digit pin (Ledger ...
4
votes
3answers
2k views

Trouble restoring FreeWallet account

Just after updating the FreeWallet app I lost my passwords book. The FreeWallet app is asking to restore my wallet. I've used the "email restore" option + "forgot password " but I never received the ...
4
votes
2answers
251 views

How is Monero's network less secure than Bitcoin?

How is Monero's network less secure than Bitcoin's network? Are there any plans in work to increase the security of Monero's network and will it ever match Bitcoin's network or surpass it?
4
votes
2answers
210 views

Cryptonote bug question

Assume someone is exploiting DigitalNote, Dashcoin, or Bytecoin. Apparently, they could issue large amounts of those coins to manipulate that individual coin value. But what keeps them from ...
4
votes
2answers
162 views

If I'm running a full node and wallet on my local network can someone get my wallet information?

If someone connected to my WIFI could they get information about my wallet or steal from me?
4
votes
2answers
782 views

How to Properly Generate a Monero Brain Wallet?

I remember reading somewhere, I think it was fluffypony mentioning one could use for example words from a letter to a loved one seed for a Monero wallet. But from playing with https://xmr.llcoins.net/...
4
votes
1answer
146 views

Proof of payment method comparison

How does the method of proofing a Monero payment following this pull request differ from the former process? Is revealing key derivation easier or more difficult than revealing the tx secret key? ...
4
votes
1answer
295 views

Cold transaction signing with GUI

Is it possible to safely complete a cold transaction signing process with the official GUI instead of the CLI process described here?
4
votes
1answer
84 views

How was the generator H for the RingCT scheme chosen?

I'm reading the RingCT whitepaper by Shen Noether. The scheme requires a second random generator H such that its discrete logarithm w.r.t. G is not known. Paragraph 3.2 suggests two variants to ...
4
votes
1answer
138 views

Do multisig addresses share the same space as regular addresses and produce the same types of keys?

Let me word it another way. Can a normal Monero seed produce the same address as a multisig wallet? And, if so, would that mean that the private spend key generated by that wallet would be able to ...
4
votes
1answer
111 views

Do nodes authenticate other nodes for p2p purposes? (re: incoming connections)

What I'm getting at is... what happens if an attacker/bad actor/etc were to see that I'm running a node and that I'm allowing incoming connections? To what extent is my computer exposed by port ...
4
votes
1answer
84 views

Code that checks for 'rogue block'

I read recently about, for lack of a better term, a rogue block that was recorded into the blockchain that forked the chain but it didn't split exactly. I read that there is some code in later ...
4
votes
1answer
88 views

Kovri operational security example(s) - file permissions

The Kovri User Guide has a Step 2. (Recommended) Operational security. It is currently as follows: Consider creating a designated kovri user and run kovri only using that user If using Linux, ...
4
votes
1answer
128 views

Drawbacks of running a RPC-enabled node

Besides increased resource requirements, why would someone not want to run a RPC node?
4
votes
1answer
427 views

Security differences between using Monero on PureOS and QubesOS

The new Librem laptops available for purchase with Monero offer an option to add a QubesOS operating system to any order. For Monero use exclusively, what are the security differences between PureOS ...
4
votes
1answer
129 views

Securely funding a Monero physical coin

Assume that someone who ordered a physical coin from smoothie either: Lost the funding instructions Received the instructions but wants to verify them in case they were replaced in a MITM attack ...
4
votes
0answers
212 views

Security risk due to bad random number generator when creating transactions

I've noticed such risk mentioned in this answer to another question, where a presentation (page 28) by Nicolas T. Courtois, studying Monero cryptography, was referred to. I'm interested to better ...
3
votes
1answer
292 views

TLS and authentication for RPC

TLS and authentication for RPC has been completed in the Monero dev branch for quite some time. Has it been reworked to fully address any conflicts with net_skeleton's license so that it will be ready ...
3
votes
1answer
1k views

Difference between --rpc-bind-ip 0.0.0.0, or loopback, or actual IP

I run a node from home. I use --rpc-bind-ip as a daemon flag, with my internal/LAN IP address as the argument. With this setup, I can access my node from wallets on different computers inside my LAN....
3
votes
2answers
287 views

Is a mnemonic seed wallet just as secure (random)

I understand you can use a 24+1 word mnemonic seed to generate your 256 bit private key. Is the number of possibilties of the 24 words the same as the 256 bits? So: are there 2^255 possible 24 word ...
3
votes
2answers
195 views

Gui wallet seed imported into mymonero web wallet.Any possible security risks?

I have a mymonero web wallet that has some moneros in it I recently downloaded the new GUI wallet and sent some monero to it from exchanges. The other day I went to the web wallet but I put in my seed ...
3
votes
1answer
90 views

Where can I find the random public key R=rG in a Tx?

I've read the white paper of Monero(CryptoNote v2.0) and a problem confuses me. This paper says that when Alice sends coin to Bob, she uses P = Hs(rA)G + B as a destination key and packs value R = rG ...
3
votes
1answer
53 views

When using a foreign remote node does the transaction signing happen on my wallet or on the node?

I don't understand the architecture of Monero wallet(s) - on OSX or on Android. When I choose not to run my own full node/daemon and use (foreign) remote node instead, how does the security of ...
3
votes
1answer
2k views

How can I change the wallet password?

I'm curious if there is a way to change the official CLI or GUI wallet password.
3
votes
1answer
243 views

Can someone spend my xmr if they steal my Wallet folder?

Assume they don't know anything about my password and seeds.If a hacker opens my windows account and copy the monero wallet folder,can they steal my monero coins?
3
votes
1answer
72 views

How could you lower the risk of accepting zero confirmation transactions?

As far as I heard monero nodes don't add double spent tx to their txpool (source), so if I connect to enough nodes it should be possible to lower the risk of a double spend attack right? (I could also ...
3
votes
1answer
521 views

How to setup own remote Monero node with maximum security / anonymity?

I'm interested in setting up my own remote monero node for personal use on a home computer running OSX. According to this guide all I need to do is setup an SSH-connection with a command line which ...
3
votes
1answer
70 views

Backward compatibility and updates

The current plan is for bi-annual updates (hard forks) "for the forseeable future". What is the policy or plan for: Backward compatibility for existing daemons and wallet versions? For how long will ...
3
votes
1answer
231 views

How to transfer synced blockchain along with another OS on a USB

So, I am considering switching my current OS to Qubes and I am currently running Lubuntu 14.04 LTS. I figured since Qubes is a lot more secure of an OS, I wanted to install it on my laptop as my main ...
2
votes
1answer
116 views

data stored in the wallet cache

According to the Wolfram Warptangent, Point Release 1 notes, there is now an expansion of the data stored in the wallet cache, including the GUI address book Is the new data being stored there ...
2
votes
1answer
321 views

Can my Monero Wallet be accessed from computer if the Wallet file name and password is known?

Sorry if this is a stupid question. I was using mymonero.com to store the XMR that I bought, but after seeing advice that it is safer to store using the simple wallet, I downloaded the warptangent ...
2
votes
1answer
701 views

Is it safe to use a remote node?

I started using Monero from now and my laptop takes a lot of time to download the blockchain. Also, my SSD is small and nearly full. I was reading about the use of a remote node to sync my wallet, ...