par C.Skywalker

Vote:

par C.Skywalker

par C.Skywalker

always a pleasure

par C.Skywalker

THIS IS (S)PARTA!

par C.Skywalker

par C.Skywalker

par C.Skywalker

par C.Skywalker

In a german article there has been an interessting comment from “Paul Janowitz” in regards to the current state of privacy for monero. It also covers a part with potential privacy issues when dealing with RingSignatures. Following you find an auto-translated part of his comment: "If your life depends on privacy, you should definitely know what you are doing, because there are certain edge cases where you invade your privacy yourself, among them E-A-E (Exchange - Alice - Exchange): Assuming that the Exchanges are even different but regulated, you can assume that they share existing data with third parties. Exchange 1, of course, knows what output Alice got, and if it appears in a ring that moves to Exchange 2, it is a hit with a probability of 1:11, or a hit that can be clearly ruled out if the output of E1 was smaller than the input at E2. Summary of outputs: If a user makes daily payouts from a marketplace and this marketplace is infiltrated, the respective outputs (UTXO) are known and if a transaction is propagated, which summarizes these outputs in rings (e.g. 10 rings with 11 possible outputs each), but in each ring exactly one known output is present, one can say with almost 100% certainty, who created it. Very old outputs: The Monero Wallet warns if you want to combine several very old outputs, because statistically, younger UTXOs are used in Bitcoin much more often than old ones and the selection of mixin outputs in Monero is based on this. If I combine two old outputs close to each other into one transaction, it is very likely that these two are the correct ones, even if the ring size is currently 11. IP Address of Propagation: IP addresses are a very strong metadata and are now protected by Dandelion++ by default by first forwarding the transaction to one node only and only after some hops wide. Additional protection is provided by Tor and I2P support, which is not active by default. Against most of the potential attacks mentioned above, the generally known “churning”, where you send a transaction to yourself, already helps. An automatic churning of old outputs similar to Samourai’s liquidity providers is currently being discussed, because with each churn you remove your output further from potentially logging exchanges and other players." PS. It’s also being mentioned, that Triptych will further increase the anon-set while remaining the size of the RingSignatures constant.

par Pancake

Particl = true Cypherpunks "If you don’t believe me or don’t get it, I don’t have time to try to convince you , sorry" -Satoshi Nakamoto

par C.Skywalker

@letsparty did you tell em they do this since 5 months now…? im mean seriously… But thx for taking the time to email them

par C.Skywalker

@zaSmilingIdiot “Or alternatively, let the user unlock the wallet, perform all their necessary sending actions, and then lock it as quickly afterwards to ensure the full protection of the wallet again?” well Isn’t the only way to completely remove the need for the password to not encrypt the wallet at creation? if there was a way you could disable the password completely somehow and then turn it back on i would consider this even better then having a pin tbh but it doesn’t seem very safe or possible. but maybe I am wrong I am no expert on the matter. “But assuming that this feature is then implemented in the desktop only, then this means that the desktop needs to temporarily (in memory) store the password, AND the pin: when the pin input is later used by the user and matched correctly, then the desktop needs to send the temporarily stored password to core. It needs the password to be stored, because it needs to send this to core to do the actual unlocking”. I can see why this could be worrisome security wise but is this not what happens when you unlock for staking if not cold staking ofc. “Firstly, is this a core feature or a desktop feature?” i think it would only be really needed for marketplace features so I am guessing it would be a desktop feature.

par dadon

@zaSmilingIdiot said in Projects that have forked or cloned Particl code for their own use.: Ghost by McAfee? we can add them when it’s really released and functional

par ffmad

@zaSmilingIdiot Thanks for your answers.

par T tux

@Allien said in [Bounties] Community bounties (Translations, Awareness, etc...): Btw shouldn’t Bounties be rather a category than a single thread? That would allow anybody to post their own… (I know I’d make use of them, as before, hehe) We could have one yes

par ffmad

This is a really neat idea! Thanks for doing it.

par R raydonovan