Topic: MyMonero.com - Security Issues (Read 8229 times)

Hi,

i have the same Problem.

I created the Wallet and transferred Monero on December 13th to MyMonero Wallet and in the same night, just 5 hours later at approximetely 2:30 in the morning all my Monero got transferred out of it.

Is there anything I can do? I already notified the Support (they probably dont even comment on it). Could you do anything about it?

I dont think that someone got my Private Keys. If so, another Wallet would be empty too.

Atleast i learned alot from it...

I Lost My Coin in this wallet mymonero.com there is a transaction log that i never done ,
 i already cek my komputer but there is no security issue ,
i read my transaction , i found something wierd that the transaction is pass without payment ID.... ( its like a bank check without ID Payment who come ?? )
, i try to email the support team , now i'm waiting for their answer.... , Hope there are not a SCAM , cause i found this on google :

https://www.cryptocompare.com/wallets/mymonero-wallet/

Anybody has the same problem

beware  there are exactly the same sites as mymonero.com  .even the name :  that was the first google search option for me twice . 
https://www.4shared.com/img/MFUgJfe9ca/s25/15f5465da10/fake

is this wallet safe anymore?

'Funds in mymonero.com may be stuck after 10/1/2017: "you may struggle to retrieve funds after this date '
https://www.cryptocompare.com/wallets/mymonero-wallet/

Its a shame there is only one light wallet for XMR . credited coins have thousands of safe wallets. Many are not capable of running a full wallet node.

Still inactive.Very interesting...I guess something is wrong.

https://www.reddit.com/r/Monero/comments/5n3b9b/psa_mymonero_is_offline_for_updates_during_the/

The site is closed.Any info?

Ah, ok. Thanks.

The new BitLicences ask for a pen test

"Penetration testing. Each Licensee shall conduct penetration testing of its electronic systems, at least annually, and vulnerability assessment of those systems, at least quarterly. "

p33

http://www.dfs.ny.gov/legal/regulations/adoptions/dfsp200t.pdf


Apart from the bleeding obvious that this is not a licensed service and or is not based in NY, a pen test might be deemed a reasonable obligation if this is securing customer funds?

i did not expect that the discussion in this thread would be valuable and constructive, but i was wrong.
if you troll like this your are welcome. Critism is wanted by most if not all of us, but it must have hand and feet. sometimes i feel BlockaFett just trolls to keep people busy, but this thread gives some good insight. still its a waste of time

maybe its time for all of us to evolve a little? (maybe we allready did). i never really took place in all this coinwars but i guess it took everyone a lot of energy.

edit: so much energy wasted..

+1 Davey.

Apologies if I sounded frustrated Celestio.

actually i have to say this first time im on Blocka´s side.

1. This thread is not about Dash so use on of the many threads or create one yourself
2. I actually think we have a nice discussion and the way fluffy responds also helps everyone concerning about Monero
3. Every piece of information is good for new people getting into Monero who actually want to research a coin.

You seem to have missed the previous page celestio...MyMonero is sending your spend key and seed to the server in a cookie for a lot of users and all the evidence is there....let's not start this ridiculous sherade and start to p*** me off with blatant lies like above ("no factual information") when I just went to the trouble of doing your security testing for you backed by full evidence, and even Fluffy admits the problem and provided a plausible explanation and we dealt with it like adults and no need to start dragging this up.  If I really wanted to cause a stink about this obviously with a fact like this I could, but the fact i'm not should show you I am not just trying to 'troll Monero'...please take a deep breath maybe this BS style of FUD'ing BCT should stop.

BlockaFett admitted himself that this thread is a "troll" thread/entirely worthless. It has no factual information and is only biased speculation as BlockaFett is a DASH supporter. Of course we could do the opposite and talk about DASH's 2million coin fraudulent instamine...which is factual.

WebWallet like blockchain.info

Just pulling up a seat before catching up with events tomorrow.

Hold on, this is a third party service we're talking about?

Ok so my points would be:

API - I understand it's on a different sub domain so it doesn't get the cookie with the send key, same with google analytics.. It is going to mymonero.com though so not sure how much difference that makes (from pure exploit point of view). I think it's plausible that a dev might not have spotted this though like you say.

Cache - again, plausible that this is the cause as you say

Shredding - no I meant on the client side - for the MyMonero users who's cookie with send-key / seed being sent to the server, locally that cookie was on their HD during the session, so if someone else accesses the HD they could potentially recover everything to hijack that wallet from clear-text....so they should probably be alerted and move their funds to a new address (and because the cookies could have been intercepted in transit etc anyway)

Private key propagation - yes they weren't going to the API but they were going to mymonero.com in every request (for the ?2 users) so it would be trivial (from an exploit point of view) to insert code server side to read this and retain it and use it later and serve that ostensibly through a flat html file (using an http module or extension mask or whatever you want).  Not saying you *are* doing that, but it is *possible* with this setup, which is the reason I raised it.

Confidentiality on your stats / demographics - sure, not for me to say, just asking.  

Replacing Monero Core as the first option - Yes as an observer that would seem to be the obvious way to go but again not for me to say.

Not storing large quantities on MyMonero - Sure, after Mintpal IMO I would say this about any centralized store of coin info...if you got hacked and the private keys are moving from the client to the server then through various scenarios it could be a similar outcome, just me but as a user I would want to be told that from the outset on the choose page but again not for me to say

Monero design goals - I am not an expert, the above situation seems like a contradiction to what I heard from some of your 'evangelists' but as I never bought Monero I don't think I qualify to try to say what is should be for.. I hold Dash as you know and if we were talking about a Dash web wallet plus these issues here i would be saying exactly the same thing, anyway..

Yes looks like some cache issue probably triggered by the different URL rewrite patterns e.g. when i type in mymonero.com it redirects to this (using ?2 *with* the cookie code)

https://mymonero.com/#/

But if I type mymonero.com/index.html it rewrites to this: (using ?2 *without* the cookie code)

https://mymonero.com/index.html#/

so probably based on location, you get the different versions, based on the cache you are hitting, I would guess...

Fireforx 38.0.5 , URL = mymonero.com as you ask. And im from Germany and as fluffy brought up of maybe Cloudflare being the reason... usually i get routed to the Cloudfare Frankfurt servers afaik when some sites using Cloudfare were down.

Ok so just to clarify: with AngularJS you basically just get index.html + a bunch of JS files, and then it gets "partials" (kinda like views in an MVC pattern) as it needs. BUT that's just static files. The stuff that is polled regularly / any actual interaction with MyMonero is done through the API. Now the MyMonero API is on a different domain (api.mymonero.com), so cookies are never sent to it (the cookie was explicitly for "mymonero.com", not ".mymonero.com" which would have included subdomains). So the risk we identified with it (ie. why we dropped that functionality) was because it would be included in static object requests, which is something that the developer who added that functionality in the very initial version never considered.


I understand that - what I meant is that ?2 should never be served by index.html:)


That code hasn't existed on the server (except as a git blob) for ages, so there's nothing to delete on that side. When you add ?2 to the file you're being served a cached file somewhere along the line, which is why I went and cleared a bunch of things server-side that could be caching it. I suspect the reason that actual file can still be accessed is because CloudFlare has longer lived caching on some of their endpoints. But beyond that nobody should ever be served ?2, so the caching of the actual JS should be/have been largely irrelevant.

Re: shredding, we don't log static object requests, as that just clutters the log, and we've never logged cookies (even when we do receive them). Since all the heavy lifting is done client-side, and then on the server side by the API, the static objects are just cached aggressively and served as quickly as possible. Logging would interfere with that. We also don't log much of anything else, because I don't want to have an environment where I've got metadata that can be requested by LEA.


Nowhere near a year:) It's been up since the end of last year (so about 5 months), and as mentioned above private keys weren't going to the API, and static requests weren't logged.


Yes absolutely to the MITM risk that existed with that code snippet, or to the risk that I'm outright lying and we've logged everything. But, at the same time, the risk profile doesn't change: if I really wanted to I could serve up some obfuscated JS buried deep in the code (not obvious and outright like you've seen) that surreptitiously sends me private keys. That's the risk you take with any webwallet, Bitcoin or otherwise, and that is why it doesn't matter how much is done client-side, you still have to trust the operator 100%. I don't think (or hope) that anyone that uses MyMonero is under any illusions there. They have to trust me, it's the nature of using a web wallet.


It's a commercial project that cost a lot of money to develop and build out by a small team of accomplished developers. This isn't something I hacked up on a weekend, and I'm also not the only owner (Risto Pietilä owns half of it). There's no secrecy with the backend, it's just a commercial project that isn't going to be made open-source just yet. We do have long-term plans to provide a user-hostable version, but right now it's just too complex and "delicate" to release.

No you can't have an indication as to the userbase for two reasons. Firstly, it's a commercial project, and the Google Analytics stats are not public. Secondly, even if I provided stats on the number of viewkeys it's all rather meaningless, as it's really easy to create multiple accounts.


No, it'll be replaced by Monero Core as the first option when that is completed. MyMonero fills a usability gap that couldn't be filled with Monero Core fast enough, and there was (and is) a need for those that are interested in tinkering around with Monero to have something that they could use.

I would never, ever recommend anyone store large quantities of value in Monero itself (which is somewhat trivially attacked by a motivated attacker with enough mining power) and definitely not in MyMonero. But overall I think you misunderstand what Monero is trying to achieve. It's not designed to be some super-secret currency that is so private that nobody even knows it exists. It's not designed to fill some specific use-case like "buying dildos on the dark web". It is designed to be truly fungible, sure, but that is only one aspect of its design.

Things like our eternal emission (to retain mining incentives), or the move to a 6-month rolling hard fork window, are there to make Monero useful. Things like OpenAlias, and the slowly-increasing easy-to-understand content on GetMonero.org, are there to make Monero usable. Transactional privacy is a core feature, but even that is not yet complete (eg. we still have to implement the changes posited in MRL-0004). We ultimately want Monero to be easy to use by everyone, whether they're very familiar with cryptocurrencies or not.

what's your browser and exact URL?

Here's some cache results (so independent of client / location)

Google:



Bing:



Yahoo:



So ^ these are what the search engines index on their side, and they all use the account.js?2 the code that sends the private key / seed up to the server in the cookie...

The only one with account.js?1 is wayback....



.....Which doesn't send the private key

Maybe a URL rewriting issue?  But how come the cookie code is anywhere on the server should delete it really?

This is what i get. Also account.js?4 is in line 56 on my source, you have it in line 57. The modal.js? also differs if you look.

Fluffy / Smooth - thanks for your direct response and coming here to explain yourselves in a reasoned fashion.

Fluffy - Just on the cookie issue because that's what i'm looking at, MyMonero is definitely serving the account.js?2 verison *with* the priv key being sent to the server in the cookie on every http request (so like 10 times on every page refresh and I think there is even a keep alive to send it up too...)

View source on index.html gives this...



...same on Firefox / Chrome / Tor and from a few different locations so it is being served, for whatever reason, at least for me.

And on the web-archive you linked that's indexed today, it's there too if you just change the query string to a 2:

https://web.archive.org/web/20150604040007/https://mymonero.com/js/services/account.js?2

   accountService.setAccountCookie = function() {
            if (accountService.loggedIn()) {
                ipCookie('account', {
                    address: accountService.getAddress(),
                    view_key: accountService.getViewKey(),
                    spend_key: accountService.getSpendKey(),
                    seed: accountService.getSeed()
                }, {
                    expires: config.accountCookieTimeout,
                    expirationUnit: 'minutes'
                });
            }
        };

Maybe some other users can do a 'view source' on the homepage from their end and see which account.js they are getting but I can only get the cookie one above?

Seems like something that should be fixed pretty quick e.g. just delete that code from the server and I would guess existing users need to be alerted that they may have had cookies with their priv key stored in clear-text on disk that can be recovered potentially unless it's been manually shredded?

One question about your comment:  "As mentioned, there's little to no useful information I can gleam from MyMonero that would give me some edge in trading."

...but with the private keys being sent up to the server, that could be used to get a picture on distribution / richlist, plus if you see some of the large balances going up or down with withdrawals / deposits, wouldn't that be good for predicting pumps and dumps? (as statistically most of it I guess would be to Poloniex)

I appreciate what you are saying, but MyMonero has been live for what a year now (?) with the private keys going up to the server so assuming you fix it now, it has been happening up to this point.. at least for some people.......  

...So potentially some accounts are compromised and need to have funds moved because if those keys were intercepted in transit (like man in the middle / cross domain cookie hack / server breach / data retained on server was hacked) then those coins can be stolen at some point in the future too?

How come there is the secrecy too, why is the backend closed source, and also why no indication of how many people use MyMonero - yes its private but you know yourself as do Google Analytics so why not share this with everyone?  

Do you plan to keep MyMonero going and as the #1 option for a wallet presented to users? - how does that tie in with Monero being designed for untraceability / security, it doesn't seem to be achieving that?

Wow I get in a plane and Bitcointalk goes nuts in my absence:)

I think I'm going to start by addressing some of the concerns in BlockaFett's first post. I'd like to note, having read through this thread, that BlockaFett has not contacted me at all to discuss his concerns. I would really have appreciated that as being the first step here, but no matter.


It is absolutely correct that I can see information on MyMonero accounts that others obviously cannot.


I think you're misunderstanding how the viewkey works. I can see funds that are received, but I can't see which signature in an input is the correct one, so there's very little information I can exploit. At best I can see funds moving between MyMonero accounts, but I have no way of determining whether funds have been transferred out to an exchange or anything like that. Thus I cannot possibly use the information to give me information on dumps, and I cannot possibly know about "pumps" without simultaneously having access to everyone's BTC wallets.

I'd also like to point out that we have never claimed that Monero is the "most decentrazlied coin" (sic), and we definitely don't claim it is the "most anonymous". I'd be hard-pressed to define "most decentralised", but clearly Bitcoin is the only cryptocurrency with enough hashpower and a sufficient distribution of nodes to be called "most decentralised". In terms of anonymity, the ZeroCoin/ZeroCash cryptocurrency (as and when it is released) will offer privacy that is nearly absolute, and is thus would earn the crown of "most anonymous". It has other issues (such as cryptography that is untested and not yet sufficiently reviewed), but Monero definitely does not lay claim to that.

I think this may be your misinterpretation of what people are claiming.


I'm not sure the relevance of this or what connection you're trying to make here. Are you implying that it is bad for me to be building out services for the cryptocurrency ecosystem? Or is the implication that trying to publicly raise funds is bad? I don't see an issue with either - I/we didn't raise any funds in the end with VertPay, and we pivoted off that and repositioned ourselves to create a more generalised solution. I'm still not understanding what your implication is.


You are 100% correct on this. As has been pointed out in this thread already, though, I have made an effort, through MyMonero, to host a giveaway on Bittrex and try and shift some volume there. This is at odds with your implication that somehow I am in cahoots with Poloniex, profiting off their dominance.


The core team does not have visibility on MyMonero's data. Additionally, there are several GUI wallets that the website links to and that plenty of people use. And, too, the CLI wallet is not particularly difficult. Lastly, we put work on the GUI on the back-burner last year after the block 202612 attack, and we indicated publicly why we had to do this. It is imperative that we work to ensure everyone's funds are secure, rather than prematurely shove out some GUI.

Nonetheless, the code for the work we had done on the GUI has been made public: https://github.com/monero-project/monero-core so anyone can work on it and release it.

The CryptoNote GUI wouldn't work with Monero as our code is too differentiated, and there are fundamental changes we've made to the way wallets work and store data, and the way they communicate with the daemon.

Again, we have never claimed to be the "most secure and untraceable coin". Bitcoin is the most secure. ZeroCoin/ZeroCash will be the "most untraceable" (to its detriment, when coupled with the whiz-bang cryptography).


No, we do know. Git is an amazing tool for being able to step back and look at where code comes from. You can use git-blame yourself on the crippled code, and you can also check where we caught the issues and updated them:

https://github.com/monero-project/bitmonero/commit/3cc45e9324a402aee91e2f46861b2ca393d711aa
https://github.com/monero-project/bitmonero/commit/44f61c3965d569c288520b75356ad3bdc68b47d1

And correlate that with mining hashrate at the time. You will observe that there was a rise in hashrate when we released those changes, not days/weeks before.

Let me ask you something: why would we have made those changes to the hashing algorithm that quickly and released them publicly, when we could instead have quietly mined for weeks or months before making those changes public?


By the same token, Bitcoin is "potentially *setup* as a scam", as the core developers have access to information that nobody else does. Bitcoin's core maintainers know about features before they're even announced / released, and they could trade on that information. There is no fix for this, other than (I guess) to treat it as insider trading and regulate it accordingly. Trying to fix this problem right now is truly out of scope for Bitcoin, and is dramatically out of scope for us.


As mentioned, there's little to no useful information I can gleam from MyMonero that would give me some edge in trading.

Every exchange can make use of their internal state, and they have WAY more access to information than MyMonero does. They can have their systems automatically pull their orders if there's a buy that will hit them, they can do all sorts of stuff. One need only look at Mtgox's Willy bot to see what exchanges can get up to. We have no way of verifying that Coinbase, Bittrex, btc-e, Bitstamp, Cryptsy, BitFinex, etc. *don't* abuse their internal state / information. So what are we going to do about it? Never use an exchange again?


I've also said that it's a dumb argument to say "he's such a nice guy", because the best scammers *are* nice guys. That's precisely what con men do for a living. Knowing me is largely irrelevant and I would recommend that any trust is given based on my history and dealings with people. Sources of information could include, for example, the Bitcoin OTC web of trust: http://bitcoin-otc.com/viewratingdetail.php?nick=fluffypony

Additionally, one could consider that I had access to the Mintpal funds. Ferdous asked me for assistance because he couldn't gain access to the wallet (he was struggling to get it restored because it was in an older wallet format, and 0.8.8.6 didn't have the ability to restore that format, which is something we've subsequently fixed). Ferdous had no idea if the funds were still in that wallet. I could easily have told him that they were unfortunately stolen, and then just kept them for myself. It is no wonder that Ferdous said on Twitter: "IMO @fluffyponyza is one of the most honest, smartest and hardest working individuals in this space."

Now to answer some other things that have popped up:


At that stage when we wanted to raise funds there was quite a bit of backend development that had been done, all self-funded. We raised $0 because we cancelled the fund-raising as it was clear it was too controversial. This lead to some internal changes and a complete refocus of what we wanted to achieve, and a bit of a state of flux for a few months. After this was resolved we began working on the project again in the 2nd half of 2014.

BlockaFett's timing seems to be a little off, as by the time the VertPay funding was scrapped (middle of May, 2014) the Monero core team had already been formed, and we had forked the project away from thankful_for_today (after he refused to accede to the community's wishes). Thus I didn't "move on" to Monero, I was doing both simultaneously (as I continue to do).


This is 100% correct, but it is also old (as in it predates MyMonero's official launch). Why you're seeing a very old version of the main page is beyond me, but that version of account.js hasn't been around for many, many months. I've confirmed on multiple systems that index.html is passing the correct account.js, and that account.js does not contain that old code. Additionally, you're passing ?2, which is a cachebuster value that we use to ensure nobody is receiving a cached version. Whilst this doesn't match the cachebuster value right now (?4) it still shouldn't have served up such a very, very old file. This could very well be an issue introduced when we were deploying a Phonegap-based QR code scanner on Tuesday morning, but that was rolled back after an hour as it caused endless issues in its detection of mobile devices. To make doubly-sure that this isn't occurring anymore I've cleared every possible server-side cache that could have been serving it.

In order to confirm that this functionality was indeed accidental (in that it was poorly thought through) and also removed ages ago I checked archive.org. The most recent capture of MyMonero is from May 13th, 2015 (https://web.archive.org/web/20150513233042/https://mymonero.com/#/) and has the following account.js: https://web.archive.org/web/20150513233042/https://mymonero.com/js/services/account.js?1 - you can confirm in that, and older versions, that there is no cookie-storage code.

It is important to note JavaScript-based wallets are never going to be really safe, and MyMonero is no exception. I've said before that MyMonero is merely a stopgap solution until we have libraryise completed (so that third-party GUI developers can better hook into core functions) and/or we've found an SPV-style solution (our current work is on using a bloom filter for viewkeys instead of passing the raw viewkey) for lightweight wallets. In fact, the website even says quite clearly: "The clients below are ideal if you are using Monero for the first time".

BlockaFett, I appreciate very much that you have clearly indicated your bias. I understand, too, that you have an inherent desire to ensure people don't get screwed over, and I applaud that. But this is going to become a mud-slinging session and you know it. Whatever answers and responses I've provided above you won't be satisfied with, and eventually it is going to become a frustrating "shouting" match that will only leave things more confusing for the casual reader. I would like to suggest that we find some time for a Skype chat or a phone call to discuss this using a medium that is a little more immediate than Bitcointalk, and you or I can report back afterwards. I understand that you lack time and energy to invest into this, and I understand that. Having just arrived back home from Europe I can assure you that I don't have much time for a back-and-forth on Bitcointalk, but I do absolutely want you to be able to flesh this out and discuss it with me. I am more than happy to make myself available to you for discussion, and if there's anything specific in my answers above that you'd like me to clarify publicly I am also happy to do so.

BlockaFett just as technical matter, you can't reverse stealth addresses even with private keys. So in order to see that coins are moving to Poloniex to allow front-running the market, the MyMonero client would have to send the public destination address to the server before performing ECDH on it. I don't think it does that, or at least there wouldn't be a good reason to do it.

If you find something like that in the code, you are on to something here, otherwise, that aspect of your presentation is debunked.

I don't really think there is anything wrong with the scrutiny here, but I don't see any major problems either, based on what you've shown so far. The cookies thing is interesting, I'd like to hear what the MyMonero developers or other JavaScript experts (I'm not) have to say about it.

The vertpay/paybee connection seems particularly pointless. If he raised money and stole it, that would be one thing, but he didn't. You say it is now self-funded (i.e. he's spending his own money to build a business). I see nothing wrong with it at all based on what you've stated.

Yes, its morphed into PayBee.com now apparently which is self-funded i think.

Webwallet is one thing but on a Cryptonote coin, that relies on opaque blockchain where no one has access to distribution info / rich list / fund movements, if it can be used to give one entity that information it seems like a big compromise.  

And looks like user's private keys are being sent to the server on MyMonero.com in which case all that would be possible plus spending the coins but waiting for validation on that.

Ah - I remember that drama over on Vertcoin's reddit although I wasn't paying that much attention.  

So he began by trying to raise the money - but eventually shuttered the entire thing without raising it if I understand correctly.

Didn't realize that was fluffypony.  Thank you for the background.

I tend to agree with you on the webwallet.  I still think it's the least of the compromises with anon tech in this space.  But I understand those who feel differently.

sure, there is an interview with Fluffypony where he describes vertpay & the funds he was trying to raise https://soundcloud.com/zerofiat/zero_fiats-vertcoin-update-05-06-2014

but it never got off the ground...there was a lot of pushback from the vertcoin community e.g. https://www.reddit.com/r/vertcoin/comments/2590id/hello_members_of_the_cryptocurrency_community/

and Fluffy cancelled it before joining Monero and setting up MyMonero.com:


Here is some info on the latest payment site Paybee.com: https://bitcointalksearch.org/topic/m.10964605

My issue with it is the pattern has been used by scammers to get in the middle of coins and take advantage, like Ryan Kennedy in the Moolah / DOGE scandal - the DOGE co-creator gave a good interview about it here https://soundcloud.com/mindtomatter/ltb-e156-the-moolah-story

Not saying that is definately what's happening here, and if it isn't then no harm in asking because it means they have been checked out / some due diligence has been done.  Although I think a web-wallet is totally inappropriate in an anon-coin like Monero though either way

I really appreciate this honesty.


Do you have any background on this?  When were the funds raised, how long the website has been in development, where the funds went etc?

As someone interested in following and owning some Moneros I appreciate the contribution.  Just like I appreciate the Monero supporters concerns over Darkcoin's premine.  People need to grow some skin and decide discovering the truth & negative opinions are your friend in a world that consists of 95% scams.

The Monero inflation really isn't setup to scam unless it's a long term (multi year) setup.  The price seems pretty stable stable compared to most currencies - probably due to inflation.

Yes XMR was 100% safe on Mintpal, Ryan Kennedy went straight for the BTC and darkcoins.  Fluffy didn't need to do any 'work' unless there was a problem with the XMR wallet, Ferdous was already on the case refunding various coins.

Like your take on things Kazuki, typically twisted-reality like most of your ramblings.  Although I did say twice I would take a backseat on BCT, but everytime I did when I checked the forum there were the usual throngs of XMR trolls filling every page in the alt section with FUD and trying to bully people to buy Monero and slandering everything in your path so I feel like someone should stand up to your kind of behavior, if that's ok with you?  

OK so I check some of the JS and the first thing that jumps out is this:

(src: https://mymonero.com/js/services/account.js?2)



So looks like spend key and seed are being stored in the user's browser cookie which is sent to the server with every HTTPrequest.

...which would give 2 main problems:

1) Any browser you log into MyMonero.com will store an unencrypted copy of your spend key and seed (plus address / viewkey) in a cookie file on the disk

2) The spend key and seed are sent to the server on *every HTTP request* meaning that the data is there on the server, you just need one line of code to put that in a DB if you want.

I couldn't get past the create account page to grab the actual cookie, it was like this 2 days ago when I tried too...



So I can't generate the 'account' cookie from above to validate this code....and I can't try transactions to see what else might be sent up to the server....can someone from Monero who can login validate this? - i mean login successfully and then pull the actual 'account' cookie from a get request and paste it here so we can have a look? (obviously on a test account not on your actual XMR account if it contains your spend key)

BTW cookies are stored using Angular JS IPCookie: https://github.com/ivpusic/angular-cookie/blob/master/angular-cookie.js

Well, and it certainly worked because my mind automatically associated this thread with a Monero FUD thread.
As far as this goes, from what i've seen about fluffypony he seems like a legit hard working guy trying to make the coin better, let's hope he isn't another letdown. Personally I trust him more than Duffield.

You could've posted that on a whole lot of threads before this one, what made you to decide to get all concerned just now?

I dont mind people like BlockaFett with their usual BS and lies, he said on two occasions, that I can remember, he would leave the forums for months after being publicly humiliated only to return the next day to troll more, so we are dealing with pathological liar here, the worst are the ones that say to hate both Monero and dash/darkcoin as if it makes them look special or something, they are the real joy of the thread.

Btw since BlockaFett is so worried about Mintpal et al he should at least note the effort fluffy did to recover the users funds:

You are wasting your time.  The only reason he is spewing this nonsense is because there are about a dozen threads by a dozen different people criticizing his precious DASH about the myriad of fallacies and shortcomings inherent in that scam coin.  I believe he is well aware of how factually unfounded his accusations are.

First of all, the whole premise for this monero ""vulnerability"" is he states that most monero transactions go through mymonero which is an outrageous assumption.  Mymonero is simply a web wallet used mostly by noobs who don't want to download the blockchain and run their own wallets.

Even the rest of the DASH DEFENDERS™  are too embarrassed to join him in this ridiculous discussion about unfounded allegations based on absurd assumptions.

You seems not to know what people are trying to tell you.... yes, the API to interact with the blockchain are on the server side, but everything is done on client side.... the server side have only your viewkey, dont have your spend key, the onlything that mymonero knows about your monero wallet is your inputs... when you want to spend anything the encription is maded on client side... If you know "WEB" as you say you know be my guest and check the code...

Neither can I: AFAIK only one of those thread starters is a Monero supporter (generalizethis).

For some reason I think certain people are not happy with this thread and would like it to go away......can't think why.

Othe - can't deal with the eye-bleed from trying to decode the word salad you made of my posts so I just paste in your points here:

"Without the spendkey you don´t see what outputs have been spend etc.
MyMonero users are less private, obviously, but that doesn´t endanger the others."

I think on an opaque blockchain coin, having users do their transactions on the devs personal closed-source website is a danger. we are going round in circles....

"Another lie - MoneroX works fine on Linux, Windows and OSX.
Works and looks the same as Bitcoin QT, aka Dashcoin QT."

So I am a liar because MoneroX works fine, then what is this?


"Obviously because you are an idiot who wasn´t even able to check the sourcecode :-) No i am not talking to someone who knows sth. Definately not.
You see in the JS what is send to the server and what not, no need to make stupid speculations. Just go and check it."

Like I keep saying, you have no idea what you are talking about.  The JS is just a wrapper to the api which is the backend which is closed source.

To save the tediousity Othe of you having to shout for the next 50 posts that everything is open source on MyMonero - maybe take a deep breath go read some basic Javascript / web dev tutorials, learn what a backend is aka what 'server side' means.  Or if you want to insist that it's open source, then please post me the API / backend source.

Honestly you act like a proper thug hyperventilating over every point and calling it a lie when a 5 year old can go and paste a link to show you you are wrong...and you call me a liar lol.  MyMonero is 100% closed source apart from the client-side javascript (obviously), meaning anything of any importance to security or privileged financial information.  MoneroX is not a viable alternative to MyMonero as the thread is full of users complaining it doesn't work.  I seriously hope you are not a Monero dev for their sake.

EDIT: Lets not argue Othe, there is nothing more that I want to say...what I presented was a theory about how you have a structural problem, I honestly am not bothered what you do with that info and no point in repeating myself.  If you don't agree, no skin off my nose.

I am not discussing a bug or exploit, and if it's ok with you I would rather remain here on a public forum.

When I use the word 'exploit' I mean someone might be exploiting the opaque blockchain nature of Monero, by setting things up to have a view right inside it.

If you don't want to comment on that, your choice, but probably best not to try to misconstrue what is being discussed here.

 
Oh my god this is getting ridiculous, let's close this discussion.

Come to talk on IRC #monero & #monero-dev if you found any real bug or real exploit.

Without the spendkey you don´t see what outputs have been spend etc.
MyMonero users are less private, obviously, but that doesn´t endanger the others.

You have Mobile/Webwallets for DASHSCAM. It´s just that they don´t support a single bit of anonymity i.e. darksend.


Another lie - MoneroX works fine on Linux, Windows and OSX.
Works and looks the same as Bitcoin QT, aka Dashcoin QT.



It´s none of your fucking business, it´s really that simple.  Who are you to tell people what to use and where to trade? So we have to spread it out to 10 untrustworthy exchanges instead of 1 trustworthy?
Even ignoring the fact that we tried to get volume on Bittrex https://bittrex.zendesk.com/hc/en-us/articles/204310644-Year-long-XMR-giveaway- and even sponsored XMR for that? If people still prefer Polo, then they use Polo and it´s their decision.


Obviously because you are an idiot who wasn´t even able to check the sourcecode :-) No i am not talking to someone who knows sth. Definately not.
You see in the JS what is send to the server and what not, no need to make stupid speculations. Just go and check it.

I would say so but I am not the person to do that.  

And they can fix it I think by making a decent official wallet so users a) don't need MyMonero b) other exchanges can add XMR and Polo isn't central point to manipulate

It looks like you've really hit a sore spot. Maybe this warrants further investigation.

1. Lol, you still don´t get how Monero works :-)

--My understanding is that Monero is Cryptonote and I use that so my transactions / balances are then untraceable.  My point is that *they are not untraceable if I use MyMonero*, which a large % of users do.

2. Thats a blatant lie, no one has to, its just an option. Most people don´t want to use the Full node, especially not traders. FACT. Blockchain.info is prolly the most used BTC Wallet too. Why doesn´t DRK have a real web wallet? After over one year, are you guys to incapable to create one? Prolly because for your scam, you don´t even need mass adoption :-)

--Webwallet on an anonymous/untraceable coin seems like the most inappropriate thing you could develop to me, that's why I imagine Dark or any other anon coin didn't do it, and is why it makes me suspicious of the motives of the people who have done that for Monero.  As to forcing people to use it, I never said that - you just have to make the alternatives unusable for the average user, which they are in Monero's case, after 1 year.

3. Poloniex is the most trust worthy exchange we have. Fact. Why should we move somewhere else. We can trade where we want, only a fucking Dashtard Nazi would tell others where to trade their coins, it´s their own fucking business where they want to trade.

--Real basic stuff as to why having all your volume on one exchange isn't healthy...and in the context of what I am saying could be extremely unhealthy.

4. What Privacy? It´s run by Riccardo. Where is the sourcecode for Blockchain.info? Wheres the sourcecode to commercial product XYZ?? Oh wait, in the browser in case of Mymonero. idiot.

--No offense, you call me an idiot, but I don't think you know the first thing about how web tech works and you are talking to some who does..  the javascript is client side but anything can be going on on the server side, e.g.. the database, and without it being open sourced we have no idea how that works or what data is being collected / how it is being stored

I'm not trying to discredit you I am discrediting you as a wanabe SJW. You presented one side of a story and you never even contact the people involved to try and see if there even is another side.

Also with the information itself I guess you're not just a fuck face SJW you're also a stupid one. I already blew up your 'information' you just don't seem to want to read.

Dude you are spinning so much bullshit it's coming out your ears.


All this stuff you're saying doesn't matter. You had a moral obligation, especially as a self-appointed 'investigator' for bitcointalk, to act responsibly. Sending what you wrote on this thread privately to someone DOESN'T TAKE MORE WORK THAN MAKING THIS THREAD!

Also I know this is the altcoin section and there are a lot of scammers and delusional idiots but take a minute to think about how cryptocurrency works. For PoW whoever controls 51% of the hashrate makes the rules. For PoS whoever controls 51% of the currency makes the rules. With Bitcoin the mining network is so big that it's basically impossible for anyone to buy up 51% of the hashing power and make their own rules. But for EVERY SINGLE ALTCOIN including Darkcoin and Monero and Peercoin and Litecoin and Dogecoin and fucking everything there are single people with enough money to take over the mining network, forget about companies or the NSA or Israel. No altcoin is secure, they're just a collection of mostly-shit hoping to be less-shit one day.

Pointing out that an altcoin only has one web wallet or one main exchange is a big fucking whoop, because if that altcoin is successful there will be others and not everyone will use web wallets anyway. The entire argument you're trying to make is a load of SJW 'save the people of bitcointalk' bullshit from a child who doesn't know how to act like a responsible adult.

Oh and bro this took me one minute of google to find. Makes your entire attempt to make some link between the web wallet and polo seem pretty fucking suspect.

https://bittrex.zendesk.com/hc/en-us/articles/204310644-Year-long-XMR-giveaway-
https://bittrex.zendesk.com/hc/en-us/articles/204527664

1. Lol, you still don´t get how Monero works :-)

2. Thats a blatant lie, no one has to, its just an option. Most people don´t want to use the Full node, especially not traders. FACT. Blockchain.info is prolly the most used BTC Wallet too. Why doesn´t DRK have a real web wallet? After over one year, are you guys to incapable to create one? Prolly because for your scam, you don´t even need mass adoption :-)

3. Poloniex is the most trust worthy exchange we have. Fact. Why should we move somewhere else. We can trade where we want, only a fucking Dashtard Nazi would tell others where to trade their coins, it´s their own fucking business where they want to trade.

4. What Privacy? It´s run by Riccardo. You are the only one here hiding in the Dark (literally) between a made up nickname, why all the privacy?? Where is the sourcecode for Blockchain.info? Wheres the sourcecode to commercial product XYZ?? Oh wait, in the browser in case of Mymonero. idiot.

Like othe already said, XMR has been on top of the voting list at cryptsy for several months. Instead of really adding it, they still come up with flimsy pretexts (e.g. we're still in the process of adding it (they already said this a year ago)). Devs even offered to help with the integration, there is a guide to full php integration avaible, but they never bothered to ask for help. They will probably add it some time in the future, but this could still take a while.

I can not comment on Mymonero, but like MikeCorleone already said, if you are worried about MyMonero, please ask fluffypony himself. He is in almost everyday in #monero on freenode, so what's stopping you? If you didn't even contact him about your "worries", then this is just pure FUD spreading in my opinion.

No disrespect again but I am not invested in Monero and I never lost anything due to Monero so not like I care to go to all that trouble.

And i'm not disclosing a technical exploit that then renders Monero vulnerable based on the info I posted (which was speculation anyway) - I am saying the structure enables whoever owns MyMonero to exploit the market in financial terms because then it allows front-running on Poloniex where all the volume is. And the other things like no viable official wallet after so much time compound the problem and make me suspicious but how can I know what's happening behind the scenes.  The anonymity problems and letting Google in on the action is secondary today I would imagine.

Not much more for me to say - solution is get rid of MyMonero (by making a viable / usable official wallet that most users then actually adopt) and spread volume across exchanges: scam not possible, problem solved.

Also i'm not the person to look into this any further as I already explained i have conflict of interest so I think I should leave it there

You sound exactly like a fucking SJW! This just reinforces my belief man, SJWs are just cowards pretending they're doing everyone a favor and saving them.

This is what SJWs don't realize and what you don't realize: Maybe by talking to him you make him realize there's an issue, and he works to fix it, and then afterwards you're able to jointly release a statement pointing out the problem and what was done to fix it. Or you talk to him, he explains something to you, and you get a litebulb moment and then understand why it's not a big deal (I'm not saying it isn't a big deal I'm just saying this is one possible outcome). Or maybe he's a complete asshole to you and then you actually have! something! to! post! on! the! fucking! forum! except! your! stupid! opinion!

http://en.wikipedia.org/wiki/Responsible_disclosure go read and see what adults do when they think they've found a security problem.

Hi - no disrespect, but what exactly is Fluffy's word on any of this supposed to prove?  If my concern is a structural problem with Monero that is unhealthy and I ask him if he's using that to gain market info and then trade big on Poloniex where volume is all locked in and he says "oh no, not doing that" - then I shouldn't have posted this?  And he's free to come here to discuss, why do I need to contact him privately?

EDIT: again, I am not trying to single out Fluffy here and attack him.  I am saying MyMonero / 95% Polo volume seems like a bad idea basically because it *enables* someone to take advantage and undermines the core selling point of the coin, I don't know if anyone is doing that or not.

That is really shitty man. We aren't children on the playground gossiping about each other. Why would you post on the forum without first talking to the person you are accusing and asking them wtf is going on? You are no better than every fucking whiteknight SJW posting on tumblr. People like you make me sick.

Grow up and stop acting like a kid. Just send the dude a message and tell him what you're worried about. Are you so scared of him that you're posting this shit on a forum thread first? Coward.

7. Host has access to view key

1. if you don't mask your IP, host knows your physical location

2. host gets info on type of client you are using

3. embedding google analytics lets google know same and also enables you to be identified cross-domain on Google side (so who you are based on every other site you use basically)

4. if you don't use fake email, host knows your email

5. anything you type in a form on the site can be accessed retained by the site owner obviously (so all you financial info in XMR terms and what you are doing with funds)

6. ISP knows you are a MyMonero visitor and has to record this by law in a lot of countries and disclose if required

But that's not the main issue.....

It's the *financial information* that MyMonero has access to, that *no one else* has access to due to it being a Cryptonote coin, that is the real issue I am trying to ask about here...

Please explain technically how mymonero can de-anonimize users.

I am honestly curious, thank you.

EDIT: before anyone goes off on a tangent: No I am not affiliated in any way, shape or form with mymonero.com. I sport it in my signature because I am aware of the difficulties some people have with the CLI wallet.

I haven't investigated this yet.  That's why the title is "investigate?".  

This is just seeing what other people think to find out if it is worth investigating.

So far all my points have been dismissed..

In terms of input from Fluffy, he is welcome to answer my above questions, this is an open forum

This thread is really interesting. I like that BlockaFett has taken it on himself to investigate, and I think that should be praised. I have a few questions for you, BlockaFett, mostly around some more details of your investigation, as I think that will help us understand your conclusions.

1. How often have you approached Fluffypony to discuss your concerns? Was it just the one conversation, or multiple conversations?
2. What communications medium did you use: emails or skype or Bitcointalk pm or something?
3. Are you willing to show us the conversations you've had with him whilst you were investigating this, assuming he is ok with them being posted up?
4. I assume the conversations you've had with Fluffypony about this ended badly, can you tell us more about what he said to you in private that led to you putting this post up?
5. Have you spoken to him since putting this post up, and has he given you any more feedback?

I really think it's important that we get the answers to these questions, that way we also get his side of things.

PS. For next time it would be great if you could put the conversations up along with your investigation otherwise you're nothing more than a SJW and you lose credibility (obviosly not the case now:-) :-)

please, people. dont waste your enegry on this....
its not worth it. his questions are all fake

Asking if you are a dev seems like a pretty simple question...and the BCT search is disabled so not that easy to investigate right now...but trust me if I decided to investigate this properly you will know about it...

Within the last 24hrs you have 3 users on the XMR thread complaining that they can't use the official wallet:




Then when we go to the 'choose a wallet page' we are pushed to MyMonero:



And lots of quotes on the XMR thread of people with wallet problems being told to use MyMonero.

So the questions are:

1. Why did the Monero devs decide to setup a web-wallet that enables them to deanonimize users / be the only group to access blockchain / distribution / fund movements information, on a coin they are marketing as untraceable / anonymous?

2. Why, after 1 year, are users still having to turn to MyMonero.com because the official wallet has so many usability problems / no GUI?

3. Why has no progress been made to get the 95% of volume off Poloniex and spread across different markets?

4. Why the privacy surrounding MyMonero.com?  Where is the source code?  Where are the stats on users (if the answer is privacy, then it's not because the devs can see it, not sharing it privileges them)

Proof this.
Most users seem to run SimpleWallet from my observations. Clowns like you can´t be taken seriously :-)

The Website clearly says: "If you are able to spare the bandwidth and disk space required to run a full node, doing so helps keep the network stable and robust, and also affords you the maximum privacy Monero has to offer."


C´mon, you are the investigator here. Just shows us you know fuck nothing about XMR.


It´s a website man, get used to it. You run your own node if you want privacy, thats how it works. And that is mentioned 100x times. MyMonero is just for people who don´t care. It´s an easy solution to use XMR, which is currently only used for investments and speculation anyway.



You still don´t get how Monero works - cute




There is nothing to dismiss, we already found out you don´t know how Monero works :-)

Othe...again...are you a Monero dev? (or can someone else confirm this or not please?)

EDIT: Othe - saying 'anyone can choose a wallet' is disingenuous.  We both know nearly all users get funnelled to MyMonero, that is even the first option on the 'choose a wallet' page - again, extremely suspicious that you are acting 100% dismisive like this.  I suggest you take this more seriously..

EDIT2: Again saying that its no problem that Google Analytics is used on MyMonero - you are either clueless about web development / security or lying....

I'm highlighting a structural setup in Monero that *enables* the dev, who is selling a coin as untraceable & anonymous, to be the only one to effectively see the XMR blockchain/distribution/movements, via MyMonero.com.

And the fact that most people have to use MyMonero because the official wallet doesn't work properly, after 1 year, again *enables* an exploit like this to take place..

My suspicion is that Fluffy is in fact a large force on Poloniex (and I saw yesterday people discussing that he was there)

So reasonable to think something fishy might be going on here and I am just sharing my thoughts....

Slightly alarming to have you and Othe here trying to flatly dismiss this actually...(because I would have expected a simple explanation and not vitriol / diversion)

1. The important stuff is done clientside...I am not going to explain you how JAVASCRIPT works, take some basic pc learning course for that or ask Mr. Duff.
You posted the code yourself, ga('send', 'pageview'); - it just sends pageviews.

2. Theres nothing to justify, MyMonero is a third party project from Fluffypony that the community wanted to have. They can decide to use it or not, its that easy but that doesn´t get into your little narrowminded braincells. Unlike DASH - Monero isn´t a company and everyone can do what he wants.
We even have decentralized Wallets:
- MoneroX
- LiteWallet
- Antantst Wallet
- MyMonero
- Simplewallet

everyone can use what he wants, unlike with Dash were everyone is forced to use the BitcoinQT copy/pasted Wallet.

3. It´s so fucking dumb to compare a webservice with monero itself.

You are always wrong, but too narrowminded to accept it, why should we even explain it again after already doing it?


You know sooo much about Monero, awesome investigation.


It´s just your brain that doesn´t make much sense.


I hereby allow Busoni to post my trading statistics for Monero on Poloniex, when Evan Duffield allows the same for Cryptsy and Bitfinex in the case of Dash.

Please don't take this thread too seriously. It's obviously an attempt to troll the community.
BlockaFett argument's would be taken seriously only IF he was addressing all these "problems" to Monero's devs and trying to find solutions.


Of course it is a bad habit to use only one exchange.
Of course it is a bad habit to use a wallet that you didn't compile from the source code but instead trust a dev that made a wallet for you.
But hey... let people take responsibility for their acts.

Othe you keep saying Bitcoin has Bitcoin.info...Bitcoin *is not* claiming to be untraceable and anonymous like you are.

If it was, trying to get all users to type their transactions into a webform on the Dev's personal server, would obviously *undermine the untraceability* 100%.

(and all the info Bitcoin.info can access is *publically available* on the BTC blockchain anyway, info that MyMonero has access to is not so they have a big advantage in a Cryptonote coin)

I don't understand, how can you justify making a web wallet for a coin you claim is "anonymous and untraceable" when the site owner can then access and *break* all the untraceability (and potentially then use this info to their advantage as everyone else in the market is in the dark).

For example looking at the page source on MyMonero, it's running Google Analytics (a service designed to let site owners and Google learn the most information possible about the site's visitors)



Why has all this been done, it doesn't make any sense.  And if the core team are infact major players on Poloniex instead of poor hardworking devs who need donations, with the above situation, red flags are going up for me.

If I'm wrong, please explain it...

EDIT: BTW are you a Monero dev?

You are just pissed that its not possible to make a good working Webwallet for Dash - because of the broken by design coinjoin crap which needs premixes and which needs you to be online the whole time.
We did it, because we can and because most users wanted a simple to use Webwallet like Blockchain.info for BTC.
No one uses BitcoinQT, 90% or so of users choose SPV Wallets. It is how it is.

The Fact is, we have a mobile wallet solution which supports Mixin and DASH has nothing, theres simply no way to darksend coins on a mobile device.
Maybe you should code one, which you can´t, because DASH is over a year old and still has no Mobile wallet with darksend support?? Is it true?


Cryptsy has no reaso to not add it, they are just too lazy and/or stupid. Fact.
Same reason they also take years to add non Btc clones.
Wallet work fine, but theres something in your head which doesnt get that obviously.

PS: Great timing, just in time with the next Otoh PUMP https://bitcointalksearch.org/topic/m.11510173

don't know... I thought the coinbase-debacle was pretty telling... when fungibility disappears I'm looking elsewhere to store value... But that's subjective off course

I think the technological progress is nowehere near significant enough to replace what's been working for years. You could create a coin with all the best features of the top coins and it would still be traded through bitcoin.
There will be better alternatives, but I don't think that coin exists yet.

yeah, technological progress doesn't exist... there will never be better alternatives, bitcoin has no fungibility problem, i shit flowers and ride pink ponies...

I couldn't care less about that instamined nonsense nor do I care about Monero/Nem/NXT I just find it funny when people are convinced that any of these coins have an actual chance at challenging bitcoin when in reality these coins probably won't even stay relevant in a few years.

Viewkeys is one thing but when you run a website you have access to all the data entered in every form, so MyMonero.com is positioned to collect pretty much all the data on the users including what amounts they type in, addresses, who sends to who and how much, what is distribution, plus their IPs, browser / OS type, etc etc, which made me wonder why? because the whole point of Cryptonote is to hide such info, why take Bytecoin which is client-based like all cryptos then dev a single website to route all that through a single server instead.  

So it just seems like an odd choice - take over development of an untraceable coin, then instead of developing the client wallet to be secure / anonymous / usable, you spend that development time making a website delivered from your own server instead.

1 year on and nothing has changed - new users go to MyMonero and the official wallet still not working properly.

Why?  MyMonero.com took development time and $ to build, why spend on that and not on a decent anonymous client wallet for users so they don't have to use a server?

One explanation might be that centralized payment sites are what Fluffy is used to and feels comfortable developing (as he tried Vertpay.com before and also working on Paybee.com now)

Either way, the solution is surely to get rid of MyMonero.com - Monero just can't be untraceable / anonymous with the bulk of it's users doing their transactions through a single server owned by the dev

Plus get volume spread across different exchanges and not just through Poloniex - my understanding is exchanges like Cryptsy didn't add Monero again because of problems with the official wallet client - so same problem, same solution, get the wallet working...

EDIT: Dash supporters thanks for not posting here...if there is any truth to what I am saying it's better for Monero to fix it than have arguments over who's coin is better...thanks.

There are several Monero GUI valets.

When i started with Monero in May 2014 i started on one of first GUI vallet, but latter rather starting using simple vallet, since for me simple is perfect .

I have no ideas where your ignorance come from.  Monero GUI valets are mention in many threads on this forum. Some even have their own thread, where you can monitor how they developed.

There is no innocence there, it was copied for sure, so if they infringed on someone else's code than i bet my 100 moneros that a scam it is

http://www8.gmanews.tv/webpics/v3/2012/02/Admiral-Ackbar_Its-a-scam.jpg

Pathetic little liers, it´s almost funny...

1. There are several working GUI´s linked: http://getmonero.org/getting-started/choose
2. MyMonero doesn´t have your spendkeys, that means only the MyMonero users can spend their own funds.
...
47. https://www.cryptsy.com/coinvotes/ - we voted for it on Cryptsy and it was on #1 for several months, why don´t you ask them why they don´t add it? Did Dash pay them off to not add it?


Not going to answer the rest of your bullshit, has already been answered x times.

make sense
considering the low level of replies and argumentations from moronero shill accounts this can actually be true

it's easy to scream SCAM louder than anybody else just to cover your own tricks and take advantage of your own community (moreno users have been victim of fraud for more than a year now)

I understund your arguments and I am sorry about all the people here attacking DASH vs Monero based on you beeing an DASH holder, I think XMR is for me like DASH is for you, so we are in the same position..
About your concerns I personally believe that fluffyponny is honest, even if he wanted to take advantage from the viewkeys that he have on mymonero i think there is no mutch information that can be used to know if the market is going up or down, he can have only some perseption for the ones who are on XMR for long term... the ones who short keep the coins on exchange...

About poloniex beeing the main exchange i dont like that fact too, but its not devs fault.. They try to contact another exchanges multiple times to add monero, but for some reason (dont know what, the volume is pretty high) they have allways some problem in adding it

There is no official GUI because there is more important things to do before that, and over time i saw that clearly.. there are alot of unofficial guis that can be used and working fine for the current daemon... Finishing the DB version and releasing an propper API for the wallet at this stage its primary, what is the point in having an official gui if there is almost no market for this coin yet ?
Of course that you can say that fluffypony beeing an core dev should had focus his energy on releasing first one official gui before creating and releasing his own, but this is an opensource project and he is doing his work voluntary, I think its better having him working for the cominity and for himself rather than working for himself only

Both monero and dash are a piece of scam junk, both beling in the trash.

I know he said dont intervene but how can i just watch this 

If DASH is scam, then wtf is Monero?? MOTHER OF ALL SCAMS

if DASH is scam, why so many buys in last days

if DASH is scam, how come nobody has break his mixing service amd instantx, and prove that Evan is full of shit?

...

And myraid coin wins, lolz

Pathetic trolls we got here

Benthach, why are you always so bent out of shape in every thread I see you post in?

both suck

both monero and dash are shit coins. shit name and shit brand, actually they don't have brand, they have shit nonsense coin name. lol

You are just another Darkcoin/Dash shill

Problem is that it's all speculation as you said. None of what's in the OP about pumping and so on has any basis in fact. I can very well say Gavin Anderson was a CIA agent like so many have been doing in the Bitcoin Discussion section, but that's all "speculation"(Aka nonsense).

So yes, this thread looks like 100% trolling.

totally not my intention, probably bad idea to start this

As someone who dislike both Monero and Dash, I think this might be worrying for some considering Polo is entirely dependent on FinCEN. And then there's the very slim possibility of Polo getting hacked, either way it's centralization in a way.

Not calling Monero a scam, because I have zero evidence that it is.  OP is speculation and I am biased like I said.  Just sharing my tinfoil hat theory from today.

Most coins have something shady in their past.  Dash beginnings are probably the most investigated, I checked it out and decided to invest, that's it really, everyone make their own decision.

It's going to be too hard for me to add any value on anything here, kind of looks just like Dash supporter attacking Monero which wasn't the intention.

It's reply-bait. The only purpose of this thread is so the words 'Investigate Monero' can be perpetually alive in the altcoin section, thus subtly insinuating that it's some kind of scam. The actual dialogue is meaningless.

I don´t mind you investigating, when there is a flaw it needs to be fixed... if its a flaw.

But what i mind is that i do not understand that you call Monero a scam... but are perfectly fine about Dash´s shady past ( which we don´t need to get into because all has been said plenty of times )

Some of you might know me from investigating the Mintpal V2 scam after losing BTC there.

Also some of you know me from lots of confrontations with core Monero supporters / devs on various threads with my Dash investor hat on, which I recently moved most of my alts into.

So I am not the person to be unbiased / neutral when discussing Monero - it's one of several competitors to my main investment so this gives me a conflict of interest when criticizing it.

That being said I just want to share this in case there is more to it and someone else wants to look into it and without wanting to slander Monero because this is just pure speculation.

(note, I started putting reference in but can't be bothered, if you want for something below then ask)

UPDATE 4th June: Security issues found with MyMonero.com sending the private key to the server in a cookie for some users, as per the posts starting here: https://bitcointalksearch.org/topic/m.11529538

-------------------------------

A lot of Monero users use (and get recommended to use) MyMonero.com, their web wallet ran by lead dev Fluffypony, instead of the official wallet client - because the wallet client has no GUI and a lot of technical / usability issues (e.g. just today here and here)

So Fluffypony can technically access distribution / what funds are moving around for all MyMonero wallets which could give him leading info on the market and pumps / dumps etc, whilst no-one else can (being a Cryptonote coin you can't see anything on the blockchain like distribution).

On it's own this might be innocent / incompetent in terms of centralizing / deanonimizing Monero users and transactions whilst simultaneously claiming your coin is the most anonymous and decentrazlied coin.

But then we find out that Fluffypony has done this before in trying to setup the same type of site for Vertcoin (Vertpay.com) and raising $200,000 to develop that from VTC users.  And that he is also working on Paybee.com, another payment site.

Next thing is that 95% of XMR volume is through one exchange, meaning open-season on price-manipulation, and bigger profits from anyone with leading info on what users are doing - and this has been the case for 1 year already, still no other exchanges

So just connecting the dots but what if it's no accident that Monero wallet is dysfunctional after one year (crippled?) and so most wallets are on MyMonero.com and under the sole visibility of the core team, that all volume is still on Poloniex giving whales their a single place to manipulate after one year, that the GUI wasn't added even now Cryptonote has made an open source one so most people go to MyMonero.com, and all on the "most secure and untraceable coin".

Plus we know that Monero did launch a crippled miner with things like useless loops inserted to slow the mining down, although we don't know if this was innocently copied in from Bytecoin or not.  

Potentially, are we are looking at a coin *setup* as a scam here, with various parts crippled to make sure the core team are the only ones with access to the key 'behind the scenes' market information and are also actually big investors / traders, that all trade is through Poloniex, and then they go around accusing everyone else of being a scam whilst scamming XMR volume behind the scenes?

Maybe Cryptnote is a prime target for this kind of stuff because everything is hidden - in such an environment, MyMonero / Poloniex owners can go wild if they make use of the info that no one else can have....

I'm sure a lot of the Fluffypony fans will be outraged at this suggestion.  And I could be totally wrong.  But if your argument is "I know Fluffy wouldn't do that" then lol because you should no in crypto now anything like this can and does happen, regularly..

No offence to Monero investors here....if i'm totally wrong then sorry for suggesting.  And this isn't to help Dash in any way, that coin is strong enough on it's own without needing any trolling and i'm probably the only Dash supporter bothering about the Monero trolling and that's because i'm new probably - I was investigating Mintpal before I went Dash and i'm good at it so that's where i'm coming from and I learnt a lot about Monero recently.

anyway...let the roasting commence.

[BTW - if you are a Dash supporter, please don't post here to bash Monero as you will be biased; I am not here for anything to do with Dash]