[XMR] Monero Speculation - page 1452.

dEBRUYNE

legendary

Activity: 2268

Merit: 1141

Quote from: primer- on March 17, 2016, 08:28:06 AM

There's a hard fork in less than a week and no binaries have yet been released ?!

Did you miss this? Also, any 0.9.x version is fine in advance of the hardfork. The first 0.9.x version was released on 31 December 2015.

Quote from: dEBRUYNE on March 16, 2016, 07:51:25 PM

Monero v0.9.2 - Hydrogen Helix - released! (Urgent and important bug fixes for the upcoming hard fork)

https://github.com/monero-project/bitmonero/releases/tag/v0.9.2

Quote

will do shasums / gpg signed mesage tomorrow

Information from Github:

Quote

This has urgent and important bug fixes to 0.9.0 Hydrogen Helix

Major performance and size improvements to the LMDB database implementation
Urgent and important bug fixes for the upcoming hard fork
Huge bug fixes to the database hard fork handling
New simplewallet flag to restore from keys
Initial work on a wallet library / API
Updated in-source block headers

General hardfork information:

Background:

https://forum.getmonero.org/4/academic-and-technical/303/a-formal-approach-towards-better-hard-fork-management

Quote

What are the change(s) with the upcoming hard fork on the 20th of March?

Blocktime is bumped from 1 to 2 minutes. See:

https://forum.getmonero.org/20/general-discussion/2401/increasing-the-block-time

Minimum blocksize is bumped to 60 KB. See:

https://forum.getmonero.org/20/general-discussion/2409/increasing-the-minimum-block-size

A big advantage of this is that current individual transactions that sometimes won't go through (because they are a bit above the median due to many outputs (e.g. dust), or the daemon / MyMonero rejects them for some reason) can easily be included in the block without incurring a penalty. Above is a bit of a blunt explanation, I am sure one of the core-team members / developers could give you a more detailed explanation.

Finally, the recommendations from the MRL team stated in MRL-0004, of which the minimum mixin >= 3 is probably the most salient. See:

https://lab.getmonero.org/pubs/MRL-0004.pdf

P.S. Due to variance the hard fork will likely be on the 21th or 22th of March. A specific block height was determined for the hardfork, not a specific date. The specific blockheight for the hardfork can be found here:

https://github.com/monero-project/bitmonero/blob/master/src/cryptonote_core/blockchain.cpp#L83

Quote

// version 2 starts from block 1009827

dEBRUYNE

legendary

Activity: 2268

Merit: 1141

Quote from: Hueristic on March 17, 2016, 11:41:55 AM

Quote from: GingerAle on March 17, 2016, 09:44:58 AM

Quote from: papa_lazzarou on March 17, 2016, 09:09:33 AM

Quote from: smooth on March 17, 2016, 07:48:19 AM

Quote from: papa_lazzarou on March 17, 2016, 06:57:58 AM

If I understood correctly (bear in mind that this rarely happens Tongue

) fluffypony was referring to the possibility of MITM attacks.

In part yes, but also malware on your computer. There is no substitute for cold storage, paper wallets, good hardware wallets, etc.

Quote

So, afaik, there is nothing less secure with the wallets created with mymonero (discounting the 13 vs 24 word mnemonic).

If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish.

That is true assuming you are completely sure that nothing was compromised when you created it. Hard to really know that.

Well, what I wanted to convey is that, if one has already created the wallet for cold storage in mymonero, either the coins are already gone or they are still there. Tongue

Therefore, accessing mymonero just to transfer the coins to another cold storage may in fact worsen your chances of getting hacked. It would be safer to wait for the code to restore short mnemonic seeds to be available for offline use. Either through simplewallet or a third party client.

I'll just speculate here, but I believe what was ultimately referred to was the vulnerability of MITM when accessing mymonero via Tor because outproxies are essentially just "men in the middle" and anyone using them is trusting that they are benign. I'm pretty sure that if you see the https in standard clearnet, things are encrypted end to end so noone in the middle can read your stuffs. This doesn't prevent malware on your end from swiping your stuffs though. Keyloggers I guess would be the main thing. Or if your text input into the mymonero login is stored temporarily in any fashion. But ultimately I don't really know what I'm talking about, I'm just piecing together what I've gathered so far.

What concerns me is the amount that was stolen. That had to have been one of the larger if not the largest wallet on there. That says to me someone either targeted him specifically or had/has access to that info. I would not consider MyMonero safe for other than pocket change. And expect that someday every one of those accounts will be emptied. The Odds of only his account (specifically such a large one) going through a poison Tor node are So extremely low I can't even entertain the thought of that being the method of compromise.

Highly unlikely it was a targeted attack. Also, fairly unlikely that it was a Tor MITM attack. Even if it was, it probably was a driveby attack instead of a targeted one. MyMonero doesn't have a .onion link and therefore it is fairly easy to perform an MITM attack for a tor exit node (I think fluffypony stated that they already had earlier cases of TOR MITM attacks on MyMonero). Same happened to blockchain.info before they had a .onion address. Lots of threads about people that had their BTC stolen.

It is more likely malware/trojan/rootkit/virus etc. that somehow stole his XMR, i.e. acquired his seed somehow.

dEBRUYNE

legendary

Activity: 2268

Merit: 1141

Quote from: Quicken on March 17, 2016, 11:30:32 AM

Quote from: dnaleor on March 17, 2016, 10:13:42 AM

Quote from: Quicken on March 17, 2016, 09:58:16 AM

I am considering getting a Trezor. I have little interest in BTC at the moment (though multi-coin capability may be handy), so this would be based on the expectation that XMR compatible Trezor firmware will be fully functional going forward. Reasonable assumption?
Q

It already works

http://weuse.cash/2016/03/07/trezor-for-monero-first-impressions/

Just consider it beta until it's merged with the official Trezor firmware Wink

Yeah, I guess I mean is it a good bet that this will get official. I would be looking to use this for more than testing. Not really sure how bg a deal the viewkey transmission is.

Anyway, I prefer the idea of Trezor to paper wallets, so I hope it happens. Thanks to NoodleDoodle for doing the groundwork on this.

Q

One of the trezor founders was asking for testers, so most likely it gets merged upstream (and thus signed by Trezor) once the code is finalized. See:

https://twitter.com/AlenaSatoshi/status/709837766150983680

dEBRUYNE

legendary

Activity: 2268

Merit: 1141

Quote from: Quicken on March 17, 2016, 11:30:32 AM

Quote from: dnaleor on March 17, 2016, 10:13:42 AM

Quote from: Quicken on March 17, 2016, 09:58:16 AM

I am considering getting a Trezor. I have little interest in BTC at the moment (though multi-coin capability may be handy), so this would be based on the expectation that XMR compatible Trezor firmware will be fully functional going forward. Reasonable assumption?
Q

It already works

http://weuse.cash/2016/03/07/trezor-for-monero-first-impressions/

Just consider it beta until it's merged with the official Trezor firmware Wink

Yeah, I guess I mean is it a good bet that this will get official. I would be looking to use this for more than testing. Not really sure how bg a deal the viewkey transmission is.

Anyway, I prefer the idea of Trezor to paper wallets, so I hope it happens. Thanks to NoodleDoodle for doing the groundwork on this.

Q

There is a guide/example here:

"Generate simplewallet based on MyMonero 13 word mnemonic seed"

https://github.com/moneroexamples/mymonero-simplewallet

Hueristic

legendary

Activity: 3836

Merit: 4969

Doomed to see the future and unable to prevent it

Quote from: jwinterm on March 17, 2016, 08:41:49 AM

Quote from: primer- on March 17, 2016, 08:28:06 AM

There's a hard fork in less than a week and no binaries have yet been released ?!

Any binary that is v0.9.x is compatible. So, the first compatible version was released in December I believe.

Batter Swings and misses Again! About 6 months before you can get your participation trophy primer.

Quote from: americanpegasus on March 16, 2016, 08:48:54 PM

Watching Vanilla Scam and Dash Scam get pumped while Monero stays even for the day. Huh

Worked out for me! Cheesy

But I have no faith in BTC so I cashed it out the last few months and cannot accure more without using otb or us getting a pairing. Anyone wants to do a OTB sale to me can PM. As you can see I will only buy in the dips.

Just for SlapHappy as requested. BTW slap you can pm me when you want to act like an adult and I'll consider your words on whether to remove you from ignore. Questioning my integrity and calling me a liar is pretty much a line you don't come back from.

Quote from: GingerAle on March 17, 2016, 09:44:58 AM

Quote from: papa_lazzarou on March 17, 2016, 09:09:33 AM

Quote from: smooth on March 17, 2016, 07:48:19 AM

Quote from: papa_lazzarou on March 17, 2016, 06:57:58 AM

If I understood correctly (bear in mind that this rarely happens Tongue

) fluffypony was referring to the possibility of MITM attacks.

In part yes, but also malware on your computer. There is no substitute for cold storage, paper wallets, good hardware wallets, etc.

Quote

So, afaik, there is nothing less secure with the wallets created with mymonero (discounting the 13 vs 24 word mnemonic).

If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish.

That is true assuming you are completely sure that nothing was compromised when you created it. Hard to really know that.

Well, what I wanted to convey is that, if one has already created the wallet for cold storage in mymonero, either the coins are already gone or they are still there. Tongue

Therefore, accessing mymonero just to transfer the coins to another cold storage may in fact worsen your chances of getting hacked. It would be safer to wait for the code to restore short mnemonic seeds to be available for offline use. Either through simplewallet or a third party client.

I'll just speculate here, but I believe what was ultimately referred to was the vulnerability of MITM when accessing mymonero via Tor because outproxies are essentially just "men in the middle" and anyone using them is trusting that they are benign. I'm pretty sure that if you see the https in standard clearnet, things are encrypted end to end so noone in the middle can read your stuffs. This doesn't prevent malware on your end from swiping your stuffs though. Keyloggers I guess would be the main thing. Or if your text input into the mymonero login is stored temporarily in any fashion. But ultimately I don't really know what I'm talking about, I'm just piecing together what I've gathered so far.

What concerns me is the amount that was stolen. That had to have been one of the larger if not the largest wallet on there. That says to me someone either targeted him specifically or had/has access to that info. I would not consider MyMonero safe for other than pocket change. And expect that someday every one of those accounts will be emptied. The Odds of only his account (specifically such a large one) going through a poison Tor node are So extremely low I can't even entertain the thought of that being the method of compromise.

Quicken

sr. member

Activity: 280

Merit: 250

Quote from: dnaleor on March 17, 2016, 10:13:42 AM

Quote from: Quicken on March 17, 2016, 09:58:16 AM

I am considering getting a Trezor. I have little interest in BTC at the moment (though multi-coin capability may be handy), so this would be based on the expectation that XMR compatible Trezor firmware will be fully functional going forward. Reasonable assumption?
Q

It already works

http://weuse.cash/2016/03/07/trezor-for-monero-first-impressions/

Just consider it beta until it's merged with the official Trezor firmware Wink

Yeah, I guess I mean is it a good bet that this will get official. I would be looking to use this for more than testing. Not really sure how bg a deal the viewkey transmission is.

Anyway, I prefer the idea of Trezor to paper wallets, so I hope it happens. Thanks to NoodleDoodle for doing the groundwork on this.

Q

birr

hero member

Activity: 870

Merit: 585

Quote from: papa_lazzarou on March 17, 2016, 09:09:33 AM

Quote from: smooth on March 17, 2016, 07:48:19 AM

Quote from: papa_lazzarou on March 17, 2016, 06:57:58 AM

If I understood correctly (bear in mind that this rarely happens Tongue

) fluffypony was referring to the possibility of MITM attacks.

In part yes, but also malware on your computer. There is no substitute for cold storage, paper wallets, good hardware wallets, etc.

Quote

So, afaik, there is nothing less secure with the wallets created with mymonero (discounting the 13 vs 24 word mnemonic).

If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish.

That is true assuming you are completely sure that nothing was compromised when you created it. Hard to really know that.

Well, what I wanted to convey is that, if one has already created the wallet for cold storage in mymonero, either the coins are already gone or they are still there. Tongue

Therefore, accessing mymonero just to transfer the coins to another cold storage may in fact worsen your chances of getting hacked. It would be safer to wait for the code to restore short mnemonic seeds to be available for offline use. Either through simplewallet or a third party client.

Another option is to do the conversion from 13 to 25 words. Who has link(s) to how you do that? I'm very interested.

dnaleor

legendary

Activity: 1470

Merit: 1000

Want privacy? Use Monero!

Quote from: griffen1102 on March 17, 2016, 09:30:13 AM

today or tomorrow.

I prefer a log chart, makes more sense, imho:

dnaleor

legendary

Activity: 1470

Merit: 1000

Want privacy? Use Monero!

Quote from: Quicken on March 17, 2016, 09:58:16 AM

I am considering getting a Trezor. I have little interest in BTC at the moment (though multi-coin capability may be handy), so this would be based on the expectation that XMR compatible Trezor firmware will be fully functional going forward. Reasonable assumption?
Q

It already works

http://weuse.cash/2016/03/07/trezor-for-monero-first-impressions/

Just consider it beta until it's merged with the official Trezor firmware Wink

Quicken

sr. member

Activity: 280

Merit: 250

I am considering getting a Trezor. I have little interest in BTC at the moment (though multi-coin capability may be handy), so this would be based on the expectation that XMR compatible Trezor firmware will be fully functional going forward. Reasonable assumption?
Q

GingerAle

legendary

Activity: 1260

Merit: 1008

Quote from: papa_lazzarou on March 17, 2016, 09:09:33 AM

Quote from: smooth on March 17, 2016, 07:48:19 AM

Quote from: papa_lazzarou on March 17, 2016, 06:57:58 AM

If I understood correctly (bear in mind that this rarely happens Tongue

) fluffypony was referring to the possibility of MITM attacks.

In part yes, but also malware on your computer. There is no substitute for cold storage, paper wallets, good hardware wallets, etc.

Quote

So, afaik, there is nothing less secure with the wallets created with mymonero (discounting the 13 vs 24 word mnemonic).

If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish.

That is true assuming you are completely sure that nothing was compromised when you created it. Hard to really know that.

Well, what I wanted to convey is that, if one has already created the wallet for cold storage in mymonero, either the coins are already gone or they are still there. Tongue

Therefore, accessing mymonero just to transfer the coins to another cold storage may in fact worsen your chances of getting hacked. It would be safer to wait for the code to restore short mnemonic seeds to be available for offline use. Either through simplewallet or a third party client.

I'll just speculate here, but I believe what was ultimately referred to was the vulnerability of MITM when accessing mymonero via Tor because outproxies are essentially just "men in the middle" and anyone using them is trusting that they are benign. I'm pretty sure that if you see the https in standard clearnet, things are encrypted end to end so noone in the middle can read your stuffs. This doesn't prevent malware on your end from swiping your stuffs though. Keyloggers I guess would be the main thing. Or if your text input into the mymonero login is stored temporarily in any fashion. But ultimately I don't really know what I'm talking about, I'm just piecing together what I've gathered so far.

Dotto

legendary

Activity: 981

Merit: 1005

No maps for these territories

ETH going to hell. Monero waiting. We could be be in decoupling time.

griffen1102

full member

Activity: 229

Merit: 100

today or tomorrow.

papa_lazzarou

hero member

Activity: 649

Merit: 500

Quote from: smooth on March 17, 2016, 07:48:19 AM

Quote from: papa_lazzarou on March 17, 2016, 06:57:58 AM

If I understood correctly (bear in mind that this rarely happens Tongue

) fluffypony was referring to the possibility of MITM attacks.

In part yes, but also malware on your computer. There is no substitute for cold storage, paper wallets, good hardware wallets, etc.

Quote

So, afaik, there is nothing less secure with the wallets created with mymonero (discounting the 13 vs 24 word mnemonic).

If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish.

That is true assuming you are completely sure that nothing was compromised when you created it. Hard to really know that.

Well, what I wanted to convey is that, if one has already created the wallet for cold storage in mymonero, either the coins are already gone or they are still there. Tongue

Therefore, accessing mymonero just to transfer the coins to another cold storage may in fact worsen your chances of getting hacked. It would be safer to wait for the code to restore short mnemonic seeds to be available for offline use. Either through simplewallet or a third party client.

jwinterm

legendary

Activity: 3164

Merit: 1116

Quote from: primer- on March 17, 2016, 08:28:06 AM

There's a hard fork in less than a week and no binaries have yet been released ?!

Any binary that is v0.9.x is compatible. So, the first compatible version was released in December I believe.

primer-

legendary

Activity: 1092

Merit: 1000

There's a hard fork in less than a week and no binaries have yet been released ?!

smooth

legendary

Activity: 2968

Merit: 1198

Quote from: papa_lazzarou on March 17, 2016, 06:57:58 AM

If I understood correctly (bear in mind that this rarely happens Tongue

) fluffypony was referring to the possibility of MITM attacks.

In part yes, but also malware on your computer. There is no substitute for cold storage, paper wallets, good hardware wallets, etc.

Quote

So, afaik, there is nothing less secure with the wallets created with mymonero (discounting the 13 vs 24 word mnemonic).

If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish.

That is true assuming you are completely sure that nothing was compromised when you created it. Hard to really know that.

papa_lazzarou

hero member

Activity: 649

Merit: 500

Quote from: dEBRUYNE on March 16, 2016, 04:54:45 PM

Quote from: RAJSALLIN on March 16, 2016, 04:51:57 PM

I have coins stored on wallets created with mymonero.com. Are they less secure than a paper wallet created with moneroaddress.org?

Unfortunately yes, fluffypony discourages storing any relatively large amounts there because webwallets always bring an additional layer of risk. Therefore, I would recommend to use https://moneroaddress.org to create a paper wallet. Alternatively, if you are fairly paranoid, use this guide:

https://www.reddit.com/r/Monero/comments/48cgmd/an_extensive_guide_for_securely_generating_an/

The guide ensures that the only way your coins can get stolen is physical access, which is extremely rare. It might take you a few hours to get familiar and comfortable with, but in the end it brings ease to the mind.

If I understood correctly (bear in mind that this rarely happens Tongue

) fluffypony was referring to the possibility of MITM attacks. So every time you access mymonero you are incurring the risk of getting your coins stolen. So, afaik, there is nothing less secure with the wallets created with mymonero (discounting the 13 vs 24 word mnemonic).

If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish. And instead of logging in to transfer your funds to a proper cold address/account, you'd be better off not to. Wait instead for the short mnemonic seed to be supported by simplewallet.

Guys in the know: amirite?

EDIT: Adding context
https://www.reddit.com/r/Monero/comments/491gbj/i_lost_some_monero_that_i_had_on_mymonerocom/d0ocdpm

nioc

legendary

Activity: 1624

Merit: 1008

Quote from: Dotto on March 17, 2016, 04:48:31 AM

Pretty big triangle closing in less than 12h, visible in 2h. If done right we could be reaching .0035-.004 area. If gone wrongside, we could face .002 arena... Thoughts?

You use TA and I use my subconscious. Seems like something is brewing. I don't think .002 or .0035-.004 is possible for the time frame you are talking about. Too much support to allow 0.002 and too much resistance until accumulation is finished. When will that be finished? NFC. Good luck Cool

For now that leaves nowhere...........

https://www.youtube.com/watch?v=AWtCittJyr0

Dotto

legendary

Activity: 981

Merit: 1005

No maps for these territories

Pretty big triangle closing in less than 12h, visible in 2h. If done right we could be reaching .0035-.004 area. If gone wrongside, we could face .002 arena... Thoughts?

Topic: [XMR] Monero Speculation - page 1452. (Read 3313576 times)