Saki

joined 2 years ago
MODERATOR OF
[–] Saki@monero.town 1 points 1 year ago (3 children)

Cake Pay should be fine for most gift cards, I don’t think they usually ask for KYC for those.

So perhaps your recent bad experience with Mastercard EUR cards are rather exceptional?

[–] Saki@monero.town 3 points 1 year ago (5 children)

Thanks for warning. Saw https://monero.town/post/872283 too. Guess Cake Pay may be convenient for those who are fine with KYC. Another option, that Stealths thing is more expensive (higher fees), so basically if you want to buy a gift card here or there, you’ll have to choose between (possible) KYC and higher fees. Or so it seems…

[–] Saki@monero.town 3 points 1 year ago (1 children)

According to @azalty@monero.town, Cake Pay works fine if you’re fine with KYC, and otherwise you may just lose your money: https://monero.town/post/872283

If you’re a privacy advocate not fully supporting KYC but want to try this anyway, then try a small amount, because you may lose all your money. Another recent option is more privacy-friendly and KYC-free, but the fees are higher with them.

[–] Saki@monero.town 2 points 1 year ago

We know the ability to get Monero will not be essentially affected—after all, this is not the first time, nor the second time, when Monero is delisted. It seems reasonable to admit, though, that ultimately the ability/freedom to spend Monero might be limited if legit (e.g. hosting) companies can’t accept it in the future—directly or indirectly because of MiCA etc. Although, what will happen in such a situation may be seen as an interesting experiment.


Since the posted link is not very Tor-friendly behind CF, similar random links just in case…

Following the announcement, privacy tokens such as Dash (DASH), Monero (XMR), and Zcash (ZEC) witnessed a notable decline of up to 10%

The prices of some of these tokens have headed south shortly after the announcement. XMR is down nearly 3% in the past 24 hours, while ZEC has plunged by 10%

[–] Saki@monero.town 4 points 1 year ago (2 children)

The concept may be lovely, but the fact is, many people nowadays have been Pavlov’ed to immediately ignore anything weird that says, "Congratulations! You got some money. Visit this URL and input something." As they say, the Cake is a lie…

Monero could be a wonderful gift to a friend of yours if they’re especially interested in privacy (in that case, you might want to talk to them privately, and perhaps recommend a better wallet). Otherwise, it may be kind of like casting pearls before swine…

[–] Saki@monero.town 6 points 1 year ago* (last edited 1 year ago)

Tor Browser is planning to remove Google from the search engine options a user can choose: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41835

There some say brave onion + no JS is good: https://search.brave4u7jddbv7cyviptqjc7jusxh72uik7zt6adtckl5f4nwy2v72qd.onion/

Mullvad team seems to be considering 4 possible options:


PS: Not disgussing ddg / ddg onion too much, basically because ddg is the long-time default search engine of TB. Most TB users assume ddg is a decent, standard, generic option, esp. its non-JS version.

[–] Saki@monero.town 1 points 1 year ago

Dr. Strangemoney…

A sister meme by the same OP @rottenwheel : https://monero.town/post/1210342 also titled There's an app for that (Black jokes possibly easily misunderstood)

Unfortunately qu.ax seems to be blocking Tor now.

[–] Saki@monero.town 1 points 1 year ago* (last edited 1 year ago)

Trocador shows it explicitly whether a specific CEX is no-log or requiting IP logging, which you can choose. This new thing doesn’t have TOS nor Privacy Policy to begin with. Yet as long as you use onion, logging by the front-end is rather irrelevant.

Even if the front-end is not logging anything (which no one can verify), a CEX behind it surely records the tx and retains it as required by laws (some of them might be less than perfectly legal and might not record anything, though that would mean a different kind of risk). Using a CEX is more or less risky, be it Trocador or something else. Some may think that an instant swap by CEX is convenient. Personally I prefer DEX, even though it may be less convenient, even though Monero.town itself has an official affiliate link to Trocador too.

[–] Saki@monero.town 2 points 1 year ago

Asia might potentially be a better idea (not Japan or Korea though)

You mean, like Hong Kong, or India, maybe? What do you mean by “not Japan or Korea though”? I’d feel China would be worse. Privacy-focused services tend to be pricey anyway, both in Europe and in the US, and the price comparison is tricky as EUR/USD can move weirdly. If you’re talking about Njalla (Sweden), it’s indeed rather expensive.

Although France seems to be generally anti-cryptography, of course you wouldn’t go to jail just because you use Tails. There was this notorious incident related to French activists & Proton, though. Also, the Netherlands can be scary. They arrested a developer of Tornado Cash, right? Although, those things have nothing to do with VPS!

[–] Saki@monero.town 2 points 1 year ago

Thank you so much! These minor details are really helpful :D Happy holidays!

[–] Saki@monero.town 1 points 1 year ago* (last edited 1 year ago)

It’s true that the EU is getting “difficult”. Ironically, the US (without GDPR) can be better, where the right to anonymous speech is more or less protected (although, of course, US hosting companies in general are not good for that).

IncogNet is a good example, where you can get a domain anonymously, just like from Njalla but the price being much affordable. Not only that, they’ll set up an onion/I2P version for your website for free. (This is not a recommendation, though. DYOR.)

Floki was once famous but, yeah… they’re getting a bit less popular now after the Covid things. It’s not Iceland and Seychelles based; basically it’s a German company, having servers in Iceland, Finland, Romania, and the Netherlands. Island was once very popular, but anymore. Using a .is domain now assuming it’s “safer” is a bit yesterday.

Especially, be aware of France: they’re like “you use encryption because you have something to hide, doing something bad.” Also, you might want to avoid EU domains (.fr etc.) in general: check about NIS2, so called “Thick Whois“ to see what this means. For example, you can’t get a .nl anonymous domain anymore (a recent change); a similar trend being expected soon in other EU registrars/resellers i.e. “domain KYC”.

PS: Incognet is based on Fran's (Frantech/BuyVM) in Canada, which has been generally trusted and has some good track record. One might want to consider BuyVM etc. too (Not a recommendation, DYOR).

PPS: Incognet accepts xmr, but you can’t do crypto-related things like mining on their servers. A negative point for some of us.

[–] Saki@monero.town 2 points 1 year ago (3 children)

Exactly how does you activate it? Ordering itself is kyc-free (and even Tor-friendly?) but you’ll need to show your IP to activate it, of course?

 

the onchain activities of the attackers were monitored and […] action was taken to freeze the wallets held by the attackers by working with other cryptocurrency exchanges

a member of the cryptocurrency community questioned how Binance could freeze these funds despite the fact that cryptocurrencies are marketed as not being confiscable by third parties

Changpeng Zhao […] said that the whole thing is a matter of balance. […] CZ implied that a solution to events such as theft cannot be found in a system that cannot be completely frozen.

CZ stated that if users use privacy coins such as Monero (XMR), such freezes will not occur, but the stolen funds cannot be returned.

Cf.

PS. See also: Bitcoin can be traced, If you use XMR, then there isn’t much anyone can do https://monero.town/post/1069626

 

regulatory scrutiny is shifting towards privacy coins […] Understanding how they will be implemented in systems that are decentralized, where the developers and maintainers often maintain anonymity, is complex.

E.g. Bisq, Haveno

compliance with these regulations becomes a paradox for such projects since the crux of privacy coins lies in their ability to mask transaction details, which inherently contradicts the essence of regulations […] Therefore, achieving full regulatory compliance for privacy coins may sometimes seem impossible. […] in the UK, the Financial Conduct Authority (FCA) has been proactive in educating consumers about the risks associated with privacy coins but has not implemented bans or specific regulations concerning them.

in the United States, proposed legislation such as the STABLE Act could further extend the regulatory framework […] it’s plausible that the provisions of the STABLE Act […] could potentially mean that transactions involving privacy coins would need some form of identity verification

A prime example of a regulatory shift impacting privacy coins is the European Union’s Fifth Anti-Money Laundering Directive (5AMLD) […] these platforms are now obliged to implement customer due diligence measures, […] verifying user identities and monitoring transactions for any signs of activity.

Potentially:

  • Alice (unhosted wallet) sends coins to Bob (CEX) -> Alice is also KYCed by the CEX
  • Alice (CEX) sends coins to Bob (unhosted) -> Bob is KYCed too
 

Monero Project admits thieves stole 6-figure sum from a wallet in mystery breach

https://lemmy.world/post/7993453 i.e. https://monero.town/post/1045387

While there are typical comments like crypto=scam “You have to be quite stupid to support crypto in 2023”, there are also replies like these (with which more people seem to agree, unexpectedly):

It’s designed to protect anyone using it - even attackers. That’s the price to pay for having privacy. The alternative is an Orwellian dystopia.

If you’re going to use Luna, FTX, and NFTs as arguments about something like Monero, […] you probably don’t really understand any of them.

It’s a bit odd that such a discussion is more active on a different Lemmy instance than here, but it’s interesting to hear honest opinions of various people about the incident, about Monero. Maybe your views are different from them, from mine. For example, one person states there that while they know exactly what Monaro is, they’re still skeptical.

 

Collateral wallet is 2-3 multi-signature wallet but it doesn't have to be Monero. Bitcoin multi-signature is much more tested and very ease to use using Electrum or similar.

Option two on this topic would be to use Monero multi-signature to keep Collateral.

-4
submitted 2 years ago* (last edited 2 years ago) by Saki@monero.town to c/monero@monero.town
 

Somewhat curious, though not like using xmr speculatively.

  • 2023-11-02T15:57 CCS Wallet Incident · Issue #916 · monero-project/meta · GitHub
  • 2023-11-04T00:39 [Moonstone Research] Postmortem of Monero CCS Hack: A Transaction Graph Analysis (Dated Nov 03)
  • 2023-11-05T07:20 [One of the earliest media reports] Monerujo Wallet User Drains Monero’s CCS Wallet: Report - Coin Edition

Some of the media reports are negatively confusing, like saying the Monero network is defective. Date-Time in UTC.

Edit: Moonstone Research -> 2023-11-04T00:39 was based on the server response headers (last-modified). Apparently the blog post was created about 1 hour earlier (the link was posted on Github at 2023-11-03 23:50).

 

These changes radically expand the capability of EU governments to surveil their citizens by ensuring cryptographic keys under government control can be used to intercept encrypted web traffic

This enables the government of any EU member state to issue website certificates for interception and surveillance

https://www.internetsociety.org/resources/doc/2023/qualified-web-authentication-certificates-qwacs-in-eidas/

The browser ecosystem is global, not EU-bounded. Once a mechanism like QWACs is implemented in browsers, it is open to abuse

https://en.wikipedia.org/wiki/EIDAS

The proposal would force internet companies to place a backdoor in web browsers to let them perform a man-in-the-middle attack, deceiving users into thinking that they were communicating with a server they requested, when, in fact, they would be communicating directly with the EU government. […] If passed, the EU would be able to hack into any internet-enabled device, reading any sensitive or encrypted contents without the user's knowledge

See also: https://mullvad.net/en/blog/2023/11/2/eu-digital-identity-framework-eidas-another-kind-of-chat-control/

 

Nothing really new for us. Just one of the earliest media reports for the record.

Edit (2023-11-06): Apparently, one of the earliest reports about the incident by general (“outside”) media is, Monerujo Wallet User Drains Monero’s CCS Wallet: Report [blocking Tor: archive.org], at 2023-11-05T07:20+00:00.

It’s interesting to see how general people are looking at this, and relatedly how they are thinking about Monero, although generally what’s written there is nothing new nor helpful for us (often disturbingly inaccurate even). For this reason I posted a few random links to related articles. You can add more and comment on it, if there are anything interesting or especially stupid 😖

 

[Edit 2: Read the admin’s “reasoning” and comments here or see PS below. The clearnet site is up again. The onion versions = 100% up tme for me]

[Edit: As of writing this (2023-11-01) their clearnet server is down, while the onion version is working. Cock.li is exactly like this… Relatively rarely but randomly it’s down. Kind of irresponsible but it’s just like that. Interestingly, though, onion is up and clearnet is down. Usually opposite.]

Onion http://rurcblzhmdk22kttfkel2zduhyu3r6to7knyc7wiorzrx5gw4c3lftad.onion/

Cockbox on kycnot.me - https://kycnot.me/service/cockbox “Too bad it costs $9 to send BTC. Bring Monero.”

(From their webpage)

Cock.li is your go-to solution for professional E-mail and XMPP addresses. Since 2013 cock.li has provided stable E-mail services to an ever-increasing number of users. Cock.li allows registration and usage using Tor and other privacy services (proxies, VPNs) and thanks to continued funding by its users is certain to stay free forever.

Cock.li (aka Cockmail) is a Tor-friendly, privacy-focused, soon-to-be-10-year-old free email provider (IMAP, POP, XMPP, Webmail). Although currently (since around 2021) a new registration is invite-only, the admin @vc now states on their website:

E-mail is a Human Right!

Oppressive governments are using dirty tricks to try and force e-mail providers to require phone numbers or other controlled integrations to register. We will never allow these crimes against our userbase. We will stand up for the right to register for e-mail without being surveilled, and demand this right to be recognized globally. Public registration re-opens on cock.li's 10th birthday, 20 November.

Probably people here know this service pretty well, but some important points:

  • Their email addresses are sometimes blacklisted when you want to use them, because in the past the service was abused by spammers. So this provider may not be suitable for normal users/normal usage. Its “technical scores” may be low too, when checked e.g. via https://internet.nl/mail/ If you think this is sketchy and its name is weird, it is. It’s not for you, so please just ignore it.

  • A cock.li account may be great to have if you want to sign up and use it anonymously always via onion (something you can’t do with Proton or Tutanota), perhaps with PGP. Maybe great to use on Tails OS too.

  • Their service was not very stable in the past. In recent years, it’s been rather stable and very fast even via onion. Pop/Imap via Tor works perfectly. Cock.li onion may load 100 times faster than that of Proton.

  • Custom domains are not supported! Consider Disroot or Tutanota if you need them and would like to pay with Monero.

  • They are one of the earliest v3 onion providers. In contrast, Proton was so slow to migrate from v2 to v3 (even after v2 got obsolete). Cock.li is also one of the oldest mail providers that started accepting BTC and XMR donations. So probably they’re extremely well-funded (you know why).

  • If you use Thunderbird, set up your account manually (its automatic setup probably doesn’t work right).

For more info, visit their webpage. Please DO NOT abuse this based cypherpunk service.


PS. Vincent Canfield (vc@shitposter.club) wrote on September 23, 2023:

Good morning, CISA is now calling cock.li a "Malicious E-mail Domain" and implies this is because it's not "publicly available". So, cock.li will once again open to the public on its 10th birthday, 20 November. #StopRansomware

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a

For those who don't remember, a previous CISA advisory which recommended "service providers strengthen their user validation and verification systems to prohibit misuse of their services" shortly predated cock.li going invite only.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a

I'm sure if cock.li added phone number verification these joint statements would go away. Everyone sees what's happening, you want to force all providers to link to identities so you can surveil people. Cock.li is never adding that bullshit.

 

While privacy coins promise enhanced anonymity and financial freedom, they also pose challenges […] they often face heightened regulatory scrutiny, with some governments banning or heavily regulating their use.

the very feature that makes them attractive – their privacy – can also be their Achilles’ heel. […] This dual-edged sword might deter potential new adopters and pose reputational risks for those involved in legitimate uses of privacy coins.

Cryptocurrency privacy is vital for ensuring personal liberty and maintaining fungibility, becoming even more crucial as surveillance and data collection grow. […] a balance of innovative privacy technologies and thoughtful regulation is essential

We all know this; not easy.

 

Hamilton was an Irish mathematician, who discovered quaternions on the 16th of October, 1843. When he discovered them, he was so happy that he carved his fundamental equations i² = j² = k² = ijk = −1 into the stone of a bridge (apparently he was walking near it).

“That is to say, I then and there felt the galvanic circuit of thought close; and the sparks which fell from it were the fundamental equations between i, j, k; exactly such as I have used them ever since.”

If you think this is not fun, please, just ignore it. While I’ll write this like talking to a 14-year-old teen, the following is nerdy (mathematical) and lengthy 😅

Today a hundred and four score years ago, Hamilton discovered “quaternions”. To commemorate this, allow me to use (Monero-flavored) quaternions to prove Euler’s identity: If N is a sum of four squares and n is a sum of four squares too, then Nn is also a sum of four squares.

Example: 8 = 2² + 2² + 0² + 0² and 127 = 9² + 6² + 3² + 1² are sums of four squares. So 8*127 = 1016 must be somehow a sum of four squares too.

Proof: Given N = A² + B² + C² + D² and n = a² + b² + c² + d² with some intergers A, B, C, D, a, b, c, d, we need to show Nn = E² + F² + G² + H² with some integers E, F, G, H. Since we’re Monero fans, let us use X, M, R instead of Hamilton’s i, j, k. Things work in a “cyclic“ way like this:

X² = M² = R² = −1 ... Eq.(1)

XM = R, but MX = −R ... Eq.(2)

MR = X, but RM = −X ... Eq.(3)

RX = M, but XR = −M ... Eq.(4)

If we define XMR = −1 imitating Hamilton’s ijk = −1, (2)(3)(4) follow. X, M, R are a bit unusual: the order of multiplication matters (e.g. XM and MX are different). On the other hand, regular numbers (say: e, f, g, h) can “move” freely, as in hXM = XhM = XMh. A quaternion is a “number” of the form e + fX + gM + hR.

Assume we have two quaternions, Q = A + BX + CM + DR and q = a + bX + cM + dR. Multiply Q by q, and things become a bit messy:

Qq = (A + BX + CM + DR)(a + bX + cM + dR)

= Aa + Ab(X) + Ac(M) + Ad(R)

 + Ba(X) + Bb(X²) + Bc(XM) + Bd(XR)

 + Ca(M) + Cb(MX) + Cc(M²) + Cd(MR)

 + Da(R) + Db(RX) + Dc(RM) + Dd(R²)

= Aa + Ab(X) + Ac(M) + Ad(R)

 + Ba(X) + Bb(−1) + Bc(R) + Bd(−M) ← using (1)(2)(4)

 + Ca(M) + Cb(−R) + Cc(−1) + Cd(X) ← using (2)(1)(3)

 + Da(R) + Db(M) + Dc(−X) + Dd(−1) ← using (4)(3)(1)

= (Aa − Bb − Cc − Dd)

 + (Ab + Ba + Cd − Dc)X

 + (Ac − Bd + Ca + Db)M

 + (Ad + Bc − Cb + Da)R

If we write

E = Aa − Bb − Cc − Dd,

F = Ab + Ba + Cd − Dc,

G = Ac − Bd + Ca + Db,

H = Ad + Bc − Cb + Da,

then above mess becomes tidy:

Qq = E + FX + GM + HR ... Eq.(5)

Now, consider a function swap() that converts a given quaternion u = e + fX + gM + hR into a quaternion e − fX − gM − hR. By messy calculation like above, you can show: swap(Q) * swap(q) = E − FX − GM − HR which is = swap(Qq) according (5). Generally, for any two quaternions u, v:

swap(uv) = swap(v) * swap(u) ... Eq.(6)

We define the hash of u = e + fX + gM + hR as hash(u) = e² + f² + g² + h². Since e, f, g, h are regular numbers, a hash is a regular number. Just like above, do some math and you get:

hash(u) = u * swap(u) ... Eq.(7)

Using (7) with u = Qq,

hash(Qq) = (Qq) * swap(Qq) = Q * q * (swap(q) * swap(Q)) ← using (6) with u=Q, v=q

= Q * (q * swap(q)) * swap(Q) = Q * hash(q) * swap(Q) ← using (7)

= Q * swap(Q) * hash(q) ← hash is a regular number; can “move” freely

Again using (7), we conclude hash(Qq) = hash(Q) * hash(q) ... Eq.(8)

Recall the definition of “hash”. Given Q = A + BX + CM + DR and q = a + bX + cM + dR,

hash(Q) * hash(q) = (A² + B² + C² + D²)(a² + b² + c² + d²) ... Eq.(9)

We know Qq = E + FX + GM + HR as in (5), so

hash(Qq) = E² + F² + G² + H² ... Eq.(10)

(8) says (9) = (10), meaning

(A² + B² + C² + D²)(a² + b² + c² + d²) = E² + F² + G² + H² as required.

Example (cont.): With 8 = 2² + 2² + 0² + 0² and 127 = 9² + 6² + 3² + 1²,

E = Aa − Bb − Cc − Dd = 2×9 − 2×6 − 0×3 − 0×1 = 6

F = Ab + Ba + Cd − Dc = 2×6 + 2×9 + 0×1 − 0×3 = 30

G = Ac − Bd + Ca + Db = 2×3 − 2×1 + 0×9 + 0×6 = 4

H = Ad + Bc − Cb + Da = 2×1 + 2×3 − 0×6 + 0×9 = 8

Sure enough, 6² + 30² + 4² + 8² = 1016 = 8*127 😃

Notes: We implicitly assumed that multiplication of quaternions is associative. This assumption is correct as you can see (ij)k = (k)k = −1 and i(jk) = i(i) = −1 are identical, etc. Euler originally used −B, −C, −D, instead of our B, C, D. Both versions are essentially the same.

Monero-themed names ~ Standard names:

X, M, R ~ i, j, k

swap ~ conjugate

hash ~ norm (or norm squared, depending on how you define it)

 

1️⃣ Completely normal photos, such as holiday pictures 🏞️ are considered suspicious.

2️⃣ So our private family photos or the chats and pictures from your sexting yesterday 🍑🍆 also end up on an official table. So we can throw privacy in the bin 🚮

Chances are high that most of your European friends have never heard of chat control. So let them know about the danger and what you think about the chat control proposal.

“The European Commission launched an attack on our civil rights with chat control. I contacted my local MEP to tell him that I oppose the proposal. You can do so too! This Website I found will help you write an e-mail to an MEP using A.I.”

 

The bug fixed in cURL 8.4.0 (CVE-2023-38545) is a nasty one, but it seems rather harmless in our context.

First of all, if you don’t use socks5, this issue should be irrelevant. (But do your own research. Source code is there for you to freely study, modify, compile.)

According to the blog, the bug could be exploited only if a socks5 proxy user is tricked to resolve a crazy long hostname (~1024 characters+), which sounds unlikely; except if your direct peer is evil, they might be able to send you a crazy long hostname instead of a numeric IP… maybe? However, if you’re on socks5 proxy, the attacker can’t see your real IP to begin with, so they can’t attack you (I think).

The only attack vector my stupid head can think of is: if for some reason you use both clear connections and socks5 connections, then a lucky attacker who notices your behavior can hit your real IP when you’re on Tor, using your wallet address as an identifier. (Tor exit nodes are public, so they know someone is on Tor.) Even then, maybe the worst thing that could happen is that your p2pool crashes due to buffer overrun.

view more: ‹ prev next ›