MyMonero.com - Security Issues

[bathrobehero]

As someone who dislike both Monero and Dash

You are just another Darkcoin/Dash shill

I couldn't care less about that instamined nonsense nor do I care about Monero/Nem/NXT I just find it funny when people are convinced that any of these coins have an actual chance at challenging bitcoin when in reality these coins probably won't even stay relevant in a few years.

[1713875788]

1713875788

[1713875788]

1713875788

[1713875788]

1713875788

[obit33]

As someone who dislike both Monero and Dash

You are just another Darkcoin/Dash shill

I couldn't care less about that instamined nonsense nor do I care about Monero/Nem/NXT I just find it funny when people are convinced that any of these coins have an actual chance at challenging bitcoin when in reality these coins probably won't even stay relevant in a few years.

yeah, technological progress doesn't exist... there will never be better alternatives, bitcoin has no fungibility problem, i shit flowers and ride pink ponies...

[bathrobehero]

As someone who dislike both Monero and Dash

You are just another Darkcoin/Dash shill

I couldn't care less about that instamined nonsense nor do I care about Monero/Nem/NXT I just find it funny when people are convinced that any of these coins have an actual chance at challenging bitcoin when in reality these coins probably won't even stay relevant in a few years.

yeah, technological progress doesn't exist... there will never be better alternatives, bitcoin has no fungibility problem, i shit flowers and ride pink ponies...

I think the technological progress is nowehere near significant enough to replace what's been working for years. You could create a coin with all the best features of the top coins and it would still be traded through bitcoin.
There will be better alternatives, but I don't think that coin exists yet.

[obit33]

As someone who dislike both Monero and Dash

You are just another Darkcoin/Dash shill

I couldn't care less about that instamined nonsense nor do I care about Monero/Nem/NXT I just find it funny when people are convinced that any of these coins have an actual chance at challenging bitcoin when in reality these coins probably won't even stay relevant in a few years.

yeah, technological progress doesn't exist... there will never be better alternatives, bitcoin has no fungibility problem, i shit flowers and ride pink ponies...

I think the technological progress is nowehere near significant enough to replace what's been working for years. You could create a coin with all the best features of the top coins and it would still be traded through bitcoin.
There will be better alternatives, but I don't think that coin exists yet.

don't know... I thought the coinbase-debacle was pretty telling... when fungibility disappears I'm looking elsewhere to store value... But that's subjective off course

[othe]

Why?  MyMonero.com took development time and $ to build, why spend on that and not on a decent anonymous client wallet for users so they don't have to use a server?

One explanation might be that centralized payment sites are what Fluffy is used to and feels comfortable developing (as he tried Vertpay.com before and also working on Paybee.com now)

Either way, the solution is surely to get rid of MyMonero.com - Monero just can't be untraceable / anonymous with the bulk of it's users doing their transactions through a single server owned by the dev

You are just pissed that its not possible to make a good working Webwallet for Dash - because of the broken by design coinjoin crap which needs premixes and which needs you to be online the whole time.
We did it, because we can and because most users wanted a simple to use Webwallet like Blockchain.info for BTC.
No one uses BitcoinQT, 90% or so of users choose SPV Wallets. It is how it is.

The Fact is, we have a mobile wallet solution which supports Mixin and DASH has nothing, theres simply no way to darksend coins on a mobile device.
Maybe you should code one, which you can´t, because DASH is over a year old and still has no Mobile wallet with darksend support?? Is it true?

Plus get volume spread across different exchanges and not just through Poloniex - my understanding is exchanges like Cryptsy didn't add Monero again because of problems with the official wallet client - so same problem, same solution, get the wallet working...

Cryptsy has no reaso to not add it, they are just too lazy and/or stupid. Fact.
Same reason they also take years to add non Btc clones.
Wallet work fine, but theres something in your head which doesnt get that obviously.

PS: Great timing, just in time with the next Otoh PUMP https://bitcointalk.org/index.php?topic=421615.msg11510173#msg11510173

[BlockaFett]

Why?  MyMonero.com took development time and $ to build, why spend on that and not on a decent anonymous client wallet for users so they don't have to use a server?

One explanation might be that centralized payment sites are what Fluffy is used to and feels comfortable developing (as he tried Vertpay.com before and also working on Paybee.com now)

Either way, the solution is surely to get rid of MyMonero.com - Monero just can't be untraceable / anonymous with the bulk of it's users doing their transactions through a single server owned by the dev

You are just pissed that its not possible to make a good working Webwallet for Dash - because of the broken by design coinjoin crap which needs premixes and which needs you to be online the whole time.
We did it, because we can and because most users wanted a simple to use Webwallet like Blockchain.info for BTC.
No one uses BitcoinQT, 90% or so of users choose SPV Wallets. It is how it is.

The Fact is, we have a mobile wallet solution which supports Mixin and DASH has nothing, theres simply no way to darksend coins on a mobile device.
Maybe you should code one, which you can´t, because DASH is over a year old and still has no Mobile wallet with darksend support?? Is it true?

Plus get volume spread across different exchanges and not just through Poloniex - my understanding is exchanges like Cryptsy didn't add Monero again because of problems with the official wallet client - so same problem, same solution, get the wallet working...

Cryptsy has no reaso to not add it, they are just too lazy and/or stupid. Fact.
Same reason they also take years to add non Btc clones.
Wallet work fine, but theres something in your head which doesnt get that obviously.

PS: Great timing, just in time with the next Otoh PUMP https://bitcointalk.org/index.php?topic=421615.msg11510173#msg11510173

Othe you keep saying Bitcoin has Bitcoin.info...Bitcoin *is not* claiming to be untraceable and anonymous like you are.

If it was, trying to get all users to type their transactions into a webform on the Dev's personal server, would obviously *undermine the untraceability* 100%.

(and all the info Bitcoin.info can access is *publically available* on the BTC blockchain anyway, info that MyMonero has access to is not so they have a big advantage in a Cryptonote coin)

I don't understand, how can you justify making a web wallet for a coin you claim is "anonymous and untraceable" when the site owner can then access and *break* all the untraceability (and potentially then use this info to their advantage as everyone else in the market is in the dark).

For example looking at the page source on MyMonero, it's running Google Analytics (a service designed to let site owners and Google learn the most information possible about the site's visitors)

<script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','//www.google-analytics.com/analytics.js','ga');

  ga('create', 'UA-53312765-3', 'auto');
  ga('send', 'pageview');

</script>

Why has all this been done, it doesn't make any sense.  And if the core team are infact major players on Poloniex instead of poor hardworking devs who need donations, with the above situation, red flags are going up for me.

If I'm wrong, please explain it...

EDIT: BTW are you a Monero dev?

[superresistant]

Please don't take this thread too seriously. It's obviously an attempt to troll the community.
BlockaFett argument's would be taken seriously only IF he was addressing all these "problems" to Monero's devs and trying to find solutions.


Of course it is a bad habit to use only one exchange.
Of course it is a bad habit to use a wallet that you didn't compile from the source code but instead trust a dev that made a wallet for you.
But hey... let people take responsibility for their acts.

[othe]

Othe you keep saying Bitcoin has Bitcoin.info...Bitcoin *is not* claiming to be untraceable and anonymous like you are.

If it was, trying to get all users to type their transactions into a webform on the Dev's personal server, would obviously *undermine the untraceability* 100%.

(and all the info Bitcoin.info can access is *publically available* on the BTC blockchain anyway, info that MyMonero has access to is not so they have a big advantage in a Cryptonote coin)

I don't understand, how can you justify making a web wallet for a coin you claim is "anonymous and untraceable" when the site owner can then access and *break* all the untraceability (and potentially then use this info to their advantage as everyone else in the market is in the dark).

1. The important stuff is done clientside...I am not going to explain you how JAVASCRIPT works, take some basic pc learning course for that or ask Mr. Duff.
You posted the code yourself, ga('send', 'pageview'); - it just sends pageviews.

2. Theres nothing to justify, MyMonero is a third party project from Fluffypony that the community wanted to have. They can decide to use it or not, its that easy but that doesn´t get into your little narrowminded braincells. Unlike DASH - Monero isn´t a company and everyone can do what he wants.
We even have decentralized Wallets:
- MoneroX
- LiteWallet
- Antantst Wallet
- MyMonero
- Simplewallet

everyone can use what he wants, unlike with Dash were everyone is forced to use the BitcoinQT copy/pasted Wallet.

3. It´s so fucking dumb to compare a webservice with monero itself.

If I'm wrong, please explain it...

You are always wrong, but too narrowminded to accept it, why should we even explain it again after already doing it?

EDIT: BTW are you a Monero dev?

You know sooo much about Monero, awesome investigation.

Why has all this been done, it doesn't make any sense.

It´s just your brain that doesn´t make much sense.

And if the core team are infact major players on Poloniex instead of poor hardworking devs who need donations, with the above situation, red flags are going up for me.

I hereby allow Busoni to post my trading statistics for Monero on Poloniex, when Evan Duffield allows the same for Cryptsy and Bitfinex in the case of Dash.

[BlockaFett]

Please don't take this thread too seriously. It's obviously an attempt to troll the community.
BlockaFett argument's would be taken seriously only IF he was addressing all these "problems" to Monero's devs and trying to find solutions.


Of course it is a bad habit to use only one exchange.
Of course it is a bad habit to use a wallet that you didn't compile from the source code but instead trust a dev that made a wallet for you.
But hey... let people take responsibility for their acts.

I'm highlighting a structural setup in Monero that *enables* the dev, who is selling a coin as untraceable & anonymous, to be the only one to effectively see the XMR blockchain/distribution/movements, via MyMonero.com.

And the fact that most people have to use MyMonero because the official wallet doesn't work properly, after 1 year, again *enables* an exploit like this to take place..

My suspicion is that Fluffy is in fact a large force on Poloniex (and I saw yesterday people discussing that he was there)

So reasonable to think something fishy might be going on here and I am just sharing my thoughts....

Slightly alarming to have you and Othe here trying to flatly dismiss this actually...(because I would have expected a simple explanation and not vitriol / diversion)

[BlockaFett]

Othe...again...are you a Monero dev? (or can someone else confirm this or not please?)

EDIT: Othe - saying 'anyone can choose a wallet' is disingenuous.  We both know nearly all users get funnelled to MyMonero, that is even the first option on the 'choose a wallet' page - again, extremely suspicious that you are acting 100% dismisive like this.  I suggest you take this more seriously..

EDIT2: Again saying that its no problem that Google Analytics is used on MyMonero - you are either clueless about web development / security or lying....

[othe]

EDIT: Othe - saying 'anyone can choose a wallet' is disingenuous.  We both know nearly all users get funnelled to MyMonero, that is even the first option on the 'choose a wallet' page - again, extremely suspicious that you are acting 100% dismisive like this.  I suggest you take this more seriously..

Proof this.
Most users seem to run SimpleWallet from my observations. Clowns like you can´t be taken seriously :-)

The Website clearly says: "If you are able to spare the bandwidth and disk space required to run a full node, doing so helps keep the network stable and robust, and also affords you the maximum privacy Monero has to offer."

Othe...again...are you a Monero dev? (or can someone else confirm this or not please?)

C´mon, you are the investigator here. Just shows us you know fuck nothing about XMR.

EDIT2: Again saying that its no problem that Google Analytics is used on MyMonero - you are either clueless about web development / security or lying....

It´s a website man, get used to it. You run your own node if you want privacy, thats how it works. And that is mentioned 100x times. MyMonero is just for people who don´t care. It´s an easy solution to use XMR, which is currently only used for investments and speculation anyway.

I'm highlighting a structural setup in Monero that *enables* the dev, who is selling a coin as untraceable & anonymous, to be the only one to effectively see the XMR blockchain/distribution/movements, via MyMonero.com.

And the fact that most people have to use MyMonero because the official wallet doesn't work properly, after 1 year, again *enables* an exploit like this to take place..

My suspicion is that Fluffy is in fact a large force on Poloniex (and I saw yesterday people discussing that he was there)

You still don´t get how Monero works - cute

Slightly alarming to have you and Othe here trying to flatly dismiss this actually...(because I would have expected a simple explanation and not vitriol / diversion)

There is nothing to dismiss, we already found out you don´t know how Monero works :-)

[BlockaFett]

...

Asking if you are a dev seems like a pretty simple question...and the BCT search is disabled so not that easy to investigate right now...but trust me if I decided to investigate this properly you will know about it...

Within the last 24hrs you have 3 users on the XMR thread complaining that they can't use the official wallet:

Been a couple of weeks since I ran bitmonerod on win7. I tried 0.8.8.6 and 0.8.8.3 today and it seems my deamons won't connect with the network anymore. All I get is a constant stream of "incoming handshake,  failed ....." I'm stuck at block 502068. Any ideas ?

Dear GingerAle! It's Win7 x64, you are right.

Before today bitmonerod+simplewallet were starting OK. After a long period I decided to run it again and here is the issue I described above.

Nothing has changed it my starting .bat also:

Code:

@echo off

tasklist /FI "IMAGENAME eq bitmonerod.exe" 2>NUL | find /I /N "bitmonerod.exe">NUL
if not %ERRORLEVEL% == 0 (
  echo Starting node...
  start bitmonerod.exe --data-dir E:\ProgramData\bitmonero\
) else (
  echo Node already started.
)

tasklist /FI "IMAGENAME eq simplewallet.exe" 2>NUL | find /I /N "simplewallet.exe">NUL
if not %ERRORLEVEL% == 0 (
  if exist wallet.bin.keys (
    echo Starting previous wallet...
    start simplewallet.exe --wallet wallet.bin
  ) else (
    echo Starting new wallet...
    start simplewallet.exe --generate-new-wallet wallet.bin
  )
) else (
  echo Wallet already started.
)

pause

When I try to run bitmonerod as Administrator the error is the same as before:

Code:

2015-Jun-02 01:46:17.056815 bitmonero v0.8.8.6-release
2015-Jun-02 01:46:17.057815 Module folder: bitmonerod
2015-Jun-02 01:46:17.057815 Initializing P2P server...
2015-Jun-02 01:46:50.121706 bitmonero v0.8.8.6-release
2015-Jun-02 01:46:50.122706 Module folder: bitmonerod
2015-Jun-02 01:46:50.123706 Initializing P2P server...
2015-Jun-02 01:47:09.983842 Binding on 0.0.0.0:18080
2015-Jun-02 01:47:09.984842 Net service bound to 0.0.0.0:18080
2015-Jun-02 01:47:09.985842 Attempting to add IGD port mapping.
2015-Jun-02 01:47:12.994014 UPnP device was found but not recoginzed as IGD.
2015-Jun-02 01:47:12.994014 P2P server initialized OK
2015-Jun-02 01:47:12.995014 Initializing protocol...
2015-Jun-02 01:47:12.996014 Protocol initialized OK
2015-Jun-02 01:47:12.996014 Initializing core RPC server...
2015-Jun-02 01:47:12.997014 Binding on 127.0.0.1:18081
2015-Jun-02 01:47:12.998014 Core RPC server initialized OK on port: 18081
2015-Jun-02 01:47:12.998014 Initializing core...
2015-Jun-02 01:47:13.010015 Loading blockchain...
2015-Jun-02 01:48:02.087822 ERROR C:/bitmonero/src/common/boost_serialization_helper.h:108 Exception at [unserialize_obj_from_file], what=std::bad_alloc
2015-Jun-02 01:48:02.088822 Can't load blockchain storage from file, generating genesis block.

I guess I should delete the monero blockchain and try to re-sync. And it seems that it works.



kazuki49, no, I decided to support the Monero network by keeping the monero core opened.  

hi guy please help
  my wallet is v8.8.3 i did not check my wallet for about 6 months or more when i checked today my 120+ coins gone is there a possibility that my wallet have been hacked? i already update my wallet into v8.8.6 and still my balance is 0 please help guys thanks in advance...

Does "incoming_transfers" show anything ?
It may be that you're looking at the wrong wallet, if you created a few different ones for testing.

yeah before i update i checked already my old wallet incoming_transfers displays some violet colored texts and after i update i have the same wallet address...

Sorry but how the heck should we know? I suggest you go on the irc and try to find one of the devs to analise your simplewallet log, but to me it sounds you transfered your xmr 6 months ago and forgot about it.

thanks for the reply and i didnt transfered or touch my wallet

Then when we go to the 'choose a wallet page' we are pushed to MyMonero:



And lots of quotes on the XMR thread of people with wallet problems being told to use MyMonero.

So the questions are:

1. Why did the Monero devs decide to setup a web-wallet that enables them to deanonimize users / be the only group to access blockchain / distribution / fund movements information, on a coin they are marketing as untraceable / anonymous?

2. Why, after 1 year, are users still having to turn to MyMonero.com because the official wallet has so many usability problems / no GUI?

3. Why has no progress been made to get the 95% of volume off Poloniex and spread across different markets?

4. Why the privacy surrounding MyMonero.com?  Where is the source code?  Where are the stats on users (if the answer is privacy, then it's not because the devs can see it, not sharing it privileges them)

[medusa13]

please, people. dont waste your enegry on this....
its not worth it. his questions are all fake

[MikeCorleone]

This thread is really interesting. I like that BlockaFett has taken it on himself to investigate, and I think that should be praised. I have a few questions for you, BlockaFett, mostly around some more details of your investigation, as I think that will help us understand your conclusions.

1. How often have you approached Fluffypony to discuss your concerns? Was it just the one conversation, or multiple conversations?
2. What communications medium did you use: emails or skype or Bitcointalk pm or something?
3. Are you willing to show us the conversations you've had with him whilst you were investigating this, assuming he is ok with them being posted up?
4. I assume the conversations you've had with Fluffypony about this ended badly, can you tell us more about what he said to you in private that led to you putting this post up?
5. Have you spoken to him since putting this post up, and has he given you any more feedback?

I really think it's important that we get the answers to these questions, that way we also get his side of things.

PS. For next time it would be great if you could put the conversations up along with your investigation otherwise you're nothing more than a SJW and you lose credibility (obviosly not the case now:-) :-)

[BlockaFett]

This thread is really interesting. I like that BlockaFett has taken it on himself to investigate, and I think that should be praised. I have a few questions for you, BlockaFett, mostly around some more details of your investigation, as I think that will help us understand your conclusions.

1. How often have you approached Fluffypony to discuss your concerns? Was it just the one conversation, or multiple conversations?
2. What communications medium did you use: emails or skype or Bitcointalk pm or something?
3. Are you willing to show us the conversations you've had with him whilst you were investigating this, assuming he is ok with them being posted up?
4. I assume the conversations you've had with Fluffypony about this ended badly, can you tell us more about what he said to you in private that led to you putting this post up?
5. Have you spoken to him since putting this post up, and has he given you any more feedback?

I really think it's important that we get the answers to these questions, that way we also get his side of things.

PS. For next time it would be great if you could put the conversations up along with your investigation otherwise you're nothing more than a SJW and you lose credibility (obviosly not the case now:-) :-)

I haven't investigated this yet.  That's why the title is "investigate?".  

This is just seeing what other people think to find out if it is worth investigating.

So far all my points have been dismissed..

In terms of input from Fluffy, he is welcome to answer my above questions, this is an open forum

[Shrikez]

So the questions are:

1. Why did the Monero devs decide to setup a web-wallet that enables them to deanonimize users / be the only group to access blockchain / distribution / fund movements information, on a coin they are marketing as untraceable / anonymous?

Please explain technically how mymonero can de-anonimize users.

I am honestly curious, thank you.

EDIT: before anyone goes off on a tangent: No I am not affiliated in any way, shape or form with mymonero.com. I sport it in my signature because I am aware of the difficulties some people have with the CLI wallet.

[BlockaFett]

So the questions are:

1. Why did the Monero devs decide to setup a web-wallet that enables them to deanonimize users / be the only group to access blockchain / distribution / fund movements information, on a coin they are marketing as untraceable / anonymous?

Please explain technically how mymonero can de-anonimize users.

I am honestly curious, thank you.

1. if you don't mask your IP, host knows your physical location

2. host gets info on type of client you are using

3. embedding google analytics lets google know same and also enables you to be identified cross-domain on Google side (so who you are based on every other site you use basically)

4. if you don't use fake email, host knows your email

5. anything you type in a form on the site can be accessed retained by the site owner obviously (so all you financial info in XMR terms and what you are doing with funds)

6. ISP knows you are a MyMonero visitor and has to record this by law in a lot of countries and disclose if required

But that's not the main issue.....

It's the *financial information* that MyMonero has access to, that *no one else* has access to due to it being a Cryptonote coin, that is the real issue I am trying to ask about here...

[G2M]

7. Host has access to view key

[MikeCorleone]

I haven't investigated this yet.  That's why the title is "investigate?".  

This is just seeing what other people think to find out if it is worth investigating.

So far all my points have been dismissed..

In terms of input from Fluffy, he is welcome to answer my above questions, this is an open forum

That is really shitty man. We aren't children on the playground gossiping about each other. Why would you post on the forum without first talking to the person you are accusing and asking them wtf is going on? You are no better than every fucking whiteknight SJW posting on tumblr. People like you make me sick.

Grow up and stop acting like a kid. Just send the dude a message and tell him what you're worried about. Are you so scared of him that you're posting this shit on a forum thread first? Coward.

[BlockaFett]

I haven't investigated this yet.  That's why the title is "investigate?".  

This is just seeing what other people think to find out if it is worth investigating.

So far all my points have been dismissed..

In terms of input from Fluffy, he is welcome to answer my above questions, this is an open forum

That is really shitty man. We aren't children on the playground gossiping about each other. Why would you post on the forum without first talking to the person you are accusing and asking them wtf is going on? You are no better than every fucking whiteknight SJW posting on tumblr. People like you make me sick.

Grow up and stop acting like a kid. Just send the dude a message and tell him what you're worried about. Are you so scared of him that you're posting this shit on a forum thread first? Coward.

Hi - no disrespect, but what exactly is Fluffy's word on any of this supposed to prove?  If my concern is a structural problem with Monero that is unhealthy and I ask him if he's using that to gain market info and then trade big on Poloniex where volume is all locked in and he says "oh no, not doing that" - then I shouldn't have posted this?  And he's free to come here to discuss, why do I need to contact him privately?

EDIT: again, I am not trying to single out Fluffy here and attack him.  I am saying MyMonero / 95% Polo volume seems like a bad idea basically because it *enables* someone to take advantage and undermines the core selling point of the coin, I don't know if anyone is doing that or not.