[XMR] Monero - A secure, private, untraceable cryptocurrency

[MoneroMooo]

As I have stated before a 2 part auth should be added, I personally would like to lock it to my IP and or MAC. There are many 2 part methods that should be added.

While generally useful, I'm not sure that'd help in this particular case:

- If the server is compromised, and is sending compromised JS, that JS can probably disable such checks, as well as post away your private spend key to an attacker.

- If the connection is MITM'd, same considerations apply.

- If your computer is compromised, the attacker can do whatever it wants.

Locking to IP and/or MAC would work if any tx has to go through the server, but that is not the case here. What would help is the ability to run known good Javascript only. So something like having the Mymonero website running on an HTTP server on your local machine, and connecting to the mymonero site as normal to get new txes and relay spends.

[Hueristic]

As I have stated before a 2 part auth should be added, I personally would like to lock it to my IP and or MAC. There are many 2 part methods that should be added.

While generally useful, I'm not sure that'd help in this particular case:

- If the server is compromised, and is sending compromised JS, that JS can probably disable such checks, as well as post away your private spend key to an attacker.

- If the connection is MITM'd, same considerations apply.

- If your computer is compromised, the attacker can do whatever it wants.

Locking to IP and/or MAC would work if any tx has to go through the server, but that is not the case here. What would help is the ability to run known good Javascript only. So something like having the Mymonero website running on an HTTP server on your local machine, and connecting to the mymonero site as normal to get new txes and relay spends.

Nothing can protect 100% yes, but each additional layer will not only create larger hurdles for the attacker it will also allow for a narrowed forensic analyzation of the attack vector as opposed to the "well we don't know but we think maybe it was a phishing site" answer we have now. Sometimes you need to just shut off vectors to find the avenue and even by adding these the attacker will be aware that the scope of their attack will become known and may therefore not strike again. This is especially true of inside jobs.

Doing nothing is the wrong answer.

[MR1]

As I have stated before a 2 part auth should be added, I personally would like to lock it to my IP and or MAC. There are many 2 part methods that should be added.

While generally useful, I'm not sure that'd help in this particular case:

- If the server is compromised, and is sending compromised JS, that JS can probably disable such checks, as well as post away your private spend key to an attacker.

- If the connection is MITM'd, same considerations apply.

- If your computer is compromised, the attacker can do whatever it wants.

Locking to IP and/or MAC would work if any tx has to go through the server, but that is not the case here. What would help is the ability to run known good Javascript only. So something like having the Mymonero website running on an HTTP server on your local machine, and connecting to the mymonero site as normal to get new txes and relay spends.

So how is the tx transmitted to the XMR network if it does not go through the server?

[MoneroMooo]

So how is the tx transmitted to the XMR network if it does not go through the server?

It does go through the server. But it does not *have* to. That is, if an attacker were to compromise some part of the chain from client to server, the attacker could induce the client to generate a transaction which would be relayed to the Monero network without going through the server.

[dEBRUYNE]

'More mooo coding goodness' - Feedback required from community on MoneroMooo's new Forum Funding System proposal

https://forum.getmonero.org/7/open-tasks/86962/more-mooo-coding-goodness

https://www.reddit.com/r/Monero/comments/56nlan/more_mooo_coding_goodness_feedback_required_from/

[nioc]

https://forum.getmonero.org/7/open-tasks/86962/more-mooo-coding-goodness

It has been moved to funding required.  Let's go guys.

[nioc]

https://forum.getmonero.org/7/open-tasks/86962/more-mooo-coding-goodness

It has been moved to funding required.  Let's go guys.

Fully funded, that was quick.

[Chronobank]

It seems, anonymity again becomes an important part of our lives - Xmr - Nav - Sdc. An interesting trend....

[ArticMine]

'More mooo coding goodness' - Feedback required from community on MoneroMooo's new Forum Funding System proposal

https://forum.getmonero.org/7/open-tasks/86962/more-mooo-coding-goodness

https://www.reddit.com/r/Monero/comments/56nlan/more_mooo_coding_goodness_feedback_required_from/

This was over subscribed, in a very short period of time. Many thanks to all who contributed.

[explorer]

'More mooo coding goodness' - Feedback required from community on MoneroMooo's new Forum Funding System proposal

https://forum.getmonero.org/7/open-tasks/86962/more-mooo-coding-goodness

https://www.reddit.com/r/Monero/comments/56nlan/more_mooo_coding_goodness_feedback_required_from/

This was over subscribed, in a very short period of time. Many thanks to all who contributed.

what happens to the overage?  revise contract to suit?  These requests are funding before I see them!

[nioc]

'More mooo coding goodness' - Feedback required from community on MoneroMooo's new Forum Funding System proposal

https://forum.getmonero.org/7/open-tasks/86962/more-mooo-coding-goodness

https://www.reddit.com/r/Monero/comments/56nlan/more_mooo_coding_goodness_feedback_required_from/

This was over subscribed, in a very short period of time. Many thanks to all who contributed.

what happens to the overage?  revise contract to suit?  These requests are funding before I see them!

I believe the overage is used for development at the discretion of the devs.  There was at least one time that funds were raised for work that was not done and it was later used to fund another request that was approved by the community.

Yes this one was funded quickly, in about an hour.  I saw the proposal shortly after it was posted and was lucky enough to be able to contribute.  There is another proposal coming probably tomorrow for funding of the i2p, kovri project.  I know nothing of the details.  If I see it before you I can donate an amount of your choosing in your name and you can pay me back later. 

[canth]

The minimum fee decreased from 0.01 XMR per kB to 0.002 XMR per kB today!

https://www.reddit.com/r/Monero/comments/564hci/the_minimum_fee_will_decrease_from_001_xmr_per_kb/

Damn If I waited 2 days I would have had more dust to play with!

...

Ya know the only Time I've ever seen Canth was the Brown Dragon in Pern, you wouldn't have to have read that have you? I've been meaning to ask you that forever and never had the keyboard handy.

It's the only place I've seen the name used as well, except for typos. I think I must have read at least 20 of Pern books when I was a kid - glad to see a fellow fan.

[Hueristic]

The minimum fee decreased from 0.01 XMR per kB to 0.002 XMR per kB today!

https://www.reddit.com/r/Monero/comments/564hci/the_minimum_fee_will_decrease_from_001_xmr_per_kb/

Damn If I waited 2 days I would have had more dust to play with!

...

Ya know the only Time I've ever seen Canth was the Brown Dragon in Pern, you wouldn't have to have read that have you? I've been meaning to ask you that forever and never had the keyboard handy.

It's the only place I've seen the name used as well, except for typos. I think I must have read at least 20 of Pern books when I was a kid - glad to see a fellow fan.

I think when I read them there was the first 3 and then later I read the firelizard ones but I didn't know there were more, I think I'll see if I still have them and do a re-read. I'm not sure if I'd like them as an adult but when I was a kid they enthralled me.

Would definitely make a good movie.

[dEBRUYNE]

Anonimal's Kovri Full Time Development Funding Thread

https://forum.getmonero.org/8/funding-required/86967/anonimal-s-kovri-development-funding-thread

[Hueristic]

Anonimal's Kovri Full Time Development Funding Thread

https://forum.getmonero.org/8/funding-required/86967/anonimal-s-kovri-development-funding-thread

$47,000 Really?

[Anon136]

Anonimal's Kovri Full Time Development Funding Thread

https://forum.getmonero.org/8/funding-required/86967/anonimal-s-kovri-development-funding-thread

$47,000 Really?

Hes asking for 34 dollars an hour right? I don't know how experienced and effective of a software developer he is, but if he is experienced and effective that sounds around about a market wage for that line of work.

[Hueristic]

Anonimal's Kovri Full Time Development Funding Thread

https://forum.getmonero.org/8/funding-required/86967/anonimal-s-kovri-development-funding-thread

$47,000 Really?

Hes asking for 34 dollars an hour right? I don't know how experienced and effective of a software developer he is, but if he is experienced and effective that sounds around about a market wage for that line of work.

I'm betting this could be contracted out for about half that.

[Anon136]

Anonimal's Kovri Full Time Development Funding Thread

https://forum.getmonero.org/8/funding-required/86967/anonimal-s-kovri-development-funding-thread

$47,000 Really?

Hes asking for 34 dollars an hour right? I don't know how experienced and effective of a software developer he is, but if he is experienced and effective that sounds around about a market wage for that line of work.

I'm betting this could be contracted out for about half that.

Yea maybe. Some people are worth more than others though. My wife works in food service and shes just so competent her employer pays her twice as much as her peers. Idk whether he is or isn't worth twice as much as some random chinese contractor but he might be.

[graviteta]

hello moneroers, i have some xmr, i am waiting xmr price 20$, is it possible?

[Hueristic]

Anonimal's Kovri Full Time Development Funding Thread

https://forum.getmonero.org/8/funding-required/86967/anonimal-s-kovri-development-funding-thread

$47,000 Really?

Hes asking for 34 dollars an hour right? I don't know how experienced and effective of a software developer he is, but if he is experienced and effective that sounds around about a market wage for that line of work.

I'm betting this could be contracted out for about half that.

Yea maybe. Some people are worth more than others though. My wife works in food service and shes just so competent her employer pays her twice as much as her peers. Idk whether he is or isn't worth twice as much as some random chinese contractor but he might be.

LOL, actually most of the cheap coders are from india. And it would cost probably 7k or less for that.

hello moneroers, i have some xmr, i am waiting xmr price 20$, is it possible?

Everything is possible in a universal perspective.