176 lines
9.8 KiB
HTML
176 lines
9.8 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta name="description" content="">
|
|
<meta name="author" content="">
|
|
<link rel="shortcut icon" href="../../../../../../assets/img/favicon.png">
|
|
|
|
<title>Why can't I trust Centralised Exchanges, and random Monero nodes ?</title>
|
|
|
|
<!-- Bootstrap core CSS -->
|
|
<link href="../../assets/css/bootstrap.css" rel="stylesheet">
|
|
<link href="../../assets/css/xt256.css" rel="stylesheet">
|
|
|
|
|
|
|
|
<!-- Custom styles for this template -->
|
|
<link href="../../assets/css/main.css" rel="stylesheet">
|
|
|
|
|
|
|
|
<!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
|
|
<!--[if lt IE 9]>
|
|
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
|
|
<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>
|
|
<![endif]-->
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<!-- Static navbar -->
|
|
<div class="navbar navbar-inverse-anon navbar-static-top">
|
|
<div class="container">
|
|
<div class="navbar-header">
|
|
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
|
<span class="icon-bar"></span>
|
|
<span class="icon-bar"></span>
|
|
<span class="icon-bar"></span>
|
|
</button>
|
|
<a class="navbar-brand-anon" href="\index.html">nihilist`s Blog</a>
|
|
</div>
|
|
<div class="navbar-collapse collapse">
|
|
<ul class="nav navbar-nav navbar-right">
|
|
|
|
<li><a href="/about.html">About</a></li>
|
|
<li><a href="/blog.html">Categories</a></li>
|
|
<li><a href="https://blog.nowhere.moe/donate.html">Donate</a></li>
|
|
<li><a href="/contact.html">Contact</a></li>
|
|
</ul>
|
|
</div><!--/.nav-collapse -->
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<!-- +++++ Posts Lists +++++ -->
|
|
<!-- +++++ First Post +++++ -->
|
|
<div id="anon2">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-8 col-lg-offset-2">
|
|
<a href="../index.html">Previous Page</a></br></br><p><img src="../../assets/img/user.png" width="50px" height="50px"> <ba>nihilist@mainpc - 2024-09-07</ba></p>
|
|
<h1>Why can't I trust Centralised Exchanges, and random Monero nodes ?</h1>
|
|
<p> As of September 5, 2024 sech1 posted on monero.town the following <a href="https://monero.town/post/4220893">post</a>, which was a repost of the following <a href="https://redlib.nowhere.moe/r/Monero/comments/1f8jv6w/comment/llnyemp/?context=3">reddit post</a> talking about a leaked Chainalysis meeting video about what was their progress on tracing monero transactions back in August 2023. This is a great opportunity to highlight the opsec weaknesses they are targeting so let's dive into it.</p>
|
|
|
|
</div>
|
|
</div><!-- /row -->
|
|
</div> <!-- /container -->
|
|
</div><!-- /grey -->
|
|
|
|
<!-- +++++ Second Post +++++ -->
|
|
<div id="anon3">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-8 col-lg-offset-2">
|
|
<h2><b>Chainalysis are running malicious monero nodes </b></h2>
|
|
<p>The main attack vector of Chainalysis is their honeypot monero nodes. Meaning there are monero nodes out there (even though their IPs didnt get mentionned in the meeting), that ARE malicious.</p>
|
|
<img src="1.png" class="imgRz">
|
|
<p>So the first thing to be aware of is that you can't just trust random remote nodes. Chainalysis IS running an unknown amount of malicious monero nodes out there, to spy on users that decide to trust them. <b>Therefore, I strongly suggest that <a href="../monero2024/node.html">you run your own monero node</a>, and use only that node. Run it from home, or <a href="../anonymousremoteserver/index.html">from a remote server</a>, but run your own!</b> </p>
|
|
</div>
|
|
</div><!-- /row -->
|
|
</div> <!-- /container -->
|
|
</div><!-- /white -->
|
|
|
|
<div id="anon2">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-8 col-lg-offset-2">
|
|
<h2><b>Chainalysis targets IP addresses and behavior anomalies (such as non-default fees)</b></h2> </br> </br>
|
|
<img src="1.5.png" class="imgRz">
|
|
<p>Now, if you decide to trust a random remote node that is not yours, and let's say you decide to trust one of their malicious nodes, you need to be aware that they can see:</p>
|
|
<ol>
|
|
<li><p>The timestamp of each transaction</p></li>
|
|
<li><p>The transaction behavioral characteristics (the number of inputs, outputs, the fee structure (1x, 10x, 100x, etc)</p></li>
|
|
<li><p>Which IP address is connecting there (clear attack on dandelion++), and it's latency.</p></li>
|
|
</ol>
|
|
<p>Therefore, <b>if you decide to trust a remote monero node, at least keep Tor in between you and the malicious node</b> to maintain your anonymity, <b>use the .onion monero nodes preferably!</b>, And I also recommend that you leave the default fee option when you want to send monero somewhere</b>.</p>
|
|
<p>But <b>so far they cannot tell how much you are sending or recieving</b>, because you are not touching centralised exchanges (assuming you are using <a href="../haveno-client-f2f/index.html">Haveno DEX</a> to buy or sell Monero)).</p>
|
|
|
|
</div>
|
|
</div><!-- /row -->
|
|
</div> <!-- /container -->
|
|
</div><!-- /white -->
|
|
|
|
|
|
<!-- +++++ Second Post +++++ -->
|
|
<div id="anon1">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-8 col-lg-offset-2">
|
|
<h2><b>Chainalysis targets centralised exchanges that have KYC procedures</b></h2> </br> </br>
|
|
<p>As <a href="../govfear/index.html">I have mentionned many times previously</a>, Businesses can all be governmental proxies to do their bidding. <b>Centralised exchanges are businesses too, they also comply with their requests.</b> Or in their own words, they are "Subphoenable entities". But guess what, <b>these very Centralised Exchanges are forced to use Chainalysis' malicious monero nodes too!</b></p>
|
|
<img src="2.png" class="imgRz">
|
|
<p>Therefore if you decide to trust one of those popular Centralised Exchanges to buy / sell monero, the implications are way, way worse than what we previously explained;</p>
|
|
<p>Those centralised exchanges all comply with the requests of governmental entities such as FBI, LA, Robinhood, IRS-CI, UNK and of course Chainalysis, <b>and due to that fact alone you cannot trust them</b>.</p>
|
|
<p>If you decide to trust a popular centralised exchange, you'll first see that <b>it'll run you through KYC procedures (and if it doesn't, rest assured that they will eventually be forced to do so).</b> That is to deanonymize you, and to know who to blame if ever asked by the authorities. <b>NEVER KYC IF YOU WANT TO REMAIN ANONYMOUS!</b></p>
|
|
<p>This meeting of theirs has been preety revealing, not only do these centralised exchanges give out everything they have about their users to Chainalysis (as "Transactions of interest", <b>mentionning the amount transacted</b>, the <b>transaction ID</b>, and <b>who transacted</b>) But it's also naming a few of THOSE very centralised exchanges that are now confirmed to actually comply with their requests:</p>
|
|
<pre><code class="nim">
|
|
Changenow,
|
|
FixedFloat,
|
|
Morphtoken,
|
|
Exodus,
|
|
Swaplab,
|
|
Coinomi
|
|
|
|
</pre></code>
|
|
<p>The info of whatever you did so far, and will ever do on those centralised exchanges, be warned, is being handed over directly to the authorities. (Timestamp 26:02 to 26:47) in the video. <b>This list is most likely (as of a year later, in september 2024) way bigger, they are eventually going to force every centralised exchange out there to implement KYC procedures and comply to their deanonymization requests.</b></p>
|
|
<p>My recommendation, once again is the same as i have mentionned <a href=",../finances/index.html">previously</a>: If you want to use a centralised exchange, you are shooting yourself in the foot. <b>Stop using centralised exchanges and use decentralised exchanges, such as <a href="../haveno-client-f2f/index.html">Haveno DEX</a>.</b></p>
|
|
<p> If you want to use a centralised exchange anyway, <b>remain anonymous when doing so (at least keep Tor in between you and the service, and never KYC yourself there)</b>, but remain aware that you will eventually have to move to decentralised exchanges sooner or later, because they are not going to stop until every centralised exchange out there complies with their demands. </p>
|
|
|
|
</div>
|
|
</div><!-- /row -->
|
|
</div> <!-- /container -->
|
|
</div><!-- /white -->
|
|
|
|
<!-- +++++ Footer Section +++++ -->
|
|
|
|
<div id="anonb">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-4">
|
|
<h4>Nihilism</h4>
|
|
<p>
|
|
Until there is Nothing left.
|
|
|
|
</p>
|
|
</div><!-- /col-lg-4 -->
|
|
|
|
<div class="col-lg-4">
|
|
<h4>My Links</h4>
|
|
<p>
|
|
|
|
<a target="_blank" rel="noopener noreferrer" href="http://blog.nowhere.moe/rss/feed.xml">RSS Feed</a><br/><a target="_blank" rel="noopener noreferrer" href="https://simplex.chat/contact#/?v=2-7&smp=smp%3A%2F%2FL5jrGV2L_Bb20Oj0aE4Gn-m5AHet9XdpYDotiqpcpGc%3D%40nowhere.moe%2FH4g7zPbitSLV5tDQ51Yz-R6RgOkMEeCc%23%2F%3Fv%3D1-3%26dh%3DMCowBQYDK2VuAyEAkts5T5AMxHGrZCCg12aeKxWcpXaxbB_XqjrXmcFYlDQ%253D&data=%7B%22type%22%3A%22group%22%2C%22groupLinkId%22%3A%22c3Y-iDaoDCFm6RhptSDOaw%3D%3D%22%7D">SimpleX Chat</a><br/>
|
|
|
|
</p>
|
|
</div><!-- /col-lg-4 -->
|
|
|
|
<div class="col-lg-4">
|
|
<h4>About nihilist</h4>
|
|
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8</p></br><p><u>Contact:</u> nihilist@contact.nowhere.moe (<a href="https://nowhere.moe/nihilist.pubkey">PGP</a>)</p>
|
|
</div><!-- /col-lg-4 -->
|
|
|
|
</div>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<!-- Bootstrap core JavaScript
|
|
================================================== -->
|
|
<!-- Placed at the end of the document so the pages load faster -->
|
|
|
|
</body>
|
|
</html>
|