Avatar
Super Testnet
2183e94758481d0f124fbd93c56ccaa45e7e545ceeb8d52848f98253f497b975
Open source dev w/ bitcoin focus | supertestnet.org bc1qefhunyf8rsq77f38k07hn2e5njp0acxhlheksn

Knots is at 13% network share

I am officially surprised and delighted

> Sam can happen with Lightning...Now lets talk about this

nostr:nevent1qqsp0auz9ewz5pf8g9a26dzt4j0n8wzwajrlu3dmz6wuh6qkt5nmdgq7d3mu7

> They use your bad OPSEC against you

Yeah, and monero needlessly throws extra opsec hurdles at users

It is monero's fault that your private keys expose your tx history -- thus enabling the tx lookup attack

It is monero's fault that transactions leak the amount sent, amount received, and time of the transaction -- thus enabling the timing analysis attack

Saying "Well the user shouldn't have made the mistakes that exposed that data" is certainly true, but it's also a problem that monero makes this data so easy to expose

> they say nothing about "withdrawn from the swap service"

They imply it. Especially this one:

The swap service only gave him 176.07 XMR but he sent 180 XMR to the CEX account. This implies that it wasn't sent directly from the swap service, because they aren't going to provide an extra 4 XMR. Therefore he withdrew from the CEX first to a wallet with extra funds, then sent the swapped funds plus a bit extra to his CEX account.

> All is visible in the LN invoice

LN invoices do not reveal the recipient, the sender, and they optionally request a specific amount, but do not even reveal how much of that amount the recipient gets. So no, not all is visible in an LN invoice.

BTW the same is true of a monero address: not *all* is visible in one of those either

But monero addresses reveal more info than LN invoices

Replying to Avatar Hanshan

nostr:nprofile1qqszrqlfgavys8g0zf8mmy79dn92ghn723wwawx49py0nqjn7jtmjagpz4mhxue69uhkummnw3ezummcw3ezuer9wchszyrhwden5te0dehhxarj9ekk7mf0qy88wumn8ghj7mn0wvhxcmmv9uynmh4h caught lying again about #monero ”tracing”

last time he was calling the sender *knowing the destination* of their transaction "tracing monero"

today its

law enforcement watching Bitcoin be sent to a swap service and then seeing Monero get deposited to a their suspects KYCed CEX account is "tracing monero"

really confused about what the motivation could be behind such transparent lies.

it certainly isn't interest in user privacy 🤨

nostr:nevent1qqs8ccnkkl50m0cdle8pj4m4sxy3uv9fnukrhdmlyw4pxm8lnutz47cpzdmhxue69uhhwmm59e6hg7r09ehkuef0qgszrqlfgavys8g0zf8mmy79dn92ghn723wwawx49py0nqjn7jtmjagrqsqqqqqp2nv5w0

You skipped the part about the amounts and the time

They checked whether (1) the *same amount* in the (2) *right time frame* was (3) *withdrawn from the swap service* and (4) *deposited at the exchange*

That's called timing analysis and it is a form of tracing

Since monero leaks the amounts sent, amounts received, and time of transactions, it definitely belongs on the list of monero leaks

Fountain App is a podcasting service with a feature called Splits where users pay a single invoice to "zap" a podcast they liked and the app automatically splits up the money to multiple recipients: https://support.fountain.fm/article/68-what-are-splits

See also Lightning Prisms: https://dergigi.com/2023/03/12/lightning-prisms/

lightning

LN has prisms and atomic tx chaining, so the following scenario is doable: I buy the latest album for $10, not knowing that $5 of it went to the original artist and $5 went to the merchant. Thus, the sender doesn't know how much money went to the receiver and how much went to one or more other folks. Which is good, that's none of his business. But XMR needlessly exposes that private info to him.

> that's a clearnet website that happens to have an onion link

All DNMs can be accessed on clearnet too, thanks to tor proxies

> there are no drugs in it

Then explain this: http://6fkdn756yryd5wurkq7ifnexupnfwj6sotbtby2xhj5baythl4cyf2id.onion/listing/3d4aa39d5d9752477d4344806dfdedfea895bc5816c297d46c7333fe29fcbb63

by the time you guys get lightning working on monero, who knows how much farther ahead we'll be by then? You bank on playing catch up but it's a losing strategy

Your wait is over! Shopstr is an illegal drug marketplace that takes lightning

> it still has nothing to do with the feds tracing Monero

It has everything to do with the feds tracing monero. You know why they knew he used that exchange? Because they traced his monero to it. If you stop them from tracing the money in the first place, they never learn what exchange he uses, and thus they don't know who to subpoena for user info.

> Using self custodial LN privately is a much higher barrier to entry

Of the four UX hurdles I outline on this page (https://moneroleaks.xyz/), monero has all 4 of them and lightning only has 1, which is this: lightning users also commonly reuse the LN-equivalent of a monero address, namely, they commonly reuse the same pubkey in all of their invoices. Not to downplay that problem, but if you just go by the hurdles I mention on that page, lightning fixes 3 out of 4 of them and monero fixes none of them.

In the cited document, look at pages 24-25, the section "LIN’s Crypto Account-1 Received Marketplace-1 proceeds." In those proceedings, they show -- through a trace -- that Lin converted criminal proceeds into monero and then withdrew them to a monero wallet and then sent them to a KYC'd exchange to sell them.

They document 4 traces in subparagraphs i, ii, iii, and iv where he did this and they outline the technique they used to perform the trace. Then, in subparagraph vi, they state that they got Lin's identity because the exchange where they traced the money to had his KYC data, namely, his mobile number, his email, and his driver's license.

That is a trace where the identification and arrest of the target happened after, and due to, tracing monero.

I think so. But lightning helps even more, if used properly

> Don't you think they would demand government to make LN nodes get a money transmitter license so they can siphon data from those nodes directly if their current setting would not work?

I think they could try, but I don't think it would work. Money transmitters are required to get the KYC info of their users, which is a serious hurdle to onboarding, so I think most users would just gravitate toward wallets where you don't have to do that -- e.g. ones connected to "underground" routing nodes. And thus the KYC'd routing nodes would simply be routed around.

I made a website listing the types of data leaked in monero transactions and providing case studies of how these leaks contributed to the arrest and prosecution of various monero users.

Monero users should consider switching to lightning.

https://moneroleaks.xyz/