• mister_monsterEnglish
    1·
    8 days ago

    But with dandelion++ it should be infeasible to deduce anything about a transaction on receipt, no?

    • EriqEnglish
      2·
      8 days ago

      yes the overall transaction is safe but the individual node sending that transaction/block is recorded with the IP logged. Mass collection with a large spy network would easily enable a semi reliable initiator logging system that could be used later for any purpose. You could connect to a public node to hide and not send from personal node but then again the public node itself could be a spy node too. Its all about collecting general metadata for use with other data to be cross examined when the time is needed.

      • mister_monsterEnglish
        2·
        7 days ago

        Well, the concept of a ban list seems ripe for abuse. We have to trust someone to tell us canonically who the bad nodes are, people can slap a fed honeypot node label on you for not going along with something.

        What we need to do is design the system such that a bad node can do nothing but participate in the network. Just like the mining incentive structure with nakamoto consensus. Dandelion++ is supposed to do that, at least for everyone broadcasting their transactions only to initial nodes they know and trust. I don’t know how to do that, but a blacklist is a dangerous stopgap.

        • rideOPEnglish
          1·
          7 days ago

          👍

          transactions only to initial nodes they know and trust. I don’t know how to do that

          • Create your own fullnode and leave it running all the time. So don’t just start it when it is needed for transactions or interactions with Monero. There are also very accessible methods for this, such as PiNodeXMR, which easily converts an SBC such as RaspberryPi into a secure Monero full node.

          • Use Tor and a known trusted Tor node, e.g. hashvaultsvg2rinvxz7kos77hdfm6zrd5yco3tx2yh2linsmusfwyad.onion from hashvault Pool.

          • Use VPN (and a known trusted node)

          • mister_monsterEnglish
            1·
            5 days ago

            Yeah, I mean for remote nodes, running your own node all the time basically solves these problems.

    • EriqEnglish
      2·
      8 days ago

      Best solution when connecting to public nodes would be through Tor. Even if the public node is a spy node somehow with tor enabled, they would still be able to see requested blocks but would not be able to pinpoint who is requesting. It still adds a good layer and is recommended by most, but it is not perfect because Tor is also somewhat under a timing attack.