The linked article (and so AutoTL;DR) is not very accurate. If you’re interested in this incident, read the original post, which is short and compact. General media articles are only quoting or re-quoting this thread, typically with some misunderstanding.

Specifically (about this post): Among other things, multisig is only suggested; nothing has been decided yet.

Generally (in many similar articles): Probably a specific local machine was hacked, though no one really knows yet what happened. It’s unlikely that the Monero network itself was hacked.

Since I’m a Monero supporter, obviously I tend to say good things about it, but frankly, the ironical fact here is, Monero is so privacy-focused that when something like this happens, it’s difficult to identify the attacker—i.e. by design Monero also protects the identity of the attacker. Some Monero users are having this weird, paradoxical feeling: it would be nice if we could catch this evil attacker, but being able to catch the attacker would be in a way very bad news for Monero (if you know what I mean) 😕

Excuse me, do you have a moment to talk about GNU/Linux? 🙃

When I got my senior mom a computer she had never used Windows. Instead of having her learn that I installed Debian with Xfce and Firefox. Now that’s all she knows, I laugh at people who tell me Linux is too hard when my mom without any tech knowledge uses it as her daily computer. If I had to switch her to Windows or a Chrome browser she’ll make a fuss about it.

How about a live OS as a free trial? Not only free as in free beer, but free as in freedom, and always will be free. You own your OS, not vice versa.

Become a Linux user today, while keeping your precious Windows 11 or whatever. I raise you Tails if you do this at all.

• Get an unused USB stick, download Tails and make a bootable USB. Typically this will take less than an hour.
• Restart and boot your computer into Tails.
• Congratulations! You’re a Debian user now, even on Tor. Meaning your real IP is hidden. Privacy strikes back!
• Start Tor Browser and enjoy Lemmy. Libre world is usually Tor-friendly (though lemmy.world may be behind CF).

I’m not saying you should ditch Windows today, but you might want to do some experiments? There are other OSes too, if you think yours is (becoming more and more) annoying!

[PS: lemmy.world is indeed behind Cloudflare (CF). You may not be able to use it directly via Tor. I’m okay because writing/reading this from a different, privacy-friendly instance. Though CF is MitM, some people believe it’s necessary. Be careful, though: everything you send, including your password, may be visible to this MitM as plaintext.]

The same URL now: Microsoft gives in and lets you close OneDrive on Windows without explaining yourself

Update November 10th, 4:45AM ET: Microsoft has removed the dialog forcing users to fill out a survey when quitting OneDrive, and reverted to the original prompt. In a statement sent to The Verge, Microsoft says:

Between Nov. 1 and 8, a small subset of consumer OneDrive users were presented with a dialog box when closing the OneDrive sync client, asking for feedback on the reason they chose to close the application. This type of user feedback helps inform our ongoing efforts to enhance the quality of our products.

The story below is unchanged.

I think I know what you’re trying to say, and that’s actually a difficult point. Privacy is double-edged.

By that logic, you’d have to support chat control, e2e backdoor, eIDAS 45, etc. and ban Tor, Tails, VPN, BitTorrent, or encrypted communication in general because sometimes criminals can (and do) abuse such technology too. While such logic is understandable, I’m a privacy advocate and can’t agree with that. Most libre people, EFF, FSF, etc. have been fighting against that very logic for more than 20 years. I’m one of them.

Exactly, except not “the entire”, but “almost entire”?

Monero has been largely detached from CEXes, no companies, no middle men… Many users still have that idealism, a cypherpunk philosophy, that which Bitcoin tried to achieve originally. It’s community-based and crowd-funded… Some of that fund was stolen, so we’ve got to admit that the Monero community was not so smart after all… Yeah, a bit embarrassing tbh. To err is human, I guess.

For example, we do have a zero-fee donation site kuno.anne.media and recently help some girl buy a laptop or doing things like that. Some of Monero users are idealists by nature, maybe silly dreamers or naive philosophers, but definitely not greedy HODLERs. Weird people, either way, haha 😅

It’s a free country, you can use whatever you like. Respect yourself and your own intuition :)

The current situation (summer July–Sept 2023) is, you better switch to any browser that is not Chromium-based. The reason is “Web Environment Integrity” (WEI), which seems to mean, basically, Google is trying to DRM-lock the whole Internet to make sure you see their ads and they can track everyone. Freedom-loving users obviously don’t like that.

At the same time Firefox is getting more and more annoying, yet it’s better than Google. A safe bet for a general user might be LibreWolf. Another new option is Mullvad Browser.

Sorry if I sounded unpleasant. I’m not holding Monero, I actually use it (just like one may use Paypal), is all. Still, as you can see I’m from Monero.town, so obviously I’m a fan. Guilty as charged!

I’ve actually been “preaching” about privacy to my friends, but they’re typically like “Google is fine. I have nothing to hide.” Or about PGP (in vain). But I wouldn’t preach about (recommend) the privacy coin to regular people. Like you pointed out, it’s controversial and risky. As a long time user, I know too well about both sides of this.

Recently (2023), the default of GnuPG has been changed: a new key generated will be no longer RSA but ECC. Elliptic (25519) is a way to go: keys are much shorter than say RSA4096. Migrating to elliptic is convenient and perhaps safer, even though RSA may be still safe too.

Realistically 2048 is about 600-digit. Factorization of a 100-400 digit number is more or less possible now. 600 is still hard, but maybe not totally impossible in the near future.

25519 was designed by D. J. Bernstein, who tenaciously fought a long legal battle against the US cryptography export regulations. He’s also strongly criticized various sabotages (backdoor) in NIST standardized cryptography algorithms, such as the random bit generation in Dual EC. That’s why people tend to like 25519, over RSA etc.

Nerdy footnotes 😅

multiplying two different large prime numbers

Technically, the two numbers are usually not proven primes (not a big deal: they’re most probably primes, just not mathematically proven…).

brute-force cracking a strong key would require an enormous amount of time

Obviously, one wouldn’t do a naive brute-force, like trial division. There are some number theoretic, sophisticated algorithms, and they’re getting stronger and stronger, both algorithm-wise and machine power-wise… Not too long ago, people were saying RSA512 was strong enough!

Some of possible solutions include:

• always use Tor 24/7, Tails or not, when possible, even when browsing normal websites, or using IRC etc.
• use bridges

While no info can't be absolute, what you're trying to do is truly appreciated. Thanks! You're also having awesome-privacy, right? That's awesome too, even though again no info can't be absolute. Keep up the great work!

Get Tor Browser and/or Tails OS. When privacy is important and you need to be anonymous, use only Tor-friendly instances only via Tor (never once log in showing your real IP - if you accidentally do that, you'll have to re-create another account as a different person).

When an email address is necessary to sign up, get one anonymously (again using Tor Browser), from a privacy-centric company or group, e.g. Tutanota, Disroot. Needless to say never ever use Gmail. https://tosdr.org/en/service/217

It used to be much more decentralized, peaceful, not-for-profit. No systematic tracking (No GA.js). No affiliate/Google Ad infestation.

Individual users had their own small, cozy, hobby websites, not for monetizing - purely writing about whatever they were personally interested in, not trying to increase page views. A lot of good, pure, text-based websites, which perfectly worked without JavaScript nor cookies. Early webmasters were able to type clean HTML directly and fluently using a plain text editor, not depending on centralized platforms, so page load was super-fast, not bloated.

Individual users themselves owned the Internet, so to speak; were not owned by centralized platforms.

I asked two Mastodon admins, both new to crypto, to accept crypto donations, adding “if possible Monero.” To my surprise, a few weeks later one started to accept only Monero, running a full-node, p2pool’ing, even providing xmrno.de publicly for non-full-node p2pool miners. So this privacy-oriented (no-logging) generic Mastodon instance ieji.de (also providing onion/I2P) is now Monero supporting.

Tor Browser is planning to remove Google from the search engine options a user can choose: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41835

There some say brave onion + no JS is good: https://search.brave4u7jddbv7cyviptqjc7jusxh72uik7zt6adtckl5f4nwy2v72qd.onion/

Mullvad team seems to be considering 4 possible options:

• Startpage: https://www.startpage.com/
• Mojeek: https://www.mojeek.com/
• Brave Search: https://search.brave.com/
• Metager: https://metager.org/

PS: Not disgussing ddg / ddg onion too much, basically because ddg is the long-time default search engine of TB. Most TB users assume ddg is a decent, standard, generic option, esp. its non-JS version.

So you are lolcat and spamming the link to 4get.ca? If so, that makes you look a bit uncool.

https://monero.town/u/[email protected]

Good things: unlike DDG or MetaGer, zero tracking. zero ads. Clean. Unlike SearXNG, you’re not using Github (a good move). This might become huge. The fact that it’s not perfect now, doesn’t matter.

Bad things: Obviously it’ll be hard to be better than SearXNG. A donation link is especially bad; ko-fi.com itself can be there, but… In the donation campaign, SearXNG accepted crypto, while you’re only using a Paypal-like thing. That’s not really cool.

• Tuta (free): you can send only like 6 email per day. Otherwise, Tor-friendly. No onion. Support forum on Reddit 😞 Germany.
• Posteo.de: 1 €/mo affordable. Nothing fancy. Support via PGP like that’s common sense. Germany. Non-crypto anonymous payments w/ various options (e.g. a prepaid CC): they don’t even ask your name (much less address, cell phone number).
• Disroot.org: Free, pop/smtp, community-based, trusted even by the Tails team. w/ onion. Netherlands.
• Cock.li: Free, pop/smtp etc. Very Tor-friendly w/ fast onion. It’s good if you think it like disposal. Irresponsible in a way (aka Freedom), but actually 10-year-old & stable. Romania.
• Proton (free): bloated, very mixed opinions, yet better than Google. w/ onion (slow). Switzerland. A simple feature like Plain Text view is missing (HTML by default: not serious about privacy).

You may be absolutely right about a warrantless search discussed in the “See also”. EFF’s opinion (the main link) is about something different, though somewhat related. The situation seems to be…

Police procured a search warrant for defendant's cell phone but were unable to execute the warrant because the cell phone was passcode protected and defendant refused to provide the passcode. Accordingly, the State filed a motion to compel production of the cell phone's passcode.

EFF argues that even in this situation with a warrant, Fifth Amendment protections against self-incrimination mean that the defendant can’t be forced to reveal the passcode:

“When the government demands someone turn over or enter their passcode, it is forcing that person to disclose the contents of their mind and provide a link in a chain of possibly incriminating evidence,” said EFF Surveillance Litigation Director Andrew Crocker. “Whenever the government calls on someone to use memorized information to aid in their own prosecution—whether it be a cellphone passcode, a combination to a safe, or even their birthdate—the Fifth Amendment applies.”

The linked article is inaccurate and misleading. Your wild guess is based on that.

Currently the best blockchain analytics publicly available about the incident is this by Moonstone, and even though it seems that the victim shared the secret key with them, nothing much is known due to the nature of the privacy coin. No way other analytics providers could tell more.

Check the original source and some of the comments there before making an irresponsible accusation like the attackers must be North Korean (or Russian, Muslim, Romany, …). A knee-jerk suggestion like that does not only promote unfair racism/stereotypes, but it helps cover up the real mastermind. Although, it’s not your fault that the article is misleading, and we can’t rule out any possibility including what you suggested. The real problem here is this confusing, poorly-written article…

Their conclusion might be true in a way, but their “6-point proof” is uninformed if they’re criticizing Monero.

• “All stablecoins are not stable” ← irrelevant to xmr
• “Every non-stable coin is just a bigger fool scam, since there is no use case for crypto” ← what?!
• “Crypto destroys customer protections” ← “no middle men” is what we’re intentionally trying to achieve, at the cost of obvious risk
• “All consensus mechanisms are geared to allow the wealthy to control the crypto economy” ← That’s exactly what Monero is trying to avoid
• “Crypto gives great privacy protections to anonymous criminals and scammers and destroys privacy for anyone using the system as a honest user.” ← the first half is a valid criticism but the whole sentence doesn’t make sense
• “Crypto aims to prevent man-in-the-middle attacks” ← that’s not the main goal of xmr

Either way, Monero is not about making money, if that’s your point of view. Many of us are Monero users, not investors. Correct me if I’m wrong!

Because my videos will be a bunch of Monero wallet tutorials.

Sorry I have to say this, but you misinformed people here, saying one shouldn’t use Feather on Tails. It’s okay, everyone makes a mistake, but you stopped engaging conversations here on Monero.town as soon as questions were asked related to your confusing statements. So I’m not sure how to feel about this, although what you’re trying to do seems generally interesting and your website can be informative if one doesn’t believe it blindly.

In fact, your website still claims “Although you’d think Feather wallet would be the slowest because of Tor, it’s actually very efficient and fast as a light wallet. Since the IP address is hidden” etc. which is kind of confusing (Feather is fast by default because syncing is not via Tor, so your IP is not hidden). You’d trivially know such basics if you were an actual wallet user, let alone someone suitable to author wallet tutorials. Perhaps you can help us with other things, not about Monero wallets. Thank you!