Saki

Monero Project admits thieves stole 6-figure sum from a wallet in mystery breach

https://lemmy.world/post/7993453 i.e. https://monero.town/post/1045387

While there are typical comments like crypto=scam “You have to be quite stupid to support crypto in 2023”, there are also replies like these (with which more people seem to agree, unexpectedly):

It’s designed to protect anyone using it - even attackers. That’s the price to pay for having privacy. The alternative is an Orwellian dystopia.

If you’re going to use Luna, FTX, and NFTs as arguments about something like Monero, […] you probably don’t really understand any of them.

It’s a bit odd that such a discussion is more active on a different Lemmy instance than here, but it’s interesting to hear honest opinions of various people about the incident, about Monero. Maybe your views are different from them, from mine. For example, one person states there that while they know exactly what Monaro is, they’re still skeptical.

These changes radically expand the capability of EU governments to surveil their citizens by ensuring cryptographic keys under government control can be used to intercept encrypted web traffic

This enables the government of any EU member state to issue website certificates for interception and surveillance

https://www.internetsociety.org/resources/doc/2023/qualified-web-authentication-certificates-qwacs-in-eidas/

The browser ecosystem is global, not EU-bounded. Once a mechanism like QWACs is implemented in browsers, it is open to abuse

https://en.wikipedia.org/wiki/EIDAS

The proposal would force internet companies to place a backdoor in web browsers to let them perform a man-in-the-middle attack, deceiving users into thinking that they were communicating with a server they requested, when, in fact, they would be communicating directly with the EU government. […] If passed, the EU would be able to hack into any internet-enabled device, reading any sensitive or encrypted contents without the user's knowledge

See also: https://mullvad.net/en/blog/2023/11/2/eu-digital-identity-framework-eidas-another-kind-of-chat-control/

[Edit 2: Read the admin’s “reasoning” and comments here or see PS below. The clearnet site is up again. The onion versions = 100% up tme for me]

[Edit: As of writing this (2023-11-01) their clearnet server is down, while the onion version is working. Cock.li is exactly like this… Relatively rarely but randomly it’s down. Kind of irresponsible but it’s just like that. Interestingly, though, onion is up and clearnet is down. Usually opposite.]

Onion http://rurcblzhmdk22kttfkel2zduhyu3r6to7knyc7wiorzrx5gw4c3lftad.onion/

Cockbox on kycnot.me - https://kycnot.me/service/cockbox

(From their webpage)

Cock.li is your go-to solution for professional E-mail and XMPP addresses. Since 2013 cock.li has provided stable E-mail services to an ever-increasing number of users. Cock.li allows registration and usage using Tor and other privacy services (proxies, VPNs) and thanks to continued funding by its users is certain to stay free forever.

Cock.li (aka Cockmail) is a Tor-friendly, privacy-focused, soon-to-be-10-year-old free email provider (IMAP, POP, XMPP, Webmail). Although currently (since around 2021) a new registration is invite-only, the admin @vc now states on their website:

E-mail is a Human Right!

Oppressive governments are using dirty tricks to try and force e-mail providers to require phone numbers or other controlled integrations to register. We will never allow these crimes against our userbase. We will stand up for the right to register for e-mail without being surveilled, and demand this right to be recognized globally. Public registration re-opens on cock.li's 10th birthday, 20 November.

Probably people here know this service pretty well, but some important points:

• Their email addresses are sometimes blacklisted when you want to use them, because in the past the service was abused by spammers. So this provider may not be suitable for normal users/normal usage. Its “technical scores” may be low too, when checked e.g. via https://internet.nl/mail/ If you think this is sketchy and its name is weird, it is. It’s not for you, so please just ignore it.

• A cock.li account may be great to have if you want to sign up and use it anonymously always via onion (something you can’t do with Proton or Tutanota), perhaps with PGP. Maybe great to use on Tails OS too.

• Their service was not very stable in the past. In recent years, it’s been rather stable and very fast even via onion. Pop/Imap via Tor works perfectly. Cock.li onion may load 100 times faster than that of Proton.

• Custom domains are not supported! Consider Disroot or Tutanota if you need them and would like to pay with Monero.

• They are one of the earliest v3 onion providers. In contrast, Proton was so slow to migrate from v2 to v3 (even after v2 got obsolete). Cock.li is also one of the oldest mail providers that started accepting BTC and XMR donations. So probably they’re extremely well-funded (you know why).

• If you use Thunderbird, set up your account manually (its automatic setup probably doesn’t work right).

For more info, visit their webpage. Please DO NOT abuse this based cypherpunk service.

---

PS. Vincent Canfield ([email protected]) wrote on September 23, 2023:

Good morning, CISA is now calling cock.li a "Malicious E-mail Domain" and implies this is because it's not "publicly available". So, cock.li will once again open to the public on its 10th birthday, 20 November. #StopRansomware

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a

For those who don't remember, a previous CISA advisory which recommended "service providers strengthen their user validation and verification systems to prohibit misuse of their services" shortly predated cock.li going invite only.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a

I'm sure if cock.li added phone number verification these joint statements would go away. Everyone sees what's happening, you want to force all providers to link to identities so you can surveil people. Cock.li is never adding that bullshit.

For example "3 (1 New)" is understandable: there are 3 comments, of which 1 is new. But I sometimes also see things like "6 (-3 New)", "5 (-1 New)", where the number of new comments is negative. Is this some kind of known bug, or is it by design actually meaning something? It's totally harmless, but weird...

Hamilton was an Irish mathematician, who discovered quaternions on the 16th of October, 1843. When he discovered them, he was so happy that he carved his fundamental equations i² = j² = k² = ijk = −1 into the stone of a bridge (apparently he was walking near it).

“That is to say, I then and there felt the galvanic circuit of thought close; and the sparks which fell from it were the fundamental equations between i, j, k; exactly such as I have used them ever since.”

If you think this is not fun, please, just ignore it. While I’ll write this like talking to a 14-year-old teen, the following is nerdy (mathematical) and lengthy 😅

Today a hundred and four score years ago, Hamilton discovered “quaternions”. To commemorate this, allow me to use (Monero-flavored) quaternions to prove Euler’s identity: If N is a sum of four squares and n is a sum of four squares too, then Nn is also a sum of four squares.

Example: 8 = 2² + 2² + 0² + 0² and 127 = 9² + 6² + 3² + 1² are sums of four squares. So 8*127 = 1016 must be somehow a sum of four squares too.

Proof: Given N = A² + B² + C² + D² and n = a² + b² + c² + d² with some intergers A, B, C, D, a, b, c, d, we need to show Nn = E² + F² + G² + H² with some integers E, F, G, H. Since we’re Monero fans, let us use X, M, R instead of Hamilton’s i, j, k. Things work in a “cyclic“ way like this:

X² = M² = R² = −1 ... Eq.(1)

XM = R, but MX = −R ... Eq.(2)

MR = X, but RM = −X ... Eq.(3)

RX = M, but XR = −M ... Eq.(4)

If we define XMR = −1 imitating Hamilton’s ijk = −1, (2)(3)(4) follow. X, M, R are a bit unusual: the order of multiplication matters (e.g. XM and MX are different). On the other hand, regular numbers (say: e, f, g, h) can “move” freely, as in hXM = XhM = XMh. A quaternion is a “number” of the form e + fX + gM + hR.

Assume we have two quaternions, Q = A + BX + CM + DR and q = a + bX + cM + dR. Multiply Q by q, and things become a bit messy:

Qq = (A + BX + CM + DR)(a + bX + cM + dR)

= Aa + Ab(X) + Ac(M) + Ad(R)

 + Ba(X) + Bb(X²) + Bc(XM) + Bd(XR)

 + Ca(M) + Cb(MX) + Cc(M²) + Cd(MR)

 + Da(R) + Db(RX) + Dc(RM) + Dd(R²)

= Aa + Ab(X) + Ac(M) + Ad(R)

 + Ba(X) + Bb(−1) + Bc(R) + Bd(−M) ← using (1)(2)(4)

 + Ca(M) + Cb(−R) + Cc(−1) + Cd(X) ← using (2)(1)(3)

 + Da(R) + Db(M) + Dc(−X) + Dd(−1) ← using (4)(3)(1)

= (Aa − Bb − Cc − Dd)

 + (Ab + Ba + Cd − Dc)X

 + (Ac − Bd + Ca + Db)M

 + (Ad + Bc − Cb + Da)R

If we write

E = Aa − Bb − Cc − Dd,

F = Ab + Ba + Cd − Dc,

G = Ac − Bd + Ca + Db,

H = Ad + Bc − Cb + Da,

then above mess becomes tidy:

Qq = E + FX + GM + HR ... Eq.(5)

Now, consider a function swap() that converts a given quaternion u = e + fX + gM + hR into a quaternion e − fX − gM − hR. By messy calculation like above, you can show: swap(Q) * swap(q) = E − FX − GM − HR which is = swap(Qq) according (5). Generally, for any two quaternions u, v:

swap(uv) = swap(v) * swap(u) ... Eq.(6)

We define the hash of u = e + fX + gM + hR as hash(u) = e² + f² + g² + h². Since e, f, g, h are regular numbers, a hash is a regular number. Just like above, do some math and you get:

hash(u) = u * swap(u) ... Eq.(7)

Using (7) with u = Qq,

hash(Qq) = (Qq) * swap(Qq) = Q * q * (swap(q) * swap(Q)) ← using (6) with u=Q, v=q

= Q * (q * swap(q)) * swap(Q) = Q * hash(q) * swap(Q) ← using (7)

= Q * swap(Q) * hash(q) ← hash is a regular number; can “move” freely

Again using (7), we conclude hash(Qq) = hash(Q) * hash(q) ... Eq.(8)

Recall the definition of “hash”. Given Q = A + BX + CM + DR and q = a + bX + cM + dR,

hash(Q) * hash(q) = (A² + B² + C² + D²)(a² + b² + c² + d²) ... Eq.(9)

We know Qq = E + FX + GM + HR as in (5), so

hash(Qq) = E² + F² + G² + H² ... Eq.(10)

(8) says (9) = (10), meaning

(A² + B² + C² + D²)(a² + b² + c² + d²) = E² + F² + G² + H² as required.

Example (cont.): With 8 = 2² + 2² + 0² + 0² and 127 = 9² + 6² + 3² + 1²,

E = Aa − Bb − Cc − Dd = 2×9 − 2×6 − 0×3 − 0×1 = 6

F = Ab + Ba + Cd − Dc = 2×6 + 2×9 + 0×1 − 0×3 = 30

G = Ac − Bd + Ca + Db = 2×3 − 2×1 + 0×9 + 0×6 = 4

H = Ad + Bc − Cb + Da = 2×1 + 2×3 − 0×6 + 0×9 = 8

Sure enough, 6² + 30² + 4² + 8² = 1016 = 8*127 😃

Notes: We implicitly assumed that multiplication of quaternions is associative. This assumption is correct as you can see (ij)k = (k)k = −1 and i(jk) = i(i) = −1 are identical, etc. Euler originally used −B, −C, −D, instead of our B, C, D. Both versions are essentially the same.

Monero-themed names ~ Standard names:

X, M, R ~ i, j, k

swap ~ conjugate

hash ~ norm (or norm squared, depending on how you define it)

1️⃣ Completely normal photos, such as holiday pictures 🏞️ are considered suspicious.

2️⃣ So our private family photos or the chats and pictures from your sexting yesterday 🍑🍆 also end up on an official table. So we can throw privacy in the bin 🚮

Chances are high that most of your European friends have never heard of chat control. So let them know about the danger and what you think about the chat control proposal.

“The European Commission launched an attack on our civil rights with chat control. I contacted my local MEP to tell him that I oppose the proposal. You can do so too! This Website I found will help you write an e-mail to an MEP using A.I.”

The bug fixed in cURL 8.4.0 (CVE-2023-38545) is a nasty one, but it seems rather harmless in our context.

First of all, if you don’t use socks5, this issue should be irrelevant. (But do your own research. Source code is there for you to freely study, modify, compile.)

According to the blog, the bug could be exploited only if a socks5 proxy user is tricked to resolve a crazy long hostname (~1024 characters+), which sounds unlikely; except if your direct peer is evil, they might be able to send you a crazy long hostname instead of a numeric IP… maybe? However, if you’re on socks5 proxy, the attacker can’t see your real IP to begin with, so they can’t attack you (I think).

The only attack vector my stupid head can think of is: if for some reason you use both clear connections and socks5 connections, then a lucky attacker who notices your behavior can hit your real IP when you’re on Tor, using your wallet address as an identifier. (Tor exit nodes are public, so they know someone is on Tor.) Even then, maybe the worst thing that could happen is that your p2pool crashes due to buffer overrun.

exchanges may randomly use this to freeze and block funds from users, claiming these were "flagged" […]. You are left hostage to their arbitrary decision […]. If you choose to sidestep their invasive process, they might just hold onto your funds indefinitely.

The criminals are using stolen identities from companies that gathered them thanks to these very same regulations that were supposed to combat them.

KYC does not protect individuals; rather, it's a threat to our privacy, freedom, security and integrity.

• For individuals in areas with poor record-keeping, […] homeless or transient, obtaining these documents can be challenging, if not impossible.

PS: Spanish speakers: KYC? NO PARA MÍ

Cloudflare-free link for Tor/Tails users: https://web.archive.org/web/20230926042518/https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/

It would introduce a complex legal architecture reliant on AI tools for detecting images, videos and speech – so-called ‘client-side scanning’ – containing sexual abuse against minors and attempts to groom children.

If the regulation undermines encryption, it risks introducing new vulnerabilities, critics argue. “Who will benefit from the legislation?” Gerkens asked. “Not the children.”

Groups like Thorn use everything they can to put this legislation forward, not just because they feel that this is the way forward to combat child sexual abuse, but also because they have a commercial interest in doing so.

they are self-interested in promoting child exploitation as a problem that happens “online,” and then proposing quick (and profitable) technical solutions as a remedy to what is in reality a deep social and cultural problem. (…) I don’t think governments understand just how expensive and fallible these systems are

the regulation has […] been met with alarm from privacy advocates and tech specialists who say it will unleash a massive new surveillance system and threaten the use of end-to-end encryption, currently the ultimate way to secure digital communications

A Dutch government official, speaking on condition of anonymity, said: “The Netherlands has serious concerns with regard to the current proposals to detect unknown CSAM and address grooming, as current technologies lead to a high number of false positives.” “The resulting infringement of fundamental rights is not proportionate.”

As enacted, the OSB allows the government to force companies to build technology that can scan regardless of encryption–in other words, build a backdoor.

Paradoxically, U.K. lawmakers have created these new risks in the name of online safety.

The U.K. government has made some recent statements indicating that it actually realizes that getting around end-to-end encryption isn’t compatible with protecting user privacy. But

The problem is, in the U.K. as in the U.S., people do not agree about what type of content is harmful for kids. Putting that decision in the hands of government regulators will lead to politicized censorship decisions.

The OSB will also lead to harmful age-verification systems. This violates fundamental principles about anonymous and simple access

See also: Britain Admits Defeat in Controversial Fight to Break Encryption

Libereco estas plej bona.

Why did you remove the “How do I start mining monero?” post?

Because the OP may have been a child? Or simply because it should have been asked in Monero Mining rather than in Monero? Or perhaps because the question was trivial (too basic)?

While I do feel (a few more) rules are necessary here, I’d like them to be explicit and transparent, if possible. Thank you.