To view the list of links, please access this site using Tor Browser.
If you’re seeing this message, access is restricted for regular browsers.
Already using Tor? If you are sure you’re currently in Tor Browser, proceed to our .onion version:
| Issue | Explanation and Mitigation |
|---|---|
| IP Logging | When connecting to a remote node, as with all services on the internet, they are able to see your IP address. This could potentially lead to a transaction being linked back to you if you do not take the proper precautions. How do you mitigate it? Simple. I think most of you already know the answer. Use a VPN, preferably one that doesn't take any personally identifying information (PII), like Mullvad for example, or, even BETTER, use the very network you're on now to see this post TOR! Connecting to a remote node over Tor would be preferable here as it is more secure than a VPN with more hops. The most secure way to mitigate this attack is to only use nodes that work over Tor as a hidden service aka "Onion nodes". Connecting to a regular node on the clearnet over Tor is fine but when you use a .onion node, traffic between you and the node never leaves the Tor network. Meaning everything stays encrypted and anonymous, there are six nodes between you and the onion service, three for your route and three for the node's route, meeting at a rendezvous point in the network. You can read more about this on the Tor Project's ⚠️website⚠️. As long as you are hiding your IP address in some way shape or form, you will be fine here. |
| Malicious nodes and bad data | Unfortunately, there are some bad apples out there as with any P2P network. The good news is, if you're using a pretty popular and trusted wallet such as Feather or Cake wallet, you don't really need to worry too much about malicious nodes, as the ones those two use are generally considered to be trustworthy and safe. Either being run by the devs themselves or by prominent figures within the privacy/security space such as sethforprivacy. What can a malicious node do and what can you do to mitigate them? You will typically see a malicious node doing any of these three things:
So, how do you mitigate it? How do you not fall victim to a malicious node? Well, first off, the chances of you connecting to a malicious node is, rare. Especially if you're using a trusted wallet such as Feather or Cake wallet with their built-in remote nodes. I would say your risk is higher if you're using something like monero.fail and picking out nodes at random to add to your list. Let's say you accidentally used a malicious node, what do you need to look out for? Pay close attention to your wallet activity. It should be easy to spot if a node is malicious. Check there is anything that seems off with your wallet. Are there transactions that aren't supposed to be there? Did you have to pay an abnormally high fee to get your transaction through? Did you send your favorite vendor some monero an hour ago and he still hasn't gotten it? These are all signs you are connected to a bad node. Check the blockchain, make sure your transactions are going through, and remember, if you did connect to a bad node it's not the end of the world, your funds are safe on the real blockchain. There are thousands of other good nodes keeping track of your precious funds. Connect to a good node again and your wallet should go back to normal. The weird transactions will disappear and fees should go back to normal. |
With a remote node its a little better that you are staying inside the onion network at least when using a .onion address node.
The worry is the meta data that a compromised node can keep and collect.
In a full non pruned self hosted node there is I think a ring size of 16, that's what you are using when you use a remote node, using another persons local node.
If the node is malicious they can compromise how the ring works and get more data than they otherwise could.
Since you are connecting over tor to a .onion there is no Exit IP, you remain in the network using their relays as well. They do not really get much considering the solidarity when remaining inside the onion network. Overall though its better to have a local node man. You never know when a remote node has been chain anal fucked, and even though its just meta data at that point why are you even playing with fire.
I understand if you are using TAILS or have storage restriction but the blockchain is around 130GB. Download it, I highly suggest you find a way to make that happen.