New Monero Privacy Update Might Be Coming Soon: Key Improvement
Monero contributor has opened a pull request that changes how nodes relay transactions coming from Tor and I2P, according to the project's GitHub.The patch addresses a that could allow an observer to connect a transaction to the anonymity network it came from due to the timing of its broadcast.PR 11743 was opened on November 13 and is currently pending review. It is an updated version of a PR opened on November 8 by contributor vtnerd. After receiving feedback from another Monero developer, vtnerd, the PR was updated.How does it work?The issue lies in a mechanism where a node receives a transaction over Tor or I2P and then passes it to the regular Monero network.Currently, when a Monero node receives a transaction over Tor or I2P, it relays that transaction to the rest of the Monero network.While the transaction is technically private as it travels into the node, once it reaches Monero's public peers, the transaction is no longer private. This PR proposes that Monero nodes will only accept transactions from Tor and I2P peers over incoming connections. Transactions received over outgoing Tor and I2P connections would be ignored.Once accepted, the transaction would be subject to a random delay before being relayed to the rest of the Monero network using Monero's existing transaction relay protocol, Dandelion++. Currently, a user can instruct their node to broadcast their transaction immediately.Over Tor and I2P connections, this request would be ignored. No transaction would be exempt from the random delay.Being able to link a transaction's timing between the anonymity network and the Monero network is an easy way to deanonymize a user. If a transaction is broadcast to the Monero network immediately after being received from Tor, an observer watching both networks can link the two.Not a new ideaThis is a similar concept to a previous PR from vtnerd that would have introduced a randomized delay when relaying transactions from Tor and I2P to the Monero network.While the amount of code that would need to be modified is not particularly large, this does close a hole for users that rely on Tor and I2P to obscure their location.When the patch lands in a release is yet to be confirmed. The PR is also labeled for a backport, so it might reach the as well.