20:14:09 The onion link to jhendrix’s research on network-level privacy issues with the Zano network (discussed here: https://matrix.to/#/!toFcRZtpaiwiyapgVO:matrix.org/$OK0H6qnHNRCzQnE_4MKZvozDuQo__LCnlCtozYLGSX8?via=matrix.org&via=monero.social&via=unredacted.org) appears to be down. Has anyone backed up or saved a copy of the article? 20:21:59 I do. 20:26:08 Could you share it, please? :) 20:37:00 There are two pages. One has the methodology. The other has the actual estimated balances of the Zano accounts. The second is arguably privacy-sensitive. 20:39:17 IIRC, @jhendrix:imagisphe.re published the methodology first and asked the Zano team to respond to the methodology with a plan to mitigate network-level threats to privacy. If they did not respond, then he planned to (and did) disclose some of the estimated account data. 20:40:01 > Will my financial activity be disclosed? 20:40:01 > Fortunately for the users, this research was conducted by people who care about making the world a better place and have no intention of revealing or selling any financial data, such as IP addresses or transaction IDs. Total balances were disclosed, but without the actual IP addresses. 20:40:01 > We expect public recognition of this work and the strategies to address the attack from the core team and public figures by July 20 at the latest. Otherwise, we will publish the user's country and the first octet of the IP address so it can be manually confirmed by the users themselves. Since the network is small, actual IP [... too long, see https://mrelay.p2pool.observer/e/l9yesZcLbjB6WWxU ] 20:40:01 > A smart spy node operator would never disclose their work publicly. Instead, they would keep their de-anonymization efforts hidden for a long time, until they decided to sell that valuable data to the highest bidder, and the bid would be substantial. We started our experiment on May 25th, and by June 10th, it had already bee [... too long, see https://mrelay.p2pool.observer/e/l9yesZcLbjB6WWxU ] 20:40:02 > We don't expect everyone to agree with all our criticisms, but at the very least, we can all agree that the lack of IP obfuscation in a privacy coin is an extremely bad idea. Fortunately, we have various options to mitigate and potentially solve the problem. We expect the team to publicly acknowledge this work and share their plan for mitigating it. 20:40:22 ^ is what a section of the methodology said. 20:45:04 I will give @jhendrix:imagisphe.re 24 hours to respond to whether he or she would object to republication of the webpages. 20:45:23 it's for personal use only: I have no intention of republishing it anywhere / causing any harm (I've worked with highly sensitive data irl (medical-grade sensitive, sometimes literally lol), so I completely understand the concern). And ofc feel free to redact anything you think is too sensitive / unethical to share: I'm not asking you to trust a random anon on the internet :) 20:49:20 ...BTW, Zano has already had a full year to address/fix this. 20:49:56 @aillia:matrix.org: Any news about that? 20:51:30 no, not that I know of