作者algorithm (algorithm)
看板DigiCurrency
标题[新闻] XMR诱饵选择算法的私密漏洞
时间Fri Aug 13 15:52:14 2021
新闻来源连结：
门罗币官方twitter
https://twitter.com/monero/status/1419852036913475587?s=20
门罗币论坛
https://forum.monero.space/d/
94-privacy-bug-decoy-selection-algorithm-ignores-very-recent-outputs
新闻本文：
Privacy bug: Decoy selection algorithm ignores very recent outputs
sgp_17 days ago Edited
A rather significant bug has been spotted in Monero's decoy selection
algorithm. Please read this whole message carefully.
在门罗币的诱饵选择算法中发现了一个相当显着的错误。
If users spend funds immediately following the lock time in the first 2
blocks allowable by consensus rules (20 minutes after receiving funds), then
there is a good probability that the output can be identified as the true
spend. This does not reveal anything about addresses or transaction amounts.
Funds are never at risk of being stolen.
如果用户在共识规则允许的前2个区块的锁定时间之後立即花费资金（收到资金後20分钟
），那麽有高机率将输出可被识别的真正花费。这不会透露有关地址或交易金额的任何信
息。资金也没有被盗的风险。
This bug persists in the official wallet code today.
Users can substantially
mitigate the risk to their privacy by waiting 1 hour or longer before
spending their newly-received Monero, until a fix can be added in a future
wallet software update. A full network upgrade (hard fork) is not required to
address this bug.
使用者可以在花费新收到的门罗币之前等待1小时或更久，直到可以在未来的钱包软体更
新中添加修复程序，从而大大降低其隐私风险。解决此错误不需要完整的网络升级（硬
分叉）。
The Monero Research Lab and Monero developers take this matter very
seriously. We will provide an update when wallet fixes are available. Please
read this GitHub issue for more details:
https://github.com/monero-project/monero/issues/7807
I have invited the individual who spotted this bug, Justin Berman, to join me
on an episode of Breaking Monero once we can more easily explain the required
fix to people.
评论：
大家收到XMR後记得等一下再使用就没事了，虽然不太方便不过先顶着先。
--
If yesterday was two days ago tomorrow,
will the day after tomorrow be today or yesterday?
Temporal Manipulation 101 final exam, Tolarian Academy
如果昨天到了明天会变成两天前，
试问後天应该是今天或是昨天？
时间操纵绪论期末考，陶拉里亚大学院
--
※ 发信站: 批踢踢实业坊(ptt.cc), 来自: 118.160.131.224 (台湾)
※ 文章网址: https://webptt.com/cn.aspx?n=bbs/DigiCurrency/M.1628841140.A.EF3.html
1F：→ kevinmeng2: 暗网表示… 08/13 15:53
2F：→ algorithm: 地址或金额这种重要资讯不会输出啦,且有暂时workaround 08/13 15:57
※ 编辑: algorithm (118.160.131.224 台湾), 08/13/2021 15:59:37
3F：→ algorithm: 不用硬分岔的话应该都小事... 08/13 16:00
4F：推 ECZEMA: 再转一个 secret network 後换乙太从 bsc 或 erc 出 08/13 18:00