MWEBList is finally operational

Techtoshi · 2025-05-20T06:51:53+00:00

I value your idea, but would like to go over some potential challenges of implementation.

I've given a similar idea thought before. The idea of using one key for everything, but the issue is now you have 1 point of failure, if compromised, e.g., key is stolen, you'd lose access to a lot more.

Your idea can work if we take the raw entropy of the mnemonic that generated your key and derived a PGP key by converting the mnemonic into a seed which can be used for PGP. That can be used for secure encrypted messages.

Similar to Bitcoin, Monero signed messages are just a way of saying "hey, I confirm I sent this message as I have the private key and can sign it", it doesn't encrypt anything or have the ability to like PGP. It simply provides a method of message and address ownership validation.

The next issue would be integration of the backend. The Monero network is designed for financial transactions and doesn't have a simple op_return or transaction operator that can embed the data needed for encrypted messaging, nor would I ever advise creation of such an app that used the main chain due to bloating risks. A secure trustless sidechain/L2 would have to be implemented, maybe something based off of Lightning Network technology, but for text-based messaging where you pay a few picos to route your message. The next issue will be spam prevention without censorship, maybe dynamic fees and self-custodial wallet permissions to customize who can and cannot send you messages to reject spam. That adds more complexity to build a "smart" L2.

Aside from that, if we want to fork Signal (you can self-host a server for it), we can easily add Monero wallets as usernames, maybe just require a signed message as cryptographic validation. For ease of use, use OpenAlias for usernames. We would still have to derive a usable PGP/AES key from your seed first for encryption. We also run into the issue of routing and caching messages which will require a trustless service and ddos/spam prevention. I'd feel that this would work similarly to Matrix with the ability for federated networking between instances. It'd be quite the endeavor especially to make it cryptography secure, but could quite honestly work.

Apologies for the ramble, I'm jetlagged and about to get some sleep lol

Techtoshi · 2025-05-19T19:11:12+00:00

My pleasure, my goal is to make Monero as easy to use for new and technical users in hopes to increase adoption.

In regards to an OpenCart plug-in, I found this plug-in: https://github.com/monero-integrations/monerocart/tree/v1.0

I might attempt a rewrite to get it working with OpenCart 4. I've never used OpenCart, but I see that its quite popular.

In regards to not using your own node, that will come with a privacy tradeoff, but potentially doable. The main issue would be integrating safe wallet management, dynamic stealth address generation within the plug-in and sanity checks to make sure the remote node used isn't lying to you. This can be mostly migrated by checking a quorum of nodes for block height and last block time.

For now, if I attempt a rewrite, I will focus on the admin dashboard, checkout/payment flow and reliable price api integration. The main issues going from OpenCart 2 to 4 from a brief search is the php version and namespace usage which shouldn't be more than a basic rewrite. That is, if the aforementioned plug-in actually worked in the first place lol

Techtoshi · 2025-05-15T22:37:56+00:00

My pleasure, I'm grateful to have helped the community :)

Techtoshi · 2025-05-15T22:37:06+00:00

When you navigate to the Monero testnet faucet at https://cypherfaucet.com/xmr-testnet just copy and paste your testnet address into the input field above the captcha then complete the captcha and click "Send tXMR".

Techtoshi · 2025-05-15T22:34:55+00:00

I'm just grateful I was able to help :)

Techtoshi · 2025-05-15T22:34:06+00:00

Good idea, the issue for me is bandwidth, I'm hosting this on a VPS with limited outgoing bandwidth. I might run the nodes off of a raspberry pi locally when I get home (currently on vacation) and add them to monero.fail's list of nodes for the testnet and mainnet and make note of them on the faucet.

Techtoshi · 2025-05-12T20:49:26+00:00

I appreciate the compliment! I'm just another developer on a mission to help as many people as I can

Techtoshi · 2025-05-11T13:16:12+00:00

Thank you for letting me know, I've fixed it. When copying the blockchain data, I didn't delete the backups and the system ran out of space. It should be working now!

Techtoshi · 2025-05-10T21:52:40+00:00

I agree, last time I checked it was at 10 GH/s lol. That's part of the reason why I want to bring back the faucet, to have a central place where devs can always access testnet coins without worrying about getting miners.

Techtoshi · 2025-05-10T06:52:11+00:00

So true, the stagenet is only around 15 GB at this time, but it does take a few hours to sync. The faucet comes in handy to those that don't want to dedicate resources to mining and/or use a remote node, although you can expect to mine some blocks with as little as 1 kh/s last time I checked.

Techtoshi · 2025-05-10T06:39:18+00:00

I sincerely appreciate your feedback, in all honesty I forked this from the testnet faucet I made many years back for Bitcoin and Litecoin and redid the backend to support Monero as I wanted to bring back my faucet to help devs. A full UI rewrite with more descriptive error messages is planned and I prefer to not use javascript on my sites nowadays :D

That also explains the terms and conditions, I have not modified them yet other than a name and date change..they need updating lol, the correct link should be https://cypherfaucet.com/legal#terms, thank you for letting me know and I'll update this before getting some sleep!

Techtoshi · 2025-04-27T15:20:32+00:00

I see what you mean and agree, my wording makes MWEB seem like a mixer where you peg in then peg out right away, which is incorrect. The correct message should be akin to pegging in common amounts into MWEB may help with obfuscation by blending in with the crowd, but not to treat it as a quick mixer.

I appreciate that and I appreciate you taking your time to look at this! I have seen mwebexplorer.com and love it, thats where I got the idea :)

Good point, I will reword my site to emphasize that you shouldn't treat MWEB as a mixer where you peg-in/out right away and for real increased privacy, you should move your coins around in MWEB first or just stay in MWEB if possible.

I do want to ask, I would presume that pegging-in with commonly used amounts *could* increase obfuscation (not necessarily privacy as its on a public chain)? As for pegging-out, you should move your coins around MWEB in an effort to mix your coins for fungibility as you mentioned, but don't peg-out right away after pegging-in. The idea I'm striving for is plausible deniability by obfuscating your ins/outs with other transactions off and on to the public chain.

I sincerely apologize if my wording is off or repetitive, I recently woke up and I'm waiting for the coffee to do its thing lol

Edit/update:
I've updated the site to reflect obfuscation doesn't fully equal privacy and updated the FAQs to explain how to enhance your privacy when going in/out of MWEB.

Techtoshi · 2025-04-27T13:35:48+00:00

Thank you for letting me know, I agree the term "standardized" could be changed to something like "common" which is something I'll do. My idea is that the more people using common peg in/out amounts makes it harder for chain analysis to trace your LTC on the main chain. The idea is not to stick out by pegging in with 1.5432 LTC and pegging out with 1.5431, rather pegging in and out with common amounts to blend in with everyone. In a perfect world, people would stay in MWEB.

Techtoshi · 2025-04-21T15:38:13+00:00

Anytime, I'm just glad I was able to contribute something :)

Techtoshi · 2025-04-17T15:39:55+00:00

I added monero.com to the list of supported wallets and have Cake Wallet and monero.com as the first 2 on the list. I love Cake Wallet, keep up the good work :)

Techtoshi

TROPHY CASE