New Monero Privacy Update Might Be Coming Soon: Key Improvement
A Monero contributor has submitted a pull request to enhance privacy for transactions routed through Tor and I2P networks, addressing a potential timing-based vulnerability.
The pull request, numbered 11743, was opened on November 13 and is currently pending review. It represents an alternative to an earlier proposal from November 8 that was reworked after feedback from another Monero developer.
Privacy vulnerability addressed
The patch targets a privacy weakness where the timing of transaction broadcasts could allow an observer to connect a transaction to the specific anonymity network it originated from. Currently, when a node receives a transaction over Tor or I2P and passes it to the regular Monero network, the transaction remains private during transit but becomes vulnerable once it reaches public peers.
Technical solution implemented
Under the proposed changes, nodes would only accept Tor and I2P transactions on incoming connections while ignoring those on outgoing anonymity connections. Accepted transactions would first wait for a random delay before being processed through Dandelion++, Monero's existing relay protocol that obscures transaction origins.
The update also removes the option for senders to request immediate broadcast on Tor and I2P connections, as timing analysis represents one of the simplest methods for tracing transaction paths.
The idea itself isn't new: an earlier pull request by vtnerd suggested a similar randomized delay for transactions moving from Tor and I2P to the public network.
Implementation timeline
While the code changes are relatively minor, they close a significant privacy gap for users relying on anonymity networks. The exact timeline for when this patch will be incorporated into a release remains unconfirmed, though the PR is already labeled for a backport that could see it reach the current release branch.
Related
