Cake is a honeypot

Masking your IP is the main fix, and Tor beats a VPN here: with a VPN, the provider sees your real IP instead of the node. But your IP isn't all a remote node gets. Per the Monero docs, it still sees the transactions you send and which outputs they spend from. A dishonest node can also inflate fee estimates or hand you biased decoys. So: check the fee before confirming, prefer a node you trust reached as an onion service, and never mark a public node as trusted, since that reveals which outputs you own. That's how I'd judge wallets too: Tor support and node choice matter more than the UI.

In the case of Monero, use only Monero GUI with Tor and run your own node; if you use any other wallet, connect it to your node.

A single Tor connection doesn't protect you from correlation attacks; Wasabi does take this into account. Be careful about recommending Tor and assuming that Tor alone makes you anonymous against a state-sponsored attack. Bitcoin Core also takes this into account with its new private sending feature. The Tor browser itself takes this into account—each tab uses a separate circuit. Unfortunately, most apps that use Tor do not take this into account and use only one circuit; for example, Samurai and most Monero wallets had this problem.

Good point. Lightning adds a third layer: channel graph privacy. Public channels broadcast balance ranges, payment routing leaks direction and timing. Wasabi cleans your UTXOs but the moment you fund a public channel that UTXO is live. Private channels plus Tor on your own node is where it closes.

Good point. Lightning adds a third layer: channel graph privacy. Public channels broadcast balance ranges, payment routing leaks direction and timing. Wasabi cleans your UTXOs but the moment you fund a public channel that UTXO is live. Private channels plus Tor on your own node is where it closes.

Exactly. And adding your own node with Tor completes the picture: you don't depend on a third-party server to sync your wallet. On-chain plus network plus node. Three layers, full coverage.

I know Wasabi has identity switching build in to avoid correlation, and is certainly needed when coinjoining. Otherwise input utxo's can be mapped to outputs. But people like to run Wasabi on stuff like Whonix, Qubes or Tails. Systems that run Tor transparently and this blocks the the integrated Wasabi Tor client. To get your cake and eat it too, you need to run Wasabi with --UseTor=EnabledOnlyRunning This option makes use of Tor's IsolateSOCKSAuth and make sure identity switching is happening when needed. I just set Wasabi up with Whonix and verified the identity switching with nyx 9n the Whonixgateway. Wasabi acknowledges this behavior.

Installation FAQ | Wasabi Docs

Frequently asked questions about how to properly install Wasabi Wallet. This is the Wasabi documentation, an archive of knowledge about the open-so...

Whonix

Stream Isolation

Prevent Identity Correlation through Circuit Sharing by using Tor Stream Isolation.

Your node caveat deserves one extension: it is the node traffic, not only the wallet, that can route through Tor or i2p. Guides exist to do exactly that, hiding your IP from both peers and your ISP, so self-hosting and good network privacy are not mutually exclusive.

My node is on my subnet, why tf would I connect through Tor?

Elaborate please.

He's making stuff up.

Cake offers a convenient way for normies to touch Monero. By default it will connect to clearnet servers for syncing. They ping different Monero nodes wirh your IP (similar to Nostr relays). By knowing which was the last block you asked for you gain a data point, because only 5 people dropped their last connection at block 3,346,263. There are more servers involved e.g. for price in USD (you can deactivate this, but it's on by default). At least one should be able to have ones own price server. Then if you use other wallets (Bitcoin, Ethereum) youbm connect this activity to your clearnet IP. Notice that in this case even your single Tor IP (exit node) would create some data linkage. What you really want is every wallet asking different nodes each time over different circuits including the pings for active nodes. Maybe something like a ping service server makes sense that you trust. Then you only need to create one secure connection to that server and let it connect you to a healthy remote node right away.

Cake offers a convenient way for normies to touch Monero. By default it will connect to their clearnet servers for syncing. They ping different Monero nodes with your IP (similar to Nostr relays). By knowing which was the last block you asked for, you gain a data point, because only 5 people dropped their last connection at block 3,346,263. There are more servers involved e.g. for price display in USD (you can deactivate this, but it's on by default). So if you connectvit to your own node it still will tell someone that you just looked up the price enabling timing correlation. At least one should be able to have ones own price server. Then if you use other coins (Bitcoin, Ethereum) you connect this activity to your clearnet IP. Notice that in this case even your single Tor IP (exit node) would create some data linkage. What you really want is every wallet asking different nodes each time over different circuits including the pings for active nodes. Maybe something like a ping service server makes sense that you trust. Then you only need to create one secure connection to that server and let it connect you to a healthy remote node right away. So Cake is not a honeypot right away. Most wallets are lacking those features. Cake is simply by far the biggest wallet, which makes it an easy target. I have nothing against Cake. I use it myself with certain security precautions. But I'd always recommend Feather and GUI for desktop and basically any other mobile wallet over Cake. Simply because their market position will make it hard to get rid of clearnet connection. If they don't take this seriously they will become a bad apple. That's how things are in life. You either advance and improve things or you become the problem. Time dies not stop. Adversaries don't stop either.

Add the Electrum RBF theft vulnerability to this list:

Ashigaru > Wasabi Wasabi? More like Wasagay.

I use Monero, I use Wasabi, I use JoinMarket. Ashigaru is a piece of crap with outrageous fees that nobody uses.

Feather wallet for desktop is really great, you can connect it to your node via clearnet or Tor. The best Monero only mobile wallet is Monfluo, not bloated and the sync process is suped fast. if you understand how Monero works and how easy it is to use you will not use Bitcoin anymore

Monfluo is good but I still have a use case for Bitcoin. The NGU tech and developer mind share doesn't compete yet. I can't wait for FCMP and I wane to see Multisig get a lot more built out. The future is bright.