Lissy93 / personal-security-checklist

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2024
https://digital-defense.io
Other
16.74k stars 1.16k forks source link

[CONTENT-CHANGE] Remove "Use Cryptocurrency for Online Transactions" #70

Open matkoniecz opened 2 years ago

matkoniecz commented 2 years ago

State which point should be edited or removed. Put "Remove/ Edit ____" as Title

Unlike card payments, most cryptocurrencies are not linked to your real identity. Many blockchains have a public record, of all transaction matadata, on a public, immutable ledger. So where possible, opt for a privacy-focused currency, such as Monero or ZCash. If you are using a widley- supported currency (such as Tether, BitCoin, LiteCoin, Ripple, Etherium etc), take steps to distance yourself from the transaction details. See more privacy-respecting crypto currencies.

Justification

While technically true, achieving actual anonymity beyond offered by standard solutions is not really easy. First of all, buying cryptocurrency is done with regular money and shaking that connection is not easy.

Especially with BTC as the most prominent one "Use Cryptocurrency for Online Transactions" is not really helpful.

Additionally, using cryptocurrency opens user to new exciting classes of security issues.

In general, it is worth doing only for really dedicated, advanced people extremely caring about specific attack modes and able to avoid various traps.

I think that it should be removed or tradeoffs should be explained better. And it should not be "Optional" it should be something like "requires rearranging your life"

Lissy93 commented 2 years ago

If you’re buying BitCoin at an exchange, then I agree that this would be pretty terrible for privacy. But if you primarily use something like XMR, or you are savy in how you manage your wallets (exchanging cash for crypto, not reusing wallets, self-custody etc), then crypto can provide the ability to send funds to anyone, anywhere that just isn’t possible with cash, and can’t be done privately with transfers / payment processors.

That's kind of what I meant by this point anyway, do you think I should re-word it to highlight those risks (public ledgers, exchanges etc)?

matkoniecz commented 2 years ago

I would definitely at least mention tradeoffs here.

For start significant research is needed, there are new unexpected failure modes, typical uses are not privacy-preserving at all, there are significant costs of various kinds.

I am not entirely sure who is intended to be target of this list, but given tradeoffs involved I think that it is unlikely that benefits are worth various costs. I would not recommend using cryptocurrency, at least as it stands now.

And costs related to cryptocurrency are significant and unexpected, for example:

Lissy93 commented 2 years ago

You are right in a lot of this, and I agree, that in order to do this properly and securley, the learning curve is very steep.

It's a real shame that there are so many crypto scams, pump and dumps and shit coins out there at the moment, because many cryptos are based on some awesome technology, and have great potential.

I personally use XMR (and sometimes BTC) to transfer funds to friends abroads, and find it really useful for avoiding high international transfer fees,

I think this comes down to skill level, threat model, personal preference. I will update this part of the list, and maybe link to this issue, as you've made some really good points.

matkoniecz commented 2 years ago

and find it really useful for avoiding high international transfer fees

and it is yet another part about tradeoffs! For example I made many international transfers (sending/receiving) and never paid anything for that (within European Union + receiving transfers from USA). Once I needed new bank account (which was both less time-consuming and less risky than transfer using crypto).

It's a real shame that there are so many crypto scame, pump and dumps and shit coins out there at the moment, because many cryptos are based on some awesome technology, and have great potential.

Yeah, it is yet another case of evil people causing costs for others :/

I think this comes down to skill level, threat model, personal preference. I will update this part of the list, and maybe link to this issue, as you've made some really good points.

Definitely, depending on use case and situation it ranges from "please stop, that is horrible idea" to "no alternative".

But right now it seems to me that median is on "please stop, that is horrible idea" or on "hmm, maybe, if you really want".