Flawed privacy of NYM unrelated to the mixnet and call to action

General Discussions
1

I really enjoy NYM’s concept of a mixnet and genuinely think that it is a very good option for network-level privacy.

However if people engage with the NYM community, run a node, want to contribute to NYM, want support for swaps or their VPN there doesn’t seem to have been a lot of consideration for user and contributor privacy.

In a lot of cases it actually makes me question NYM’s overall mission and it definitely destroyed a lot of the original trust I had in NYM as a company and for people that actually care about their privacy there is in my opinion no reason not to be concerned about at least some of these.

Requiring or promoting surveillance technology

  1. The only way to contribute to NYM is to create an account on github and contribute to their repo.
    → Github’s 4 Privacy Policies that are very long, hard to read and by agreeing to them you’re giving up a lot of your freedom

  2. The only way to receive NYM rewards in the NYM squad league seems to be to link your Keplr Wallet.
    → Kepl’s Privacy Policy isn’t as long as github’s 4 privacy policies, but they collect as much as they can about their users. This includes but is not limited to:

    • Public key(s) on a specified blockchain, and data that is openly available and associated with your public key on chain.
    • Offline messages signed by your public key(s).
    • Technical data, including information on the blockchain network used, referring web application(s), and transaction data.

    This isn’t much better than using coinbase other than you not having to give them a copy of your ID. Node operators, contributors and others being forced into using this are very much in danger of being tracked and eventually exposed. And they are most definetly giving up control over their blockchain interactions.

  3. There is no maintained privacy friendly and open source NYM (NYX)/Cosmos wallet where you can swap your NYM for ERC-20 or other tokens. All options previously available are no longer maintained and Keplr has a monopoly on this as far as I can tell. In point 2 I have already mentioned why Keplr is not a good option. This includes spectredao swap which generally expects you to be using Keplr.

    There is https://swap.nym.com but you need to contact NYM support with an order number to get problems resolved which means you need to expose information about yourself to get your tokens unstuck. After not even close to 10 swaps https://swap.nym.com required this from me which makes it a very unreliable swap option.

    For an operator needing to pay server cost, this means that hundreds of dollars might just get stuck until you contact support via email or matrix. Even contacting them via matrix then creates a permanent link from your pseudonym to that swap and evidence that can be used against you.

  4. The only option to watch NYM’s video content is youtube.

  5. The promotion of nodes for staking is only possible through telegram.

  6. A lot of NYM’s online appearances are using vercel or have third-party/cloudflare/discord tracking cookies on the sites (for example https://nymhub.space)
    → Vercel Privacy Policy
    → Cloudflare Privacy Policy
    There is most likely additional agreements or policies because that is standard practice.

  7. At least https://nymhub.space apparently uses https://replit.com/ according to their maintenance page. An AI website creation tool which in my opinion should be a very big red flag for privacy on that website. It’s not hard to write a secure web app and self-host it or use a static site. This is privacy 101 and NYM in this and many more cases doesn’t seem interested in following that.
    → The Replit Privacy Policy of course also mentions various data that they collect about their customer’s website. Not sure if they actually receive that from end users, but it’s bad enough that replit is used at all.

  8. I’m not sure if this is intended, but https://nymhub.space blocks most tor traffic and I haven’t gotten any answer to this.

Conclusion

In my opinion NYM has to do a lot of work in this regard. Them running a decentralized mixnet to counter a GPA, unlinking your payment info from your account usage is very good and honorable.

Then having these basic easy to avoid flaws however is even more disappointing from a company that seems to know better.

The list is not exhaustive and there is most likely things I have missed, therefore I welcome any additional points as comments.

This list is not meant as a way to criticize NYM for no reason, I understand that you want to appeal to users that might not be familiar with privacy and want to use a shiny site, but you also have to provide an option for people that actually care about not exposing their identity, even if it is on your websites or through swap services.

I hope that the NYM team will take this into account and work on their ecosystem. For a privacy company having a good foundation is much more important than just adding more and more potentially flawed features.

2

This is false. You are not required to connect your Keplr wallet. It’s the default for people who want to participate in missions, but you can submit grant proposals here, and we can simply reach out to you for your wallet address via the forum. Already explained to you in our Matrix chat too btw

3

Development has been focused on NymVPN of late. This might not happen until app and wallet are combined, but Nym is an open-source project so feel free to contribute.

4

It could be blocking traffic from some US nodes due to regulations - answered here. Regarding the other Nymhub-related feedback, please read the privacy policy to learn more about the data we collect and why:

5

Thank you for the feedback.

This is false. You are not required to connect your Keplr wallet…

You are if you want to use nymhub.space and exactly it’s the ONLY way to participate in missions not the default. That’s also what your reply in matrix chat suggested.

Development has been focused on NymVPN of late. This might not happen until app and wallet are combined, but Nym is an open-source project so feel free to contribute.

I’d like to contribute, but I can only do that if I sign up for github, but it’s good to at least hear that this might be worked on in the future.

It could be blocking traffic from some US nodes due to regulations - answered here.

“answered” is a bit of an overstatement since it isn’t related to the traffic at all.

Also I’d say that ~80% of my request from tor are failing, therefore this seems to be a bigger problem than that.

Regarding the other Nymhub-related feedback, please read the privacy policy to learn more about the data we collect and why…

In my opinion this doesn’t answer any of my concerns. Neither this cookie Cookie “__cf_bm=...; Domain=discordapp.com; ...” has been rejected as third-party. used on the home page.

Nor does it meaningfully address the vercel/cloudflare concerns.

Example from vercel’s privacy notice:

Website Information. We collect information about traffic to and from Customers' websites, such as End User IP address, location information derived from IP address, and system configuration information.

Hosting a website on a server you have complete control over and not having managed services that collect user data involved is required to have any privacy. Instead of having replit write a bloated AI-generated mess, NYM could have easily written web apps themselves, used static sites for scenarios where it’s possible and hosted them on a server they have control over. You however chose to not do that and now you are choosing not to address it.

6

Regarding the other Nymhub-related feedback, please read the privacy policy to learn more about the data we collect and why

I am quite surprised by the corporate non-answers I have received so far.

If NYM could at least acknowledge that using vercel/cloudflare, requiring keplr and only allowing code contributions on github is a privacy problem that would already be an improvement. Also youtube and telegram being the only option for certain content is problematic. All my previous mentions of these problems in matrix have been ignored or at least no one actually gave NYM’s position on this.

In my opinion any for example non profit that encourages their users to protect their privacy should stay away from NYM because of these exact issues being ignored. If they inform people about privacy problems they can’t ignore NYM having the same problems. You can of course correct me on this, but I am honestly very disappointed by the feedback I have received on my many mentions of these problems.

7

Missions make up < 10% of rewards in an NSL season. They are there for people who are already on Discord/YouTube/using EVM wallets to connect POAPs. If you’re just looking for an acknowledgement: then yes, it’s not the most private setup. But we haven’t found privacy friendly and sybil proof ways to reward regular participation for community members, or organise activities like that. If you have recommendations, you are free to share them here.

Thanks for flagging this. It should be resolved now.

Regarding Telegram: it was the main platform for comms. before $NYM token launch (popular with crypto people). You’re of course not REQUIRED to be there. We decided to keep it around because it’s one of our most active communities with people in censored regions like Russia, China actively using it by choice. We have to meet people where they are, not the other way around. Matrix, the more privacy preserving option is right here for anyone who needs it. And the app points to our Matrix chat too, where we usually post the same announcements. Matrix chat does get very busy sometimes, so if you feel like your questions aren’t being answered - you should tag one of the admins (me or @merve) . YouTube videos aren’t being self-hosted currently, which we want to do in the future.

8

You’re free to contact us anywhere you want for support. A burner Element account is fine too, if that works better for you. An update to swap.nym.com was pushed yesterday, so it should be more reliable now.

1 Like
9

Needed to confirm with the team before answering your Vercel-Github related questions, which is why it took longer.

I’d like to contribute, but I can only do that if I sign up for github

Github is the only way currently,

Nor does it meaningfully address the vercel/cloudflare concerns.

Regarding Vercel, we don’t really need it. We could move these sites to self-hosting on infrastructure we control, and that’s on the table. It isn’t happening right now because it sits behind other priorities (the NymVPN app),

1 Like
10

This is very reassuring. :rocket:

The point about telegram is also pretty minor compared to the rest and you even helped promote my nodes there in the past which I am still very thankful for!

Maybe it would be possible for the node promotion channel to create a mirror that forwards messages both ways via a bot from/to matrix.

Sites like mullvad, ivpn, tor are simple and not on managed infrastructure. Maybe they can serve as an inspiration. Some of them also have onion sites.
I also incorrectly suggested that vercel is used for nymhub. It is actually Google Cloud Platform and Exoscale is used for the forum.
If these are also managed hosting, you could get them under NYM’s control aswell.
This is also very good news for me and if done correctly is a privacy friendly solution that should protect people from surveillance in the future! :trophy:
I can understand that this might take some time and am awaiting the day it will become reality.

That is also good news. I still don’t necessarily agree that it is a good idea to link any blockchain transaction to any even burner account, but there’s also no easy solution to this. You could implement a chat on the website with direct support which would make this better, but this mean you might need 24/7 support.

I agree that this is a difficult question. Somehow integrating this into NYM wallet is at least right now the only solution I have. I sadly don’t have a lot of time and have never worked with COSMOS, otherwise I’d say that I’ll try to create a prototype that allows this and maybe swapping to ERC-20 via wallet connect. I however can’t even make an estimate if this would take days, weeks or months at the moment.

I really hope there will be a privacy respecting way in the future.

Thank you for these now very detailed answers. I hope that how I communicated this wasn’t unreasonable and this at least for now makes the project a lot more trustworthy for me. I just hope that what was mentioned will also be followed up eventually.

1 Like