thehat

Privacy

The threat model changed

Will be back to remind you to try it out. :D 
I'll speak to Corey about multi-sig, I believe we didn't build it for this pilot since we're just testing assumptions in stagenet, but for mainnet, a) the app will need security audits; and b) it will need multi-sig and a full suite of features.

I think the world as we know it is changing, even for builders we're seeing a pushback on anon devs. There's this theory called the Dark Forest Theory of the Internet - this idea that people are already exiting social platforms or existing "communication standards" for more intimate communication experience. Can be just to talk, create, publish, code etc. As online environments become more hostile, filled with ads, spam, and privacy invasions, people are increasingly retreating to private and hidden spaces for meaningful interactions.

*For people who already know what and why we need better OPSEC.*

We have been operating under an assumption that doxxing comes with high costs and requires intensive resources. And that deanonymisation is *possible* but *expensive,* that linking a forum account to a real identity takes a skilled investigator, hours of work per target, and a reason to come after “a target” specifically. That as long as the costs are high, scattering breadcrumbs across a hundred posts is acceptable risk. 

That assumption is now wrong, and the most recent research shows it.

## What has changed

In February 2026, researchers from ETH Zurich, MATS, and Anthropic published a paper titled "Large-scale online deanonymization with LLMs." The abstract says their agent re-identifies pseudonymous users "at high precision, given pseudonymous online profiles and conversations alone, matching what would take hours for a dedicated human investigator." [source: https://arxiv.org/abs/2602.16800]

Measured results:

* Their agent re-identified 226 of 338 Hacker News users from comments alone: 67% recall at 90% precision. Cost per target: one to four dollars. Wrong or unsure, it abstains. It runs in minutes.
* Their agents extracted identity features from raw text, embed, and matched Hacker News accounts to LinkedIn profiles at 45.1% recall at 99% precision. The best classical baseline on the same data: 0.1%.
* They re-identified at least 9 of 125 participants in Anthropic's own redacted interview dataset.
* Extrapolated to a 100-million-candidate pool, the reasoning stage still projects ~27% recall at 90% precision.

The paper's conclusion is that: "*the practical obscurity protecting pseudonymous users online no longer holds and threat models for online privacy need to be reconsidered.*"

Let’s understand this pipeline: we have unstructured text and pseudonyms. The same technique that links a Hacker News handle to a LinkedIn profile can potentially link a marketplace account to a Reddit account to the comment someone left on a blog years ago. Nothing needs to be hacked. There are no exploits and no database breaches. The model matches in minutes what it would have taken investigators days, if not months.

If a pseudonymous handle has ever been used in more than one platform (which is often the case for “trust building”), the linking is now a step closer to reality. 

## The platforms themselves are the attack surface

Even before LLMs, platforms were a bad bet: we’re talking here about physical infrastructure with founders, offices, and servers, all of which can be seized. We are always one bad policy away from endangering our digital privacy. 

This is not hypothetical. In November 2014, Operation Onymous took down Silk Road 2.0 and roughly 400 other hidden services in a single sweep, with 17 arrests across countries. In July 2017, AlphaBay was seized; its founder was arrested in Thailand and found dead in his cell a week later. In the same month, Dutch police revealed they had seized Hansa Market and silently run it for nearly four weeks, collecting usernames, passwords, and delivery addresses of buyers while the site looked healthy. In May 2019, Wall Street Market went down and its three administrators were arrested.

The pattern repeats every few years: a platform grows in popularity, it becomes a target, it gets taken down, the server now holds the full history of its users and turns into evidence.

But this doesn’t happen on the dark web alone. Look at the tools we have today.

**Telegram.** Default chats are not end-to-end encrypted - they are client-server encrypted, readable by Telegram. Real E2E only exists in one-to-one "Secret Chats," never in groups. Your identity is a phone number. After the French arrest of Pavel Durov in 2024, Telegram updated its policy to disclose IP addresses and phone numbers of users in response to valid legal orders. Whatever you think of Durov's politics, the platform he runs is a single point of legal coercion.

**Signal.** The best of the three, and will say so plainly. E2E encryption that has held up under subpoena. But a Signal identity is still a phone number, the server still handles contact graphs, and Signal itself has been honest for years that metadata - in the form of who talks to whom, when, from where, is a hard problem it has not fully solved. Sealed Sender narrows it but does not eliminate it.

**X.** Public by default, so anything you have ever written is training data as per X's own policy permits using what we write to train AI models. [source: [https://x.com/en/privacy](https://x.com/en/privacy)]. Direct messages are not end-to-end encrypted; the platform can read them. X's transparency reports show government requests for user data climbing year over year. [source: [https://transparency.x.com/](https://transparency.x.com/)]. This is the most data-hungry fingerprinting environment we interact with on a daily basis.

Underneath all three sits the browser, with 83–89% of browsers uniquely identifiable by fingerprint alone. [source: https://amiunique.org/fp](https://amiunique.org/fp]. Cross-browser fingerprinting - linking your "clean" browser to your daily one via hardware signals, works at 99.24% accuracy. [source: [https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/cross-browser-fingerprinting-os-and-hardware-level-features/]. Every ad-supported page load broadcasts your profile to 200–1,000 companies through real-time bidding, 294 billion times a day in the US alone.

## The gaps in on-chain privacy today

Monero is the best private-by-default settlement layer for private e-cash, with anonymity at the base layer, no opt-out, no shielded-pool minority problem. Even the market has confirmed it: where traceability is the whole game, transparent chains lose. [source: https://info.arkm.com/research/privacy-coins-101-what-are-they-how-do-they-work]. Practical privacy remains dependent on the size of the anonymity set, but with FCMP++ this is significantly reduced. As I wrote in a [recent tweet](https://x.com/roxananasoi/status/2109742750555918567), once you exit the private ecosystem, and amounts start moving into stablecoins or other assets, this creates an onchain fingerprint. Monero's liquidity is steady, perhaps not as high in volume given it lives on DEXs and p2p marketplaces. 

So practical privacy is dependent on the environment. To that extent, we also look at the seven-link sequence of a payment lifecycle: discovery, diligence, negotiation, contracting, ordering, settlement, enforcement. We are confident Monero solves number 5 and number 6 without issue (ordering & settlement). Where privacy breaks is around the other five links. Deals still happen in group chats, potentially on seize-prone servers, on websites that are subject to browser fingerprinting, with logs that outlive the deal.

That is the gap we are exploring: the infrastructure around the money. For a better word, we call this private finance (in short, PriFi). 

## What we propose

At Logos, we have been building privacy infrastructure in the open for years. We are not a new app with botted followers, and we did not pop up out of nowhere. Our infrastructure design philosophy is built around the thesis that you have to protect the entire transaction supply chain, where the counterparty hazard is handled by security via binding commitments, and the outsider hazard is handled by privacy, via denying information (secrecy). [source: https://logos.co/prifi](https://logos.co/prifi]

## Introducing Muster — an app built on Logos Basecamp, settling in XMR.

Basecamp is our p2p, local-first, self-sovereign desktop stack. Everything runs on hardware you control. No account, no phone number, and no middleman. Muster is a p2p coordination tool, which you can run standalone if you prefer or within Basecamp. The full engineering plan is public, down to the module dependencies and the open problems. [source: https://github.com/corpetty/muster/blob/docs/monero-in-rooms/docs/design/monero-in-rooms.md]. So is the runbook: install, share a room, request or send, pay, confirm at ten blocks, export the receipt. [source: https://github.com/corpetty/muster/blob/main/docs/runbooks/xmr-payment-request.md] 

As of Muster 0.3.1, the XMR payment-request flow is implemented and has been seen working on display: requesting, agreeing, address-sharing, and a real stagenet wallet listed in the Wallet view. An actual payment through the full flow has not happened yet - paying and confirming need funded stagenet wallets. 

**The pilot is a deal room: two counterparties, one stagenet deal.**
1. Open a private, encrypted Muster room. No coordination server in the middle.
2. Agree terms. The payee issues an XMR payment request: their wallet mints a fresh subaddress for that request, labelled `muster:req-…`, and proposing it in the room is the payee's vouch that the address is theirs.
3. The payer pays from any wallet - Cake, Feather, Basecamp's own Monero wallet. The card carries a QR code and a `monero:` link with the address and exact amount; "Pay with Monero Wallet" hands it to Basecamp's wallet for review and signing. No new wallet app required.
4. The payee's own wallet confirms it: an incoming transfer to that subaddress, of exactly the amount, at ten confirmations, which is about twenty minutes. The payer's word, a txid, or an explorer never confirms anything. No third party, no custodian, no oracle. ("Mark received" exists as a manual fallback). 
5. The room's signed record exports as a receipt with Details, Download audit trail; and the file verification, only if you choose to share it. 

No custody: keys never leave the machine. Value moves on the Monero chain. Free and open source. 

Limitations: 
1. v1 runs on Monero stagenet, not mainnet; 
we can provide the sXMR for your first runs, please reach out to roxana[at]logos.co - PGP: https://keys.openpgp.org/vks/v1/by-fingerprint/F827D8FE2F7D93671FD419598F8FEC458089C52E. 
2. Multisig escrow is out, but Monero multisig stays experimental upstream. 
3. Mixnet routing is specified. 
4. Pay from Basecamp's Monero wallet app works today as a copy-the-address-into-the-wallet flow; the one-step in-wallet review, where Muster hands over a prepared transaction and you approve it there, is still WIP. 
5. The Monero stack is a catalogue install in Basecamp - visible, inspectable, removable. 
6. While your wallet is open, any module loaded beside Muster in Basecamp can read its history. Gating the wallet core is WIP.  

## The ask

We are not launching a product. We are proposing a testbed, and we are asking for a voluntary coalition to run it. 

1. Install Muster via standalone or on Basecamp, and bring the Monero stack from the catalogue. Two fresh installs, nothing seeded. 
2. Run a deal room with a counterparty on stagenet. The runbook tells you exactly what to send back: how the invitation behaves, what the payee's card shows "seen, 0 of 10" before the first block; how long does first sync take; how many minutes from "paid" to 'finalised'; does the downloaded receipt verify with the repo's own tool etc. 
3. Then do the part that matters: attack the metadata. Check Muster's logs. Check what your node sees of the room. Check what the remote node learns if you do not run your own. Tell us where discovery, ordering, or enforcement still leak. 
4. Publish it. Publicly, in writing, with receipts.

What we get out of it: the Logos stack gets battle-tested by people whose standard is Monero-grade skepticism, and the backlog for future releases is basically written by its critics. 

What the Monero community gets out of it: local-first deal infrastructure around the settlement layer you already trust, discovery through enforcement, with security and secrecy. 

This is an open invite to the coalition. 
Come break it. 

**Links:**

* Paper: https://arxiv.org/abs/2602.16800
* PriFi: https://logos.co/prifi](https://logos.co/prifi
* Basecamp: https://logos.co/basecamp](https://logos.co/basecamp
* Design doc - Muster app: https://github.com/corpetty/muster/blob/docs/monero-in-rooms/docs/design/monero-in-rooms.md 
* Runbook: https://github.com/corpetty/muster/blob/main/docs/runbooks/xmr-payment-request.md
* Browser research: https://blog.logos.co/article/browser-betrayed-you 
* Privacy coins paper: https://info.arkm.com/research/privacy-coins-101-what-are-they-how-do-they-work

There’s a rounded value heuristic (often discussed in Bitcoin privacy) which is inherited by any public chain, including non-shielded Zcash.

This isn’t the case when values are hidden, especially for Monero and any shielded Zcash (or future shielded Bitcoin). A pool boundary… twitter.com/yfarmx/status/2109671242458358176