LND w. Neutrino Backend // Privacy & Security \ stacker news ~lightning

pull down to refresh

LND w. Neutrino Backend // Privacy & Security

403 sats \ 9 comments \ @stacks 8 Mar lightning

Hi,

I was wondering what the privacy and most importantly security implications are for running LND with the Neutrino Backend. Thinking about implementing LND in a very resource constrained environment and want to fully understand the trade-offs but couldn't find a lot of material.

In case some of you know more, very appreciated!

view all related items

117 sats \ 8 replies \ @DarthCoin 8 Mar

Here is all you need to know about neutrino: https://github.com/bitcoin/bips/blob/master/bip-0157.mediawiki

implementing LND in a very resource constrained environment

Exactly for this was created neutrino (BIP157), to be able to run a LND node without the need of full bitcoin blocks on the same machine.

You can use well known public neutrino nodes like: btcd1.lnolymp.us | btcd2.lnolymp.us - for US region sg.lnolymp.us - for Asia region btcd-mainnet.lightning.computer - for US region uswest.blixtwallet.com (Seattle) - for US region europe.blixtwallet.com (Germany) - for EU region asia.blixtwallet.com - for Asia region node.eldamar.icu - for US region noad.sathoarder.com - for US region bb1.breez.technology | bb2.breez.technology - for US region neutrino.shock.network - US region

Or search random ones in your area https://bitnodes.io/nodes/?q=NODE_COMPACT_FILTERS

You could also run a full bitcoin core on your own machine with activated neutrino mode and point your other LND machine/device to your own neutrino. Can be in the same LAN IP, tailscale private IP or public IP/domain. You can run it privately (only for you) or publicly (to share with others).

If you run a bitcoin core solely for having a full node synced, this node you can use it for multiple other LN nodes, using neutrino. Is a very elegant way to run multiple LN nodes without hassle.

Example: you can spin up a LND node on a cheap VPS and point to your home bitcoin core node as neutrino peer. Or to whatever of those mentioned above. You can also run multiple LND nodes in VMs on a local machine and point them to your local core neutrino machine/IP.

That doesn't affect your full bitcoin core node except your internet connection, but you are just "serving" blocks info. As a LND client to a random neutrino server, you are not revealing any of your information (IP, pubkey, traffic etc) you are just reading blocks, nothing else.

221 sats \ 7 replies \ @justin_shocknet 8 Mar

To add to this, neutrino is specifically a privacy focused solution for outsourcing block validation... it does this by getting compressed versions of entire blocks rather than asking a server for info about specific outputs, which could be used to deanonymize or otherwise attack you

The security profile is that you're not validating blocks yourself as you would with a full Bitcoin core node

For an edge node with a channel or three for use by you / small business / eCommerce its perfectly fine.

It's not recommended if you plan on running a routing node with lots of random peers.

21 sats \ 6 replies \ @stacks OP 11 Mar

Thanks a lot guys! Very appreciated! Do I understand that correctly, that in Neutrino mode, the lightning node connects to multiple neutrino nodes (unless you point it to a specific one) and compares their results (i.e. does not trust the answer of a single node)?

21 sats \ 5 replies \ @DarthCoin 11 Mar

Yes, you could add multiple neutrino peers for your connection. usually is taking first the one with the best ping. So I suggest to test their ping before you make your list, to be under 150ms.

0 sats \ 4 replies \ @stacks OP 11 Mar

Okay, so its not automatic. Will add a couple then! Thanks a lot!

Another quick question a bit off topic, I was always under the impression that two addresses of an m-of-n native segwit multisig cannot be connected to each other when looking at the blockchain. That made sense to me since every address has a different derivation path. Now, someone claimed that after transacting with one address, your public keys are revealed and another address of the same wallet can be connected by chain analysis crap.

Is this true. Sounds like bs to me but maybe there is something in the multisig script I do not understand.

21 sats \ 1 reply \ @DarthCoin 11 Mar

It was a post about this on SN but can't find it right now. Search on SN is kind of crap showing results only for zaprank instead of recent/older.

Maybe @bitcoin_devs could give a better answer on this. Check on their history too https://stacker.news/bitcoin_devs/posts

view all 1 replies

0 sats \ 1 reply \ @justin_shocknet 11 Mar

there's not two addresses in a multisig, there is one address, signed for with multiple keys

when that multisig output is spent those keys are revealed, but thats not the same as your extended pubkey... the derivation path is how basically you have infinite uncorrelated public keys from one true signing key

view all 1 replies