Satoshi Has No Clothes: Failures in On-Chain Privacy by Ian Miers (Devcon4)

What Hacker News said

Cites ianmiers · 2020-12 · on “Zcash Open Major Grants”

Crypto tribalism aside, you got two technical points fundamentally wrong about the cryptography: 1) snarks are fast now. It takes 3 seconds on a pixel phone for Zcash. 2)The decoy based approaches Monero uses are subject to all kinds of passive and active attacks. Both in practice ( [LINK] ) and just fundamentally: [this video] . There are ways to mitigate some of these problems to a degree. This is why you hear Monero people talk about coin control and churning (both of which can make you stand out in other ways). But the fact that they have to mention that should tell you its far from a perfect solution cryptographically. There's a reason projects go with the large anonymity set approach. And i

Cites gruez · 2021-01 · on “With the death of cash, privacy faces a deeply uncertain future”

>Monero is a [...] untraceable digital cash that preserves privacy Not exactly. A single transaction might be untraceable but over repeated transactions it's possible to deanonymize people with a high degree of confidence. See: [this video] the good part starts at 10 minutes.

Cites gruez · 2021-01 · on “Bitcoincore.org removes Satoshi's whitepaper from website after threats from CSW”

>But for normal usage-as-a-currency, I am a huge believer in XMR (monero), which masks who you're sending money to There was a talk[1] a few years ago that basically argued that this property only really holds if you look at individual transactions in isolation. It basically boils down to: if you make one transaction to a darknet market, it's impossible to know whether you were actually sending to a darknet market, or whether that was just a decoy transaction. However, if you make repeated transactions to a darknet market, the chances that all of your transactions had a darknet market decoy approaches zero, and you'll be considered suspicious. At that point the police can get a warrant to se

Cites ianmiers · 2021-04 · on “Bitcoin is a ‘boon for surveillance’, says former CIA director”

Sure. Starting from the academic beginning and then going to commercial usage: Zerocash[0], a paper from 2014 (I'm an author on it), proposes using zksnarks to get a public ledger + privacy with no centralized parties. Instead of identifying the origin of your money on the blockchain and moving it to someone, you just prove in zero-knowledge your payment is correct. This showed strong privacy on a public blockchain was feasible. But slow (2 minutes per payment IIRC) Three years and much work by others later, it takes ~2 to 3 seconds on a Pixel three to make a zk-proof for a payment. This can be optimized down to 1 second fairly easily (on that you have only my assertion currently) This is co

Cites madars · 2024-09 · on “How Chainalysis made their way into popular Monero wallets”

There are multiple attacks in that video. IP is one, but a much bigger one is knowing the real output (or maybe real output plus one other output) among 16 ring signature members. They do not explain how they achieved it but one could guess that maybe by just doing a lot of tx themselves - 15 decoys is just way too small and flooding blockchain with transactions all but ensures that someone picking random ring members will pick a lot of your outputs (and thus have little privacy from you). It is also for sure too small for targeted active attacks (e.g., it is not safe to have repeat interactions with the same entity), see [this video] You really want more than 16 ring members, preferably all outp