Satoshi Has No Clothes: Failures in On-Chain Privacy by Ian Miers (Devcon4)

What people said

madars · 2024-09 · Reference

There are multiple attacks in that video. IP is one, but a much bigger one is knowing the real output (or maybe real output plus one other output) among 16 ring signature members. They do not explain how they achieved it but one could guess that maybe by just doing a lot of tx themselves - 15 decoys is just way too small and flooding blockchain with transactions all but ensures that someone picking random ring members will pick a lot of your outputs (and thus have little privacy from you). It is also for sure too small for targeted active attacks (e.g., it is not safe to have repeat interactions with the same entity), see [VIDEO] You really want more than 16 ring members, preferably all outputs ever created like in Zcash. FCMP work promises to bring similar privacy to Monero but is years on the roadmap.

Read the original HN comment ↗

ianmiers · 2021-04 · Reference

Sure. Starting from the academic beginning and then going to commercial usage: Zerocash[0], a paper from 2014 (I'm an author on it), proposes using zksnarks to get a public ledger + privacy with no centralized parties. Instead of identifying the origin of your money on the blockchain and moving it to someone, you just prove in zero-knowledge your payment is correct. This showed strong privacy on a public blockchain was feasible. But slow (2 minutes per payment IIRC) Three years and much work by others later, it takes ~2 to 3 seconds on a Pixel three to make a zk-proof for a payment. This can be optimized down to 1 second fairly easily (on that you have only my assertion currently) This is commercially deployed in Zcash (the above mentioned coin with usability and adoption issues), a few other straight up forks, and a new coin called IronFish. And related protocols are in a few things on Ethereum (e.g., Aztec). If you want to test performance numbers, you can download one of these systems and try it yourself (Nighthawk is a decent mobile wallet for Zcash) Current technical objections (again, beyond criticisms of Zcash as a coin itself) 1) Current ZK proofs require trusted setup. New ZK proofs developed by engineers at Zcash removed this[1]. So its not longer an issue for the technology (or for Zcash once it's deployed) 2) you have to scan the blockchain to get notified of payments. No, this happens to be how Zcash does it. As I said in a separate comment, it's easy to send pay

Read the original HN comment ↗

gruez · 2021-01 · Reference

>Monero is a [...] untraceable digital cash that preserves privacy Not exactly. A single transaction might be untraceable but over repeated transactions it's possible to deanonymize people with a high degree of confidence. See: [VIDEO] the good part starts at 10 minutes.

Read the original HN comment ↗