4 ms·

Care to elaborate?

• kobeya 9y ago
  Monero works by ring signatures. When you make a spend, in addition to the coin you are spending you pick a small number of other coins, presumably at random. Validators don't know which coin of the set is being spent, but they do have assurance that any specific coin can't be spent more than once. The problem is that there are a lot of knobs to tweak here. Which coins do you pick? They're not all random because at least one of the coins is from your wallet. People have specific usage patterns that give a prior on what output is the user's vs a randomly selected one. (E.g. an output that is 2 years old is less likely than one that is 2 weeks old to be the user's, since most outputs being spent are recent.) In addition, details of the transaction such as how many other coins are selected per signature, reveal what client might be used. It has been our experience with bitcoin that it is incredibly hard to mask what software is used to generate a transaction. It turns out that there are a ton of things that can watermark a transaction and thereby decrease your anonymity set -- from coin selection to serialization choices to the default settings of optional knobs like fee or locktime. And these generally interact very badly with ring signature systems. If your wallet version makes transactions a certain way, and none of the other mixin inputs you included do exactly the same thing, then it is blindingly obvious which input is actually yours -- the one from a transaction that matches yours in these other respects.