27 ms·

Monero Is Less Untraceable Than It Seems

157 points by mlb_hn 9y ago

htormey 9y ago
I hate how everyone always stresses the illegal uses of Monero in these conversations about traceability. Monero has a lot of legal uses, many of which are listed here: https://www.monero.how/why-monero-vs-bitcoin https://www.monero.how/why-monero-vs-bitcoin The big one for me is privacy: “The most critical flaw in Bitcoin is its lack of privacy. If you give me your Bitcoin wallet address so that I can send you a payment, you immediately compromise your privacy. I can see as a matter of public record how much money you have in your Bitcoin wallet ” I don’t want other people to know how much money I have when I pay them for goods and services or how much I have paid to others in the past. This wouldn’t happen with a bank account but could happen with bitcoin. I don’t necessarily want people I am negotiating a contract with to know my hand. It potentially gives them an unfair advantage. If my Monero transaction history can be figured out by a government agency with lots of resources but not the average business, that doesn’t necessarily invalidate Monero for my use cases.
- redog 9y ago
  To me this feels like concern without regard for the full differences. With bank accounts you usually have the restriction of "as many accounts as you can afford" where with bitcoin addresses you can have countless. So someone could just as easily watch you drive up to the bank and know you bank there. Keep your private addresses private, duh.
  - htormey 9y ago
    I know that, you know that, but is that something the average person is aware of or do they think it works like Venmo? If I go to a bar should I have to cycle currency between addresses to pay for a drink and avoid the bar man knowing my complete financial history? That sounds like a terrible UX. I shouldn’t have to think about it. This is why I like the concept of privacy coins.
    - wereHamster 9y ago
      The wallet UI should do that for you automatically. Wallets which reuse addresses have been a constant source of privacy breaches and even lost coins (is it iota where you can lose coins if you use the same address as few a two different times?)
      - mhluongo 9y ago
        Most wallets these days don't reuse addresses, but without mixing, confidential transactions, or another approach, it's trivial to cluster a wallet via its chance outputs, etc. Iota is/was incredibly broken, and shouldn't be used as an example IMO.
  - Coding_Cat 9y ago
    If I make a new bitcoin wallet, and transfer money from my 'main' wallet into that one, would that be traceable by anyone who deal with my new wallet? Would I need to use/trust some kind of 'washing' service to hide my transaction among several others?
    - SXX 9y ago
      Any "wallet" is not single address, but set of addresses. Each address is just cryptographic private key and you might have as many as you want. Though as soon as you sent any transaction public key of your wallet become known. This is why by default each time you make transaction for any amount bitcoin client send specified amount of coins to target address and all that remain to some new address that you own. While you not announce that you have access to that new address it's fairly easy to track your money. > Would I need to use/trust some kind of 'washing' service to hide my transaction among several others? So answer is yes.
      - notheguyouthink 9y ago
        So what good is keeping the coins in separate addresses then? An earlier poster implied that you should keep separate addrs to avoid people knowing how much you have in full - but if you still have to wash the coins to separate accounts, what good is that? You're still washing all your coins - how many addrs you have seems like a side detail. The only thing I can think of that separate addrs gives you, is that you can have a small amount of the coin in an address that you use for daily transactions. Meaning each transaction doesn't need to be washed, because you don't care about that address. Am I missing something?
        SXX 9y ago
        > So what good is keeping the coins in separate addresses then? Publishing of your public key slightly decrease security of your coins. While ECDSA is strong it's still safer when only hash of your public key (bitcoin address) is known. After all you can always end up with weak key due to software or even hardware bugs. > Am I missing something? You're completely right, but you underestimate how important that little detail is. If you only receive money to different addresses each time then until you actually start spending it's will be impossible to prove that you actually control any of these addresses.
  - OskarS 9y ago
    Yeah, but lets say you make a website and want to accept donations using bitcoins. What you generally do is put "donations welcome at <bitcoin address>!" (I see this all over the place). Are you saying that webmasters should write a script that generates these public/private keys on every page hit, and then somehow stores all of those millions of private keys... somewhere? On your server? Or do you have to build an entire infrastructure of key exchanges to some safe place just so you can accept bitcoin donations privately?
    - magnat 9y ago
      > webmasters should write a script that generates these public/private keys on every page hit Not on every page hit, but on every donation or every few days depending on how many transactions you've received. It doesn't have to be completely new set of keys - you can use deterministic wallet to generate as many as you want from a single master secret.
    - dwild 9y ago
      Why would it have to be "donations welcome at <bitcoin address>!"? There's plenty of ways to ask for donations and it doesn't always require to have a single address shown. You can have a "Donate" button that when clicked, ask for a generated wallet (all from the same private key but that would be a different wallet still) and show it with a QR code in bonus.
      - OskarS 9y ago
        Look, I'm not making this up. Lots of people and projects do exactly this. Tails, the super-secure privacy-focused version of Linux asks for donations in exactly this way [1] (and if you go to blockchain.info you can see a full wonderful list of all the bitcoin addresses who have donated to them [2]). It's a totally reasonable way to set up bitcoin donations (hell, it's even recommended by the bitcoin wiki! [3]) and it's a significant weakness of bitcoin that these transactions are not private. It is absurd defense of bitcoin to say "well, it COULD just be as private as these other things, if you only jump through ten more technical hoops and not use bitcoin as intended". Clearly, these other cryptocurrencies offer something that bitcoin doesn't. [1]: https://tails.boum.org/donate/?r=contribute https://tails.boum.org/donate/?r=contribute [2]: https://blockchain.info/address/1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2 https://blockchain.info/address/1BvBMSEYstWetqTFn5Au4m4GFg7x... [3]: https://en.bitcoin.it/wiki/Receiving_donations_with_bitcoin https://en.bitcoin.it/wiki/Receiving_donations_with_bitcoin
  - everdev 9y ago
    Even with multiple wallets, the point is the same that your Bitcoin address is tied to your complete transaction history and account balance. Your Bitcoin address is just an alias for your real identity. If (or once) your Bitcoin alias is tied to you, you have zero privacy. Through public meta-analysis you can get a pretty clear picture of the spending habits and maybe even location of a Bitcoin address. Or, a purchase of a physical product where you give your home address and your Bitcoin address and your alias is linked to your actual home (albeit in the records of a 2nd party). But still, it's not hard to imagine how non-private Bitcoin is. And following someone to BofA doesn't exactly give you much if any information about them. Even if I gave you my checking account number (which is on all my checks), you still can't go and access my financial records without doing something illegal.
- qertoip 9y ago
  fungibility
- nickthemagicman 9y ago
  Isn't it relatively simple to create a new wallet tho?
- cremp 9y ago
  That's why the standard advice on any cryptocurrency is to use a different address per transaction. It's just... people are lazy, and more technically (in the past anyway) change addresses became an issue.
  - gondo 9y ago
    and once you transfer money from your onetime address to your main, everyone will be able to see how much money you have. the only difference is, that they will know it "little" later. still good enough f.e. for eshop to categorize customers and retarget them
    - Karunamon 9y ago
      Is there really a need to even have a “main wallet”? Most implementations I know of will aggregate multiple wallets into your balance, and I think handle sending transactions from those wallets in sum of the full amount being requested to send.
      - gondo 9y ago
        if you want to pay for something what is more expensive than what you have in one wallet (or transfer larger amount), you will eventually have to combine multiple wallets
        cremp 9y ago
        That's one legit use of a mixing or joining service. Not saying there isn't tracability though those services (especially since we aren't ideal) since the point of the distributed ledger is tracability. Something that was rather easy was depositing to an exchange, and just withdrawing; you lose the identity of the coins, at the cost of the exchange knowing the connection.
        Karunamon 9y ago
        I think the traceability concerns are mostly handled since while it might be possible to infer an identity from an address that's sent to or from an exchange account, it's a lot more murky once those coins are moved elsewhere. If you know that address ABC belongs to me, and you see I sent coins to address DEF (which is entirely offline and using a brainwallet), and later DEF sends coins to GHI, you're left with the task of proving that DEF and GHI belong to me, and weren't me paying someone else.
- wellboy 9y ago
  Well that's a weak argument. Just give them a new address. Many bitcoin owners have 100+ addresses within their wallet.
- CyberDildonics 9y ago
  It is trivial to get around the problem you are describing, you just create a new address for every transaction, which is actually what the reference wallets do by default.
  - deleted 9y ago
    [deleted]
- adangert 9y ago
  This is not quite true if you are using an HD wallet.
- deleted 9y ago
  [deleted]
- knorker 9y ago
  Cryptocurrency only real use cases are currency speculation and crime. Of course they'll mention illegal uses. It's what it's for.
- ianmiers 9y ago
  Privacy is indeed the main motivation. But you're missing the threat model. Facebook,Google, Target, etc all run sophisticated customer tracking programs. Target was predicting if their customers were pregnant based on spending habits 5 years ago[0]. If blockchain payments go mainstream, customers will use them and those companies will build profiles based on that data. If 10 grad students on a shoe string budget with ethics/IRB restrictions can break a system, so can many people you should be worried about far short of goverments. [0]https://www.nytimes.com/2012/02/19/magazine/shopping-habits.html https://www.nytimes.com/2012/02/19/magazine/shopping-habits....
  - supreme_sublime 9y ago
    It really isn't difficult to tell if someone is pregnant. I actually make a game out of it when looking through facebook at women I know. So many will drop hints that are seemingly unrelated, but which often tip me off that they're pregnant. More on topic, there is a difference though, from what I read in the article it doesn't seem like Target had access to what the people bought at other stores. It would be like if Target could see what you bought at Walmart, or at least went there and see how much you spend.
chewbaccafoo 9y ago
Another day, another bunch of irresponsible reporting in the cryptocurrency world. Wired fails to disclose that the first mentioned correspondent is Andrew Miller of the Zcash foundation. He previously published a blog containing much the same content about Monero. https://z.cash.foundation/about/ https://z.cash.foundation/about/ http://hackingdistributed.com/2017/04/19/monero-linkability/ http://hackingdistributed.com/2017/04/19/monero-linkability/ So how much money are some people making today on Monero shorts and Zcash longs thanks to a front page Wired article?
erpellan 9y ago
What about zcash? As I understand it has much stronger privacy, but almost nobody understands it so people are skeptical. I'm surprised it doesn't get more attention.
- throwawaylolx 9y ago
  See https://news.ycombinator.com/item?id=16687574 https://news.ycombinator.com/item?id=16687574
- SarangNoether 9y ago
  There has been similar research into tracing Zcash transactions between their transparent and shielded pool.
- sparkie 9y ago
  This isn't really true. Zcash isn't private by default, which weakens the concept for anyone who wants to use the privacy features. If not many people are using them then analysis of the transactions that are meant to be private becomes easier. Zcash is also not trustless because it requires the trusted setup. You have to trust that the developers completely deleted the "toxic waste" during the setup, and that their machines were not compromised (which is totally possible given Meltdown, etc). Recovery of this toxic waste can lead to unlimited coin minting. Another problem with this is that future changes to some properties of the currency require another trusted setup.
  - the_stc 9y ago
    Private-by-default is semi-dishonest. Many tx on Monero are owned by a few entities that are friendly with LE or may get hacked. Thus all those exchange tx or payment gateway tx that are on the blockchain are in practice transparent to the right people or with time. With Monero they give you a false sense of security with ZCash they are open that those tx are not going to help you. [ShapeShift does 7-15% at least of Monero tx. Add in BitFinex Binance CoinPayments and some others and where we at?]
- CiPHPerCoder 9y ago
throwawaylolx 9y ago
This was a well-known design choice where the user could balance between transaction size and privacy--people who preferred faster/cheaper transactions chose to sacrifice untraceability. Nowadays, the default option enforces higher untraceability. Also, some of the authors of the research paper mentioned in the article are part of the competitor Zcash group who sensationalise common knowledge to undermine Monero. Zcash is a US-based company that has a trusted setup which was possibly backdoored [1], one of their scientists and inventor of Zerocoin protocol publicly supported backdoors [2], and their CEO and cofounder suggested backdoors as well [3]. I would read more about Monero before dismissing it, as it's one of the very few legitimate groups in the space besides Bitcoin. [1] https://twitter.com/peterktodd/status/793584540891643906 https://twitter.com/peterktodd/status/793584540891643906 [2] https://www.newscientist.com/blogs/onepercent/2013/03/bitcoin-zerocoin.html https://www.newscientist.com/blogs/onepercent/2013/03/bitcoi... [3] https://twitter.com/zooko/status/863202798883577856 https://twitter.com/zooko/status/863202798883577856
- vzcx 9y ago
  It's fine if you want to defend monero's technology, but attacking the researchers credibility because of their association with a competing project? That's some weak sauce in my opinion. One side is actually doing the work and publishing attacks, even if they are against zcash (shielding/deshielding). The other has some questionable twitter conversations about a hypothetical backdoor. Zcash zk-snarks are backdoored? Proof of concept or GTFO is the law of the land, my dude.
  - throwawaylolx 9y ago
    Oh, and I forgot to mention they were also sponsored by DARPA. You can pretend these are all irrelevant arguments and wait for your proof, but the reality is that reasonable doubt and ad hominem are sometimes appropriate, especially when dealing with privacy. It's on them to prove their trusted setup can be trusted, and everything they've done is antithetic to trust.
    - the_stc 9y ago
SarangNoether 9y ago
I'm on the Monero Research Lab team. This article, like most media coverage of academic research, ignores much of the subtlety behind the research. The likelihood that a particular output is positively identified depends heavily on its age relative to our regular protocol upgrades. And it's not like we aren't actively working on ways to improve anonymity. We're in the process of updating the way we choose our fake outputs and discussing best practices for handling very old outputs. I always appreciate research into ways to improve Monero, but I don't think this article does the research justice.
- stochastic_monk 9y ago
  I'm not involved with any cryptocurrencies, so I have no dog in this fight. I am curious, however. Whenever ZCash comes up Monero is mentioned as "also providing" anonymity. Being on the Monero team, can you comment on the differences between the privacy guarantees provided by the two platforms?
  - splintercell 9y ago
    ZCash's biggest problem from a common man's perspective: It's privacy isn't enabled by default, it's opt-in. That means, people (i.e. the people you are interacting with) need to opt-in with it's privacy, in order for you to be able to achieve privacy. I have the same problem with Signal, it tries to be 'seamless' in it's integration with SMS. But now I could be talking to someone on Signal who also uses Signal so the communication is secured, but if they don't, Signal just sends messages as an unsecured SMS (though it shows you on the app with a slight UX tweak that this is an unsecured communication channel, but that's not good enough).
    - vzcx 9y ago
      My understanding is that shielded transactions were made opt-in due to time and resource needs in computing their zero-knowledge proofs. Hopefully they can improve this and do away with unshielded transactions altogether in the future.
  - 9y ago
cyphar 9y ago
I think GNU Taler[1] solves the untracabilty problem in a way that most people should be happy with. Consumers have all of their transactions private from everyone (the seller cannot tell how much money they have, what other transactions they've made, or where the money comes from; a government cannot tell what transactions a person has made). But seller transactions can be audited for tax reasons, to avoid tax fraud. And best of all, it's not yet another cryptocurrency. It's a payment system that works over any currency (traditional VISA, or crypto-currencies). Of course, this means that Taler "tokens" cannot be used as a store of value, other than as a proxy for the underlying store of value. So you would only hold Taler tokens like you would cash in your wallet. They even have really nice easy integrations into browsers and backend processing. (I don't work on GNU Taler, I've just been saddened that such an interesting project has gotten so little press outside of GNU circles.) [1]: https://taler.net/ https://taler.net/
- Ericson2314 9y ago
  Yeah this is such a simple improvement over the current payment cartel, dodging the scaling issues and taxation issues through its conservatism. I wish we could all switch to this and then resume comparing altcoins.
- EthanHeilman 9y ago
  Is GNU Taler an anonymous ecash mint?
  - cyphar 9y ago
    Their website[1] gives more detailed information on how it works than I can here. Effectively, yes, but the system explicitly supports having different mints that operate over different currencies. And while what consumers (people sending money) spend their money on is completely anonymous and cannot be correlated, merchants (people receiving money) can still have their income audited and taxed accordingly. The system was designed by a university research team in Europe and became a GNU project a year or two ago. [1]: https://taler.net/en/architecture.html https://taler.net/en/architecture.html
cies 9y ago
Next frontier: XSpectreCoin https://spectreproject.io https://spectreproject.io
- cies 9y ago
  Down votes but no explanation. XSpec's level of untraceability goes quite a bit beyond Monero's.
  - JumpCrisscross 9y ago
    > Down votes but no explanation Consider the obverse: a promotional link with no explanation. A short blurb about why XSpec is better than Monero might help your comment stand stronger on its own.
    - throwawaylolx 9y ago
      The difference is that Spectrecoin has no paper and no explanation how "stealth staking" works.
criddell 9y ago
I only ever hear of Monero in a negative light. Has anything positive come from it?
- Zak 9y ago
  I think the rise of darknet drug dealers is something positive. They're less dangerous than street drug dealers.
  - deleted 9y ago
    [deleted]
- tudorconstantin 9y ago
  It can't be that both affirmations have negative connotation: "Monero can be 100% anonymous, so it's the preferred coin of criminals" "Monero is not 100% anonymous, so big time criminals can't use it."
  - SarangNoether 9y ago
    Anonymity is not something you either have or don't have. It's always relative to an anonymity set. Mathematically, a ring signature provides a guarantee of anonymity within the ring.
jacques_chester 9y ago
Side-channels are the gap between theory and reality; a gulf filled with information theory and tears. As they point out, the public, consensual mutation-resistance of blockchain makes it rather hard to walk back mistakes.
wjh_ 9y ago
Every single time something seems to claim to be untraceable or anonymous, it seems to hold for a while, and then there's a "<X> is not as safe as we thought" headline. Seems to be a good rule to just not trust anything.
- ashleyn 9y ago
  Or assume the government has unlimited resources to throw at a problem, and not commit crimes. Most of these headlines describe something that would require nation-state resources to crack. If you wanna hide paying for something legal, it's probably still sufficient.
  - Zak 9y ago
    As with crypto for personal communications or mobile devices, I think it's reasonable for people to expect things claiming to be secure to be secure, or to more clearly explain the attack surface area. Someone using a technology should be able to determine what sort of protection they have if they use it for something opposed by a nation state. As for using Monero to break laws, it's probably pretty low risk to buy some MDMA to have a very good weekend, and fairly high risk to receive millions of dollars in payment for a ransomware attack against a government.
  - klmr 9y ago
    “Not commit crimes” is a good maxim when you’re living in a liberal democracy (and even then …). It’s less easy when the state outlaws things unjustly. Like being gay. Or being (a)religious. And to give just two examples that apply to (otherwise) liberal democracies, most people would include “personal, recreational drug use” in the same category. And there are Western democracies that outlaw certain sexual acts between consenting adults (e.g. Germany, which outlaws any incest, even between consenting adult siblings), which also rubs many people the wrong way. In sum, “not [committing] crimes” isn’t always straightforward.
    - tessierashpool 9y ago
      I was with you every step of the way, then suddenly you were defending incest and I was like “how the hell did I end up here?” Also, while “many” is a subjective term, I don’t think you’re using it correctly here. The idea that you should not regulate sex between consenting adults in general is very popular, but most countries carve out exceptions for sex work. Not saying they should, but many do. And I definitely think the incest legalization lobby must be very, very small, even though it probably has a sympathizer in the Oval Office.
chatmasta 9y ago
> That shouldn’t just worry anyone trying to stealthily spend Monero today. It also means evidence of earlier not-quite-untraceable payments remain carved into Monero’s blockchain for years to come, visible for any snoop that cares to look. This is the key point from the article and it applies to every cryptocurrency. Just because a crypto seems anonymous now, does not mean it will be forever, and all the transactions from “now” will still be on the blockchain “forever.” Almost ironically, scrutiny of a currency increases with its usage, so you’re probably better off just not using cryptocurrencies to commit crimes. P.S. Anyone got the link to the paper? Can’t believe wired didn’t even link to it
- weber111 9y ago
  https://arxiv.org/pdf/1704.04299/ https://arxiv.org/pdf/1704.04299/
- plasticmachine 9y ago
  Same goes for TLS - there's ample evidence that TLS data is being suctioned up at scale and stored for eventual decryption.
- taneq 9y ago
  > Just because a crypto seems anonymous now, does not mean it will be forever Just because a crypto <anything> seems safe now, does not mean it will be forever. "You can't hide secrets from the future with math."
blattimwind 9y ago
Who would've thought cryptocurrency guys would inflate whatever valid claims they might have had? > After more recent changes to how Monero chooses its mixins, that trick now can spot the real coin just 45 percent of the time—but still narrows down the real coin to about two possibilities, far fewer than most Monero users would like. Note that this is still a break, because quick Googling says that there are usually 4 mixins, so random chance would be 20 %.
- socrates1024 9y ago
  Even more recent changes have made this better too. The research in the paper only goes up to Apr. 2017 or so. Since then, the "recent zone" has been a) reduced from 5 days to 3 days, and b) more recent zone mixins are included. We haven't quantified what improvement that makes, but it should help.
EGreg 9y ago
The SAFE project would have totally private coins. If they ever launch, I mean :)
the_stc 9y ago
Monero has some real issues! These papers are OK but I am not sure if they focus on current practical issues: Main issue: Ringsize is small. Used to be 3 [why??] got bumped to 5 because 3 is obviously useless. Now getting bumped to 7. The team is taking a very aggressive approach here. Aggressive approaches with security tend not to work. They should be conservative and set the ringsize high then back off later once they have done the research to support a small ringsize. Users cannot just increase their ringsize. Doing so makes their transactions stick out: different metadata. If you always use, example, ringsize 21: then your tx look different on-blockchain. Despite this, BOTH wallets in common use have features that encourage users to make this mistake. It is like sabotage. The official GUI provides a slider that goes to 26 and says more privacy [you see a good number of of ringsize 26 tx]. The 'official' Web Wallet run by the Monero lead offers a 4-setting: 5 [default], 11 21 & 41. You see a good number of 11 21 41 ringsize tx because of this. It has been known for a long time that picking and forcing one ringsize is a good idea yet both wallets insist on encouraging the user to mess up. Not good. No warnings in the wallet, either. We need higher ringsize because the privacy of your transaction going forward depends on other users picking your output as a decoy in their own rings. Now the small ringsize is made worse by the fact that a single entity, ShapeShift.io, runs 7-15% at least of the network by tx volume! That means with one hack or warrant an attacker will be able to eliminate many fake decoys from other tx rings! How much will a few other exchanges or payment processors make up of the network? 50%? More? Despite this the ringsize stays very small. The response to all this is 'churn'. This is sending coins to yourself [looks same as sending to other people] so that you obfuscate the connection over time. But despite that this is a core feature of Monero they have provided zero research zero guide on how to do so. They spend money and time researching fancy new maths and this is great. Yet the core functionality to answer the question: How anonymous am I, how mixed in am I, this remains unanswered. Despite this they refuse to provide any sort of disclaimer. Contrast to Tor Project which makes a big deal of telling users they can hurt themselves and Tor is not some magic. In comparison Monero just claims untraceable & private with no caveat whatsoever. This is irresponsible & reckless, damaging to users and not justified. Only when users start thinking and asking questions are they told oh of course you need to churn but no one knows what this is. That is the core issue. Other issues: 1. Unencrypted transactions. Your ISP or NSA may easily monitor which tx you broadcast. This let them link your IP to a tx as well as link your tx across time. Even though HTTP is used thus adding TLS [unauthenticated but at least preventing passive snooping] would be an obvious step. On the other hand... traffic analysis might break this anyway. Tor is needed to really protect but see below. 2. Wallet leaks information. When connecting, it requests block info from the last block it has. This allows tracking that user over time. The obvious solution of having the wallet always request fixed number of blocks back in history is not implemented. This is simple engineering fixing, not fancy math. 3. The height leak is very damaging for users attempting to churn. In that case they connect, sync, broadcast, disconnect, repeat. Every time they connect they are indicating approximately where they left off. This means when they broadcast again ... one only need to look at the tx to see if there is a ring member near where the wallet connected. If so, you have linked TX. 4. The wallet will ask to confirm transactions sometimes... AFTER it has send the ring to the remote node! If you cancel tx then try again, you have sent 2 rings to the remote node but in each ring the real input is the same. Congrats, tx linked or ownership of output now shown. 5. Wallet and network does not support Tor. Despite using HTTP they do not have proxy support. On Linux they suggest hooking syscall to force proxy [torsocks]. On Windows they scorn users and tell them to use Linux. At the Monero network level only IP addresses are accepted meaning we cannot have Tor-to-Tor. 6. Tor is downplayed because they are writing-from-scratch a new I2P implementation in C++ named Kovri. Instead of using Tor today they provide no sort of IP hiding while everyone must wait for a new I2P impl. This is bad engineering and means few people can properly submit tx over Tor. 7. All TX are not the same. There is no solution to joining bad outputs. When you make a multi-in transaction you provide strong linkage if an attacker knows or suspects multiple outputs are yours. Example: you accept donations or are a darknet dealer. Attacker sends many small outputs to you. Attacker will know when you make a move because they will see a multi-input transaction containing one of their known outputs in each ring. This is useful for LE: send small money then know when money is moved. From that point trace forward and see if descendants of that TX end up at known exchange. Now you have a short list of suspects. 8. A lot of metadata per TX. Each TX can have a payment ID [old style], payment ID [new style] or none. Each tx has a fee, and fee is one of 4 levels [0.25x, 1x, and 2 large x]. But the default is 1x. This encourages smart or big users to change from default to 0.25x to save money. But now their tx look different from common users. Exchanges in particular may do this. 9. Probably other things I am not thinking off of the top of my head. In short I think that Monero practical privacy for users that have something to hide [darknet] and may find themselves against a LEA might find themselves in a bad position. Compounding this is Monero's total refusal to warn users and provide self-sabotaging options. A Tor-style warning is absolutely required given the state of things. More paranoid people might think the lack of warning and some of these issues are intentional. Edit: I still support Monero and think it is the best project. Despite ZCash looking better on paper the team makes me nervous and I avoid it. [Their wallet software is even worse despite them having many millions to fix it] ... I just want Monero stronger as it will help our users overall and that is good for my business.
nootropicat 9y ago
Very good article, doesn't go far enough - monero is not anonymous at all. It misses the biggest issue - that analyzing agencies can spam transactions, generating thousands of inputs daily. A big fraction of other transactions is transparent (shapeshift or other exchanges) to state agencies anyway. As monero has almost no use, cross-chain mixing with bitcoin/ethereum is way, way more anonymous than monero, and in addition can be done in a way that maintains plausible deniability. Monero is the worst instance of false security in crypto. Unfortunately, at least in my experience, monero users are impervious to these facts, so darknet busts with ridiculous parallel construction narratives aren't going to stop anytime soon. It's not like fbi is ever going to publicly say that monero isn't anonymous to them.
wemdyjreichert 9y ago
Cryptocurrency: hi, im a distributed, permanent record of all the transactions you make. Dark web: ooh look, anonymity!
- OrganicMSG 9y ago
  I have often wondered about the sanity of people who are using a blockchain based currency across tor. Admittedly, I haven't fully checked my assumptions here, but my initial thoughts on the matter have always been that I'd be amazed if it was a good idea from a security perspective.
zeveb 9y ago
I think that the timing issues are related to the problems with mixnets for anonymity: it turns out a global passive adversary can observe all messages sent and received and eventually determine which parties are talking to one another, within certain probability bounds. It sounds like a similar issue is at play with cryptocurrency. The solution with anonymity is to send cover & real messages through the network in such a way that traffic analysis fails. One approach would be to saturate a network link, sending random cover data until there's real data to send, then returning to cover data. There are more bandwidth-friendly schemes as well. Might a similar scheme for cryptocurrency be to constantly (or stochastically, based on some probability distribution) send money to one's own other addresses? Obviously there's an issue with transfer fees, but maybe this could be a tunable, based on how important your privacy is.
yrjocz 9y ago
well, there are others, I would say, younger and more private and secure currencies than Monero - for example Sumokoin (https://www.sumokoin.org https://www.sumokoin.org), setting Ring Confidential Transactions (RingCT) with minimum ringsize (mixin) of 12 to conceal sources/amounts transferred and make it high resistance to blockchain analysis (Monero does have 4 or something, even I have read devs are planning to increase it?)or even younger Ombre (https://www.ombre.io https://www.ombre.io).... add "illegal only" topic - well, that depends on point of view, for me personally there is always benefit to have real privacy for what are you paying for.. which you dont have with "fiat" currencies or less secure/private crypto currencies..
biztos 9y ago
Arguably off topic, but do any cryptocurrency experts here know of any studies on the potential economic effects of a truly (or even effectively) untraceable digital currency? Just off the top of my head I would expect two immediate effects if such a thing really caught on: 1) An increase in many types of illegal commerce. 2) A huge downturn in industries used for money laundering and tax evasion. These might be highly localized, e.g. a bunch of bars might close in City A because that's how the locals wash money; while in City B there might be a surge in "Anonymero" wealth because they make cocaine and are good at shipping it.
granaldo 9y ago
I've seen countless writings against monero yet the market still price it worthy https://www.coingecko.com/en/price_charts/monero/usd https://www.coingecko.com/en/price_charts/monero/usd Can compare this to iota revelation?

157 points by mlb_hn 9y ago

I hate how everyone always stresses the illegal uses of Monero in these conversations about traceability. Monero has a lot of legal uses, many of which are listed here: https://www.monero.how/why-monero-vs-bitcoin https://www.monero.how/why-monero-vs-bitcoin The big one for me is privacy: “The most critical flaw in Bitcoin is its lack of privacy. If you give me your Bitcoin wallet address so that I can send you a payment, you immediately compromise your privacy. I can see as a matter of public record how much money you have in your Bitcoin wallet ” I don’t want other people to know how much money I have when I pay them for goods and services or how much I have paid to others in the past. This wouldn’t happen with a bank account but could happen with bitcoin. I don’t necessarily want people I am negotiating a contract with to know my hand. It potentially gives them an unfair advantage. If my Monero transaction history can be figured out by a government agency with lots of resources but not the average business, that doesn’t necessarily invalidate Monero for my use cases.

redog 9y ago
To me this feels like concern without regard for the full differences. With bank accounts you usually have the restriction of "as many accounts as you can afford" where with bitcoin addresses you can have countless. So someone could just as easily watch you drive up to the bank and know you bank there. Keep your private addresses private, duh.
- htormey 9y ago
  I know that, you know that, but is that something the average person is aware of or do they think it works like Venmo? If I go to a bar should I have to cycle currency between addresses to pay for a drink and avoid the bar man knowing my complete financial history? That sounds like a terrible UX. I shouldn’t have to think about it. This is why I like the concept of privacy coins.
  - wereHamster 9y ago
    The wallet UI should do that for you automatically. Wallets which reuse addresses have been a constant source of privacy breaches and even lost coins (is it iota where you can lose coins if you use the same address as few a two different times?)
    - mhluongo 9y ago
      Most wallets these days don't reuse addresses, but without mixing, confidential transactions, or another approach, it's trivial to cluster a wallet via its chance outputs, etc. Iota is/was incredibly broken, and shouldn't be used as an example IMO.
- Coding_Cat 9y ago
  If I make a new bitcoin wallet, and transfer money from my 'main' wallet into that one, would that be traceable by anyone who deal with my new wallet? Would I need to use/trust some kind of 'washing' service to hide my transaction among several others?
  - SXX 9y ago
    Any "wallet" is not single address, but set of addresses. Each address is just cryptographic private key and you might have as many as you want. Though as soon as you sent any transaction public key of your wallet become known. This is why by default each time you make transaction for any amount bitcoin client send specified amount of coins to target address and all that remain to some new address that you own. While you not announce that you have access to that new address it's fairly easy to track your money. > Would I need to use/trust some kind of 'washing' service to hide my transaction among several others? So answer is yes.
    - notheguyouthink 9y ago
      So what good is keeping the coins in separate addresses then? An earlier poster implied that you should keep separate addrs to avoid people knowing how much you have in full - but if you still have to wash the coins to separate accounts, what good is that? You're still washing all your coins - how many addrs you have seems like a side detail. The only thing I can think of that separate addrs gives you, is that you can have a small amount of the coin in an address that you use for daily transactions. Meaning each transaction doesn't need to be washed, because you don't care about that address. Am I missing something?
      - SXX 9y ago
        > So what good is keeping the coins in separate addresses then? Publishing of your public key slightly decrease security of your coins. While ECDSA is strong it's still safer when only hash of your public key (bitcoin address) is known. After all you can always end up with weak key due to software or even hardware bugs. > Am I missing something? You're completely right, but you underestimate how important that little detail is. If you only receive money to different addresses each time then until you actually start spending it's will be impossible to prove that you actually control any of these addresses.
- OskarS 9y ago
  Yeah, but lets say you make a website and want to accept donations using bitcoins. What you generally do is put "donations welcome at <bitcoin address>!" (I see this all over the place). Are you saying that webmasters should write a script that generates these public/private keys on every page hit, and then somehow stores all of those millions of private keys... somewhere? On your server? Or do you have to build an entire infrastructure of key exchanges to some safe place just so you can accept bitcoin donations privately?
  - magnat 9y ago
    > webmasters should write a script that generates these public/private keys on every page hit Not on every page hit, but on every donation or every few days depending on how many transactions you've received. It doesn't have to be completely new set of keys - you can use deterministic wallet to generate as many as you want from a single master secret.
  - dwild 9y ago
    Why would it have to be "donations welcome at <bitcoin address>!"? There's plenty of ways to ask for donations and it doesn't always require to have a single address shown. You can have a "Donate" button that when clicked, ask for a generated wallet (all from the same private key but that would be a different wallet still) and show it with a QR code in bonus.
    - OskarS 9y ago
      Look, I'm not making this up. Lots of people and projects do exactly this. Tails, the super-secure privacy-focused version of Linux asks for donations in exactly this way [1] (and if you go to blockchain.info you can see a full wonderful list of all the bitcoin addresses who have donated to them [2]). It's a totally reasonable way to set up bitcoin donations (hell, it's even recommended by the bitcoin wiki! [3]) and it's a significant weakness of bitcoin that these transactions are not private. It is absurd defense of bitcoin to say "well, it COULD just be as private as these other things, if you only jump through ten more technical hoops and not use bitcoin as intended". Clearly, these other cryptocurrencies offer something that bitcoin doesn't. [1]: https://tails.boum.org/donate/?r=contribute https://tails.boum.org/donate/?r=contribute [2]: https://blockchain.info/address/1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2 https://blockchain.info/address/1BvBMSEYstWetqTFn5Au4m4GFg7x... [3]: https://en.bitcoin.it/wiki/Receiving_donations_with_bitcoin https://en.bitcoin.it/wiki/Receiving_donations_with_bitcoin
- everdev 9y ago
  Even with multiple wallets, the point is the same that your Bitcoin address is tied to your complete transaction history and account balance. Your Bitcoin address is just an alias for your real identity. If (or once) your Bitcoin alias is tied to you, you have zero privacy. Through public meta-analysis you can get a pretty clear picture of the spending habits and maybe even location of a Bitcoin address. Or, a purchase of a physical product where you give your home address and your Bitcoin address and your alias is linked to your actual home (albeit in the records of a 2nd party). But still, it's not hard to imagine how non-private Bitcoin is. And following someone to BofA doesn't exactly give you much if any information about them. Even if I gave you my checking account number (which is on all my checks), you still can't go and access my financial records without doing something illegal.
qertoip 9y ago
fungibility
nickthemagicman 9y ago
Isn't it relatively simple to create a new wallet tho?
cremp 9y ago
That's why the standard advice on any cryptocurrency is to use a different address per transaction. It's just... people are lazy, and more technically (in the past anyway) change addresses became an issue.
- gondo 9y ago
  and once you transfer money from your onetime address to your main, everyone will be able to see how much money you have. the only difference is, that they will know it "little" later. still good enough f.e. for eshop to categorize customers and retarget them
  - Karunamon 9y ago
    Is there really a need to even have a “main wallet”? Most implementations I know of will aggregate multiple wallets into your balance, and I think handle sending transactions from those wallets in sum of the full amount being requested to send.
    - gondo 9y ago
      if you want to pay for something what is more expensive than what you have in one wallet (or transfer larger amount), you will eventually have to combine multiple wallets
      - cremp 9y ago
        That's one legit use of a mixing or joining service. Not saying there isn't tracability though those services (especially since we aren't ideal) since the point of the distributed ledger is tracability. Something that was rather easy was depositing to an exchange, and just withdrawing; you lose the identity of the coins, at the cost of the exchange knowing the connection.
        Karunamon 9y ago
        I think the traceability concerns are mostly handled since while it might be possible to infer an identity from an address that's sent to or from an exchange account, it's a lot more murky once those coins are moved elsewhere. If you know that address ABC belongs to me, and you see I sent coins to address DEF (which is entirely offline and using a brainwallet), and later DEF sends coins to GHI, you're left with the task of proving that DEF and GHI belong to me, and weren't me paying someone else.
wellboy 9y ago
Well that's a weak argument. Just give them a new address. Many bitcoin owners have 100+ addresses within their wallet.
CyberDildonics 9y ago
It is trivial to get around the problem you are describing, you just create a new address for every transaction, which is actually what the reference wallets do by default.
- deleted 9y ago
  [deleted]
adangert 9y ago
This is not quite true if you are using an HD wallet.
deleted 9y ago
[deleted]
knorker 9y ago
Cryptocurrency only real use cases are currency speculation and crime. Of course they'll mention illegal uses. It's what it's for.
ianmiers 9y ago
Privacy is indeed the main motivation. But you're missing the threat model. Facebook,Google, Target, etc all run sophisticated customer tracking programs. Target was predicting if their customers were pregnant based on spending habits 5 years ago[0]. If blockchain payments go mainstream, customers will use them and those companies will build profiles based on that data. If 10 grad students on a shoe string budget with ethics/IRB restrictions can break a system, so can many people you should be worried about far short of goverments. [0]https://www.nytimes.com/2012/02/19/magazine/shopping-habits.html https://www.nytimes.com/2012/02/19/magazine/shopping-habits....
- supreme_sublime 9y ago
  It really isn't difficult to tell if someone is pregnant. I actually make a game out of it when looking through facebook at women I know. So many will drop hints that are seemingly unrelated, but which often tip me off that they're pregnant. More on topic, there is a difference though, from what I read in the article it doesn't seem like Target had access to what the people bought at other stores. It would be like if Target could see what you bought at Walmart, or at least went there and see how much you spend.

chewbaccafoo 9y ago

Another day, another bunch of irresponsible reporting in the cryptocurrency world. Wired fails to disclose that the first mentioned correspondent is Andrew Miller of the Zcash foundation. He previously published a blog containing much the same content about Monero. https://z.cash.foundation/about/ https://z.cash.foundation/about/ http://hackingdistributed.com/2017/04/19/monero-linkability/ http://hackingdistributed.com/2017/04/19/monero-linkability/ So how much money are some people making today on Monero shorts and Zcash longs thanks to a front page Wired article?

erpellan 9y ago

What about zcash? As I understand it has much stronger privacy, but almost nobody understands it so people are skeptical. I'm surprised it doesn't get more attention.

throwawaylolx 9y ago
See https://news.ycombinator.com/item?id=16687574 https://news.ycombinator.com/item?id=16687574
SarangNoether 9y ago
There has been similar research into tracing Zcash transactions between their transparent and shielded pool.
sparkie 9y ago
This isn't really true. Zcash isn't private by default, which weakens the concept for anyone who wants to use the privacy features. If not many people are using them then analysis of the transactions that are meant to be private becomes easier. Zcash is also not trustless because it requires the trusted setup. You have to trust that the developers completely deleted the "toxic waste" during the setup, and that their machines were not compromised (which is totally possible given Meltdown, etc). Recovery of this toxic waste can lead to unlimited coin minting. Another problem with this is that future changes to some properties of the currency require another trusted setup.
- the_stc 9y ago
  Private-by-default is semi-dishonest. Many tx on Monero are owned by a few entities that are friendly with LE or may get hacked. Thus all those exchange tx or payment gateway tx that are on the blockchain are in practice transparent to the right people or with time. With Monero they give you a false sense of security with ZCash they are open that those tx are not going to help you. [ShapeShift does 7-15% at least of Monero tx. Add in BitFinex Binance CoinPayments and some others and where we at?]
CiPHPerCoder 9y ago

throwawaylolx 9y ago

This was a well-known design choice where the user could balance between transaction size and privacy--people who preferred faster/cheaper transactions chose to sacrifice untraceability. Nowadays, the default option enforces higher untraceability. Also, some of the authors of the research paper mentioned in the article are part of the competitor Zcash group who sensationalise common knowledge to undermine Monero. Zcash is a US-based company that has a trusted setup which was possibly backdoored [1], one of their scientists and inventor of Zerocoin protocol publicly supported backdoors [2], and their CEO and cofounder suggested backdoors as well [3]. I would read more about Monero before dismissing it, as it's one of the very few legitimate groups in the space besides Bitcoin. [1] https://twitter.com/peterktodd/status/793584540891643906 https://twitter.com/peterktodd/status/793584540891643906 [2] https://www.newscientist.com/blogs/onepercent/2013/03/bitcoin-zerocoin.html https://www.newscientist.com/blogs/onepercent/2013/03/bitcoi... [3] https://twitter.com/zooko/status/863202798883577856 https://twitter.com/zooko/status/863202798883577856

vzcx 9y ago
It's fine if you want to defend monero's technology, but attacking the researchers credibility because of their association with a competing project? That's some weak sauce in my opinion. One side is actually doing the work and publishing attacks, even if they are against zcash (shielding/deshielding). The other has some questionable twitter conversations about a hypothetical backdoor. Zcash zk-snarks are backdoored? Proof of concept or GTFO is the law of the land, my dude.
- throwawaylolx 9y ago
  Oh, and I forgot to mention they were also sponsored by DARPA. You can pretend these are all irrelevant arguments and wait for your proof, but the reality is that reasonable doubt and ad hominem are sometimes appropriate, especially when dealing with privacy. It's on them to prove their trusted setup can be trusted, and everything they've done is antithetic to trust.
  - the_stc 9y ago

SarangNoether 9y ago

I'm on the Monero Research Lab team. This article, like most media coverage of academic research, ignores much of the subtlety behind the research. The likelihood that a particular output is positively identified depends heavily on its age relative to our regular protocol upgrades. And it's not like we aren't actively working on ways to improve anonymity. We're in the process of updating the way we choose our fake outputs and discussing best practices for handling very old outputs. I always appreciate research into ways to improve Monero, but I don't think this article does the research justice.

stochastic_monk 9y ago
I'm not involved with any cryptocurrencies, so I have no dog in this fight. I am curious, however. Whenever ZCash comes up Monero is mentioned as "also providing" anonymity. Being on the Monero team, can you comment on the differences between the privacy guarantees provided by the two platforms?
- splintercell 9y ago
  ZCash's biggest problem from a common man's perspective: It's privacy isn't enabled by default, it's opt-in. That means, people (i.e. the people you are interacting with) need to opt-in with it's privacy, in order for you to be able to achieve privacy. I have the same problem with Signal, it tries to be 'seamless' in it's integration with SMS. But now I could be talking to someone on Signal who also uses Signal so the communication is secured, but if they don't, Signal just sends messages as an unsecured SMS (though it shows you on the app with a slight UX tweak that this is an unsecured communication channel, but that's not good enough).
  - vzcx 9y ago
    My understanding is that shielded transactions were made opt-in due to time and resource needs in computing their zero-knowledge proofs. Hopefully they can improve this and do away with unshielded transactions altogether in the future.
- 9y ago

cyphar 9y ago

I think GNU Taler[1] solves the untracabilty problem in a way that most people should be happy with. Consumers have all of their transactions private from everyone (the seller cannot tell how much money they have, what other transactions they've made, or where the money comes from; a government cannot tell what transactions a person has made). But seller transactions can be audited for tax reasons, to avoid tax fraud. And best of all, it's not yet another cryptocurrency. It's a payment system that works over any currency (traditional VISA, or crypto-currencies). Of course, this means that Taler "tokens" cannot be used as a store of value, other than as a proxy for the underlying store of value. So you would only hold Taler tokens like you would cash in your wallet. They even have really nice easy integrations into browsers and backend processing. (I don't work on GNU Taler, I've just been saddened that such an interesting project has gotten so little press outside of GNU circles.) [1]: https://taler.net/ https://taler.net/

Ericson2314 9y ago
Yeah this is such a simple improvement over the current payment cartel, dodging the scaling issues and taxation issues through its conservatism. I wish we could all switch to this and then resume comparing altcoins.
EthanHeilman 9y ago
Is GNU Taler an anonymous ecash mint?
- cyphar 9y ago
  Their website[1] gives more detailed information on how it works than I can here. Effectively, yes, but the system explicitly supports having different mints that operate over different currencies. And while what consumers (people sending money) spend their money on is completely anonymous and cannot be correlated, merchants (people receiving money) can still have their income audited and taxed accordingly. The system was designed by a university research team in Europe and became a GNU project a year or two ago. [1]: https://taler.net/en/architecture.html https://taler.net/en/architecture.html

cies 9y ago

Next frontier: XSpectreCoin https://spectreproject.io https://spectreproject.io

cies 9y ago
Down votes but no explanation. XSpec's level of untraceability goes quite a bit beyond Monero's.
- JumpCrisscross 9y ago
  > Down votes but no explanation Consider the obverse: a promotional link with no explanation. A short blurb about why XSpec is better than Monero might help your comment stand stronger on its own.
  - throwawaylolx 9y ago
    The difference is that Spectrecoin has no paper and no explanation how "stealth staking" works.

criddell 9y ago

I only ever hear of Monero in a negative light. Has anything positive come from it?

Zak 9y ago
I think the rise of darknet drug dealers is something positive. They're less dangerous than street drug dealers.
- deleted 9y ago
  [deleted]
tudorconstantin 9y ago
It can't be that both affirmations have negative connotation: "Monero can be 100% anonymous, so it's the preferred coin of criminals" "Monero is not 100% anonymous, so big time criminals can't use it."
- SarangNoether 9y ago
  Anonymity is not something you either have or don't have. It's always relative to an anonymity set. Mathematically, a ring signature provides a guarantee of anonymity within the ring.

jacques_chester 9y ago

Side-channels are the gap between theory and reality; a gulf filled with information theory and tears. As they point out, the public, consensual mutation-resistance of blockchain makes it rather hard to walk back mistakes.

wjh_ 9y ago

Every single time something seems to claim to be untraceable or anonymous, it seems to hold for a while, and then there's a "<X> is not as safe as we thought" headline. Seems to be a good rule to just not trust anything.

ashleyn 9y ago
Or assume the government has unlimited resources to throw at a problem, and not commit crimes. Most of these headlines describe something that would require nation-state resources to crack. If you wanna hide paying for something legal, it's probably still sufficient.
- Zak 9y ago
  As with crypto for personal communications or mobile devices, I think it's reasonable for people to expect things claiming to be secure to be secure, or to more clearly explain the attack surface area. Someone using a technology should be able to determine what sort of protection they have if they use it for something opposed by a nation state. As for using Monero to break laws, it's probably pretty low risk to buy some MDMA to have a very good weekend, and fairly high risk to receive millions of dollars in payment for a ransomware attack against a government.
- klmr 9y ago
  “Not commit crimes” is a good maxim when you’re living in a liberal democracy (and even then …). It’s less easy when the state outlaws things unjustly. Like being gay. Or being (a)religious. And to give just two examples that apply to (otherwise) liberal democracies, most people would include “personal, recreational drug use” in the same category. And there are Western democracies that outlaw certain sexual acts between consenting adults (e.g. Germany, which outlaws any incest, even between consenting adult siblings), which also rubs many people the wrong way. In sum, “not [committing] crimes” isn’t always straightforward.
  - tessierashpool 9y ago
    I was with you every step of the way, then suddenly you were defending incest and I was like “how the hell did I end up here?” Also, while “many” is a subjective term, I don’t think you’re using it correctly here. The idea that you should not regulate sex between consenting adults in general is very popular, but most countries carve out exceptions for sex work. Not saying they should, but many do. And I definitely think the incest legalization lobby must be very, very small, even though it probably has a sympathizer in the Oval Office.

chatmasta 9y ago

> That shouldn’t just worry anyone trying to stealthily spend Monero today. It also means evidence of earlier not-quite-untraceable payments remain carved into Monero’s blockchain for years to come, visible for any snoop that cares to look. This is the key point from the article and it applies to every cryptocurrency. Just because a crypto seems anonymous now, does not mean it will be forever, and all the transactions from “now” will still be on the blockchain “forever.” Almost ironically, scrutiny of a currency increases with its usage, so you’re probably better off just not using cryptocurrencies to commit crimes. P.S. Anyone got the link to the paper? Can’t believe wired didn’t even link to it

weber111 9y ago
https://arxiv.org/pdf/1704.04299/ https://arxiv.org/pdf/1704.04299/
plasticmachine 9y ago
Same goes for TLS - there's ample evidence that TLS data is being suctioned up at scale and stored for eventual decryption.
taneq 9y ago
> Just because a crypto seems anonymous now, does not mean it will be forever Just because a crypto <anything> seems safe now, does not mean it will be forever. "You can't hide secrets from the future with math."

blattimwind 9y ago

Who would've thought cryptocurrency guys would inflate whatever valid claims they might have had? > After more recent changes to how Monero chooses its mixins, that trick now can spot the real coin just 45 percent of the time—but still narrows down the real coin to about two possibilities, far fewer than most Monero users would like. Note that this is still a break, because quick Googling says that there are usually 4 mixins, so random chance would be 20 %.

socrates1024 9y ago
Even more recent changes have made this better too. The research in the paper only goes up to Apr. 2017 or so. Since then, the "recent zone" has been a) reduced from 5 days to 3 days, and b) more recent zone mixins are included. We haven't quantified what improvement that makes, but it should help.

EGreg 9y ago

The SAFE project would have totally private coins. If they ever launch, I mean :)

the_stc 9y ago

Monero has some real issues! These papers are OK but I am not sure if they focus on current practical issues: Main issue: Ringsize is small. Used to be 3 [why??] got bumped to 5 because 3 is obviously useless. Now getting bumped to 7. The team is taking a very aggressive approach here. Aggressive approaches with security tend not to work. They should be conservative and set the ringsize high then back off later once they have done the research to support a small ringsize. Users cannot just increase their ringsize. Doing so makes their transactions stick out: different metadata. If you always use, example, ringsize 21: then your tx look different on-blockchain. Despite this, BOTH wallets in common use have features that encourage users to make this mistake. It is like sabotage. The official GUI provides a slider that goes to 26 and says more privacy [you see a good number of of ringsize 26 tx]. The 'official' Web Wallet run by the Monero lead offers a 4-setting: 5 [default], 11 21 & 41. You see a good number of 11 21 41 ringsize tx because of this. It has been known for a long time that picking and forcing one ringsize is a good idea yet both wallets insist on encouraging the user to mess up. Not good. No warnings in the wallet, either. We need higher ringsize because the privacy of your transaction going forward depends on other users picking your output as a decoy in their own rings. Now the small ringsize is made worse by the fact that a single entity, ShapeShift.io, runs 7-15% at least of the network by tx volume! That means with one hack or warrant an attacker will be able to eliminate many fake decoys from other tx rings! How much will a few other exchanges or payment processors make up of the network? 50%? More? Despite this the ringsize stays very small. The response to all this is 'churn'. This is sending coins to yourself [looks same as sending to other people] so that you obfuscate the connection over time. But despite that this is a core feature of Monero they have provided zero research zero guide on how to do so. They spend money and time researching fancy new maths and this is great. Yet the core functionality to answer the question: How anonymous am I, how mixed in am I, this remains unanswered. Despite this they refuse to provide any sort of disclaimer. Contrast to Tor Project which makes a big deal of telling users they can hurt themselves and Tor is not some magic. In comparison Monero just claims untraceable & private with no caveat whatsoever. This is irresponsible & reckless, damaging to users and not justified. Only when users start thinking and asking questions are they told oh of course you need to churn but no one knows what this is. That is the core issue. Other issues: 1. Unencrypted transactions. Your ISP or NSA may easily monitor which tx you broadcast. This let them link your IP to a tx as well as link your tx across time. Even though HTTP is used thus adding TLS [unauthenticated but at least preventing passive snooping] would be an obvious step. On the other hand... traffic analysis might break this anyway. Tor is needed to really protect but see below. 2. Wallet leaks information. When connecting, it requests block info from the last block it has. This allows tracking that user over time. The obvious solution of having the wallet always request fixed number of blocks back in history is not implemented. This is simple engineering fixing, not fancy math. 3. The height leak is very damaging for users attempting to churn. In that case they connect, sync, broadcast, disconnect, repeat. Every time they connect they are indicating approximately where they left off. This means when they broadcast again ... one only need to look at the tx to see if there is a ring member near where the wallet connected. If so, you have linked TX. 4. The wallet will ask to confirm transactions sometimes... AFTER it has send the ring to the remote node! If you cancel tx then try again, you have sent 2 rings to the remote node but in each ring the real input is the same. Congrats, tx linked or ownership of output now shown. 5. Wallet and network does not support Tor. Despite using HTTP they do not have proxy support. On Linux they suggest hooking syscall to force proxy [torsocks]. On Windows they scorn users and tell them to use Linux. At the Monero network level only IP addresses are accepted meaning we cannot have Tor-to-Tor. 6. Tor is downplayed because they are writing-from-scratch a new I2P implementation in C++ named Kovri. Instead of using Tor today they provide no sort of IP hiding while everyone must wait for a new I2P impl. This is bad engineering and means few people can properly submit tx over Tor. 7. All TX are not the same. There is no solution to joining bad outputs. When you make a multi-in transaction you provide strong linkage if an attacker knows or suspects multiple outputs are yours. Example: you accept donations or are a darknet dealer. Attacker sends many small outputs to you. Attacker will know when you make a move because they will see a multi-input transaction containing one of their known outputs in each ring. This is useful for LE: send small money then know when money is moved. From that point trace forward and see if descendants of that TX end up at known exchange. Now you have a short list of suspects. 8. A lot of metadata per TX. Each TX can have a payment ID [old style], payment ID [new style] or none. Each tx has a fee, and fee is one of 4 levels [0.25x, 1x, and 2 large x]. But the default is 1x. This encourages smart or big users to change from default to 0.25x to save money. But now their tx look different from common users. Exchanges in particular may do this. 9. Probably other things I am not thinking off of the top of my head. In short I think that Monero practical privacy for users that have something to hide [darknet] and may find themselves against a LEA might find themselves in a bad position. Compounding this is Monero's total refusal to warn users and provide self-sabotaging options. A Tor-style warning is absolutely required given the state of things. More paranoid people might think the lack of warning and some of these issues are intentional. Edit: I still support Monero and think it is the best project. Despite ZCash looking better on paper the team makes me nervous and I avoid it. [Their wallet software is even worse despite them having many millions to fix it] ... I just want Monero stronger as it will help our users overall and that is good for my business.

nootropicat 9y ago

Very good article, doesn't go far enough - monero is not anonymous at all. It misses the biggest issue - that analyzing agencies can spam transactions, generating thousands of inputs daily. A big fraction of other transactions is transparent (shapeshift or other exchanges) to state agencies anyway. As monero has almost no use, cross-chain mixing with bitcoin/ethereum is way, way more anonymous than monero, and in addition can be done in a way that maintains plausible deniability. Monero is the worst instance of false security in crypto. Unfortunately, at least in my experience, monero users are impervious to these facts, so darknet busts with ridiculous parallel construction narratives aren't going to stop anytime soon. It's not like fbi is ever going to publicly say that monero isn't anonymous to them.

wemdyjreichert 9y ago

Cryptocurrency: hi, im a distributed, permanent record of all the transactions you make. Dark web: ooh look, anonymity!

OrganicMSG 9y ago
I have often wondered about the sanity of people who are using a blockchain based currency across tor. Admittedly, I haven't fully checked my assumptions here, but my initial thoughts on the matter have always been that I'd be amazed if it was a good idea from a security perspective.

zeveb 9y ago

I think that the timing issues are related to the problems with mixnets for anonymity: it turns out a global passive adversary can observe all messages sent and received and eventually determine which parties are talking to one another, within certain probability bounds. It sounds like a similar issue is at play with cryptocurrency. The solution with anonymity is to send cover & real messages through the network in such a way that traffic analysis fails. One approach would be to saturate a network link, sending random cover data until there's real data to send, then returning to cover data. There are more bandwidth-friendly schemes as well. Might a similar scheme for cryptocurrency be to constantly (or stochastically, based on some probability distribution) send money to one's own other addresses? Obviously there's an issue with transfer fees, but maybe this could be a tunable, based on how important your privacy is.

yrjocz 9y ago

well, there are others, I would say, younger and more private and secure currencies than Monero - for example Sumokoin (https://www.sumokoin.org https://www.sumokoin.org), setting Ring Confidential Transactions (RingCT) with minimum ringsize (mixin) of 12 to conceal sources/amounts transferred and make it high resistance to blockchain analysis (Monero does have 4 or something, even I have read devs are planning to increase it?)or even younger Ombre (https://www.ombre.io https://www.ombre.io).... add "illegal only" topic - well, that depends on point of view, for me personally there is always benefit to have real privacy for what are you paying for.. which you dont have with "fiat" currencies or less secure/private crypto currencies..

biztos 9y ago

Arguably off topic, but do any cryptocurrency experts here know of any studies on the potential economic effects of a truly (or even effectively) untraceable digital currency? Just off the top of my head I would expect two immediate effects if such a thing really caught on: 1) An increase in many types of illegal commerce. 2) A huge downturn in industries used for money laundering and tax evasion. These might be highly localized, e.g. a bunch of bars might close in City A because that's how the locals wash money; while in City B there might be a surge in "Anonymero" wealth because they make cocaine and are good at shipping it.

granaldo 9y ago

I've seen countless writings against monero yet the market still price it worthy https://www.coingecko.com/en/price_charts/monero/usd https://www.coingecko.com/en/price_charts/monero/usd Can compare this to iota revelation?