5 ms·

This was a well-known design choice where the user could balance between transaction size and privacy--people who preferred faster/cheaper transactions chose to

This was a well-known design choice where the user could balance between transaction size and privacy--people who preferred faster/cheaper transactions chose to sacrifice untraceability. Nowadays, the default option enforces higher untraceability. Also, some of the authors of the research paper mentioned in the article are part of the competitor Zcash group who sensationalise common knowledge to undermine Monero. Zcash is a US-based company that has a trusted setup which was possibly backdoored [1], one of their scientists and inventor of Zerocoin protocol publicly supported backdoors [2], and their CEO and cofounder suggested backdoors as well [3]. I would read more about Monero before dismissing it, as it's one of the very few legitimate groups in the space besides Bitcoin. [1] https://twitter.com/peterktodd/status/793584540891643906 https://twitter.com/peterktodd/status/793584540891643906 [2] https://www.newscientist.com/blogs/onepercent/2013/03/bitcoin-zerocoin.html https://www.newscientist.com/blogs/onepercent/2013/03/bitcoi... [3] https://twitter.com/zooko/status/863202798883577856 https://twitter.com/zooko/status/863202798883577856

vzcx 9y ago
It's fine if you want to defend monero's technology, but attacking the researchers credibility because of their association with a competing project? That's some weak sauce in my opinion. One side is actually doing the work and publishing attacks, even if they are against zcash (shielding/deshielding). The other has some questionable twitter conversations about a hypothetical backdoor. Zcash zk-snarks are backdoored? Proof of concept or GTFO is the law of the land, my dude.
- throwawaylolx 9y ago
  Oh, and I forgot to mention they were also sponsored by DARPA. You can pretend these are all irrelevant arguments and wait for your proof, but the reality is that reasonable doubt and ad hominem are sometimes appropriate, especially when dealing with privacy. It's on them to prove their trusted setup can be trusted, and everything they've done is antithetic to trust.
  - the_stc 9y ago
    Trusted setup only compromises the supply integrity not privacy. I am not a fan of Zooko or the Green comments on backdoors and LE but do not misrepresent trusted setup.
    - throwawaylolx 9y ago
      >only compromises the supply integrity Conveniently, it's impossible to audit whether more coins are being minted right now to add to the developer tax already imposed on block rewards. Don't think I misrepresented trusted setup--only warning others about the reputation of Zcash. Anonymity for some can be a critical issue, so I don't think everyone can afford to wait for "proof of backdoor" before making their decision.
      - nootropicat 9y ago
        Deanonymizing zcash's shielded transactions requires breaking the preimage resistance of sha256.
        ianmiers 9y ago
        Technically, you could also break the encryption used in the memo field. But thats bog standard cryptography
    - ianmiers 9y ago
      By the way, the backdoor comments are taken out of context in a very inaccurate way. For Zooko's, literally the next tweet explains that he means for transfers in and out of fiat. "And by the way, I think we can successfully make Zcash too traceable for criminals like WannaCry, but still completely private & fungible. … … At least for as long as criminals want to cash out to fiat (years? decades?). … "[0] Since conversions to fiat are done via exchanges, which are regulated, it's pretty simple. This applies to Monero,Dash, etc. Matt's, which he has pointed out before[0], was a point that it was possible, which is true for any system. If you follow the general debate on adding backdoors to encryption, you'll know he and almost all cryptographers are completely against them. Its fine not to be a fan of them or think people should never admit even the conceptual possibility of limitations on privacy but neither quote was endorsing backdoors. [0] https://twitter.com/zooko/status/863202964416077824 https://twitter.com/zooko/status/863202964416077824 [1] https://news.ycombinator.com/item?id=15370744 https://news.ycombinator.com/item?id=15370744
the_stc 9y ago
>This was a well-known design choice where the user could balance between transaction size and privacy--people who preferred faster/cheaper transactions chose to sacrifice untraceability. Nowadays, the default option enforces higher untraceability. This has always been wrong and it is wrong on the face. Your privacy does NOT depend on your ring-size. That is only for backward-tracing. For forwards tracing [more common: you have bad money and want to turn it anonymous so it is good] you rely on other people on the network false-spending your money. Between the low ringsize [3, now 5, soon 7] and the fact that a good double-digit % of network is owned by LE-accessible entities [ShapeShift does at least 7-15% of tx]. Even with these papers Monero refuses to provide any sort of disclaimer that transactions may be traceable despite readily admitting you must do churn over time to gain privacy. Monero deserves a lot of criticism even if ZCash is worse in some ways.
socrates1024 9y ago
This isn't a good explanation. The result of this research is actually that even if you opted in to privacy during mid 2016 to jan 2017, you wouldn't have gotten it.
Quanttek 9y ago
> This was a well-known design choice where the user could balance between transaction size and privacy--people who preferred faster/cheaper transactions chose to sacrifice untraceability. Nowadays, the default option enforces higher untraceability. I don't think you understand the flaw behind this "design choice". While its great to give the user the choice in how they want to balance things, the individual's choice affects the whole system. If you - as kess privacy-conscious user - use 0 mixins (as was possible) or the min. no. of mixins, when your transaction is used as mixin for a privacy-focused user, you make that user much more identifieable. The choice defeats itself when you depend on others to take at least the same number of mixins for their transactions.
CryptoPunk 9y ago
If the ZCash trusted setup was compromised, it would allow the compromiser to create ZCash "out of thin air" and effectively rob other ZEC holders through seigniorage. It would not allow them to spy on transactions.

vzcx 9y ago

It's fine if you want to defend monero's technology, but attacking the researchers credibility because of their association with a competing project? That's some weak sauce in my opinion. One side is actually doing the work and publishing attacks, even if they are against zcash (shielding/deshielding). The other has some questionable twitter conversations about a hypothetical backdoor. Zcash zk-snarks are backdoored? Proof of concept or GTFO is the law of the land, my dude.

throwawaylolx 9y ago
Oh, and I forgot to mention they were also sponsored by DARPA. You can pretend these are all irrelevant arguments and wait for your proof, but the reality is that reasonable doubt and ad hominem are sometimes appropriate, especially when dealing with privacy. It's on them to prove their trusted setup can be trusted, and everything they've done is antithetic to trust.
- the_stc 9y ago
  Trusted setup only compromises the supply integrity not privacy. I am not a fan of Zooko or the Green comments on backdoors and LE but do not misrepresent trusted setup.
  - throwawaylolx 9y ago
    >only compromises the supply integrity Conveniently, it's impossible to audit whether more coins are being minted right now to add to the developer tax already imposed on block rewards. Don't think I misrepresented trusted setup--only warning others about the reputation of Zcash. Anonymity for some can be a critical issue, so I don't think everyone can afford to wait for "proof of backdoor" before making their decision.
    - nootropicat 9y ago
      Deanonymizing zcash's shielded transactions requires breaking the preimage resistance of sha256.
      - ianmiers 9y ago
        Technically, you could also break the encryption used in the memo field. But thats bog standard cryptography
  - ianmiers 9y ago
    By the way, the backdoor comments are taken out of context in a very inaccurate way. For Zooko's, literally the next tweet explains that he means for transfers in and out of fiat. "And by the way, I think we can successfully make Zcash too traceable for criminals like WannaCry, but still completely private & fungible. … … At least for as long as criminals want to cash out to fiat (years? decades?). … "[0] Since conversions to fiat are done via exchanges, which are regulated, it's pretty simple. This applies to Monero,Dash, etc. Matt's, which he has pointed out before[0], was a point that it was possible, which is true for any system. If you follow the general debate on adding backdoors to encryption, you'll know he and almost all cryptographers are completely against them. Its fine not to be a fan of them or think people should never admit even the conceptual possibility of limitations on privacy but neither quote was endorsing backdoors. [0] https://twitter.com/zooko/status/863202964416077824 https://twitter.com/zooko/status/863202964416077824 [1] https://news.ycombinator.com/item?id=15370744 https://news.ycombinator.com/item?id=15370744

the_stc 9y ago

>This was a well-known design choice where the user could balance between transaction size and privacy--people who preferred faster/cheaper transactions chose to sacrifice untraceability. Nowadays, the default option enforces higher untraceability. This has always been wrong and it is wrong on the face. Your privacy does NOT depend on your ring-size. That is only for backward-tracing. For forwards tracing [more common: you have bad money and want to turn it anonymous so it is good] you rely on other people on the network false-spending your money. Between the low ringsize [3, now 5, soon 7] and the fact that a good double-digit % of network is owned by LE-accessible entities [ShapeShift does at least 7-15% of tx]. Even with these papers Monero refuses to provide any sort of disclaimer that transactions may be traceable despite readily admitting you must do churn over time to gain privacy. Monero deserves a lot of criticism even if ZCash is worse in some ways.

socrates1024 9y ago

This isn't a good explanation. The result of this research is actually that even if you opted in to privacy during mid 2016 to jan 2017, you wouldn't have gotten it.

Quanttek 9y ago

> This was a well-known design choice where the user could balance between transaction size and privacy--people who preferred faster/cheaper transactions chose to sacrifice untraceability. Nowadays, the default option enforces higher untraceability. I don't think you understand the flaw behind this "design choice". While its great to give the user the choice in how they want to balance things, the individual's choice affects the whole system. If you - as kess privacy-conscious user - use 0 mixins (as was possible) or the min. no. of mixins, when your transaction is used as mixin for a privacy-focused user, you make that user much more identifieable. The choice defeats itself when you depend on others to take at least the same number of mixins for their transactions.

CryptoPunk 9y ago

If the ZCash trusted setup was compromised, it would allow the compromiser to create ZCash "out of thin air" and effectively rob other ZEC holders through seigniorage. It would not allow them to spy on transactions.