4 ms·

I'm on the Monero Research Lab team. This article, like most media coverage of academic research, ignores much of the subtlety behind the research. The likeliho

I'm on the Monero Research Lab team. This article, like most media coverage of academic research, ignores much of the subtlety behind the research. The likelihood that a particular output is positively identified depends heavily on its age relative to our regular protocol upgrades. And it's not like we aren't actively working on ways to improve anonymity. We're in the process of updating the way we choose our fake outputs and discussing best practices for handling very old outputs. I always appreciate research into ways to improve Monero, but I don't think this article does the research justice.

stochastic_monk 9y ago
I'm not involved with any cryptocurrencies, so I have no dog in this fight. I am curious, however. Whenever ZCash comes up Monero is mentioned as "also providing" anonymity. Being on the Monero team, can you comment on the differences between the privacy guarantees provided by the two platforms?
- splintercell 9y ago
  ZCash's biggest problem from a common man's perspective: It's privacy isn't enabled by default, it's opt-in. That means, people (i.e. the people you are interacting with) need to opt-in with it's privacy, in order for you to be able to achieve privacy. I have the same problem with Signal, it tries to be 'seamless' in it's integration with SMS. But now I could be talking to someone on Signal who also uses Signal so the communication is secured, but if they don't, Signal just sends messages as an unsecured SMS (though it shows you on the app with a slight UX tweak that this is an unsecured communication channel, but that's not good enough).
  - vzcx 9y ago
    My understanding is that shielded transactions were made opt-in due to time and resource needs in computing their zero-knowledge proofs. Hopefully they can improve this and do away with unshielded transactions altogether in the future.
- IIAOPSW 9y ago
  I'm a user who picked the Monero side of things. Here's the short run down on the difference and why I ultimately sided with Monero. Monero uses ring signatures to prove that one out of n people signed a transaction without revealing which one of the n. Over the course of k steps the possible transaction history might be in any of n^k states. Typically n=5. Zcash uses Zero-Knowledge-Proofs for anonymity. Any private zcash tx may have gone to or come from any other private zcash tx. Here are the problems with Zcash as I see them 1) trusted setup. There is some toxic seed data that needed to be destroyed at the time Zcash was created. With that seed you could inflate the coin as much as you want. There was an elaborate ceremony of 6 people (5 of them Zcash employees) showing the seed was destroyed. But elaborate ceremony isn't cryptographic proof. 2) privacy is optional. If a transaction goes from non-private address, to private address, to non-private address it is traceable. The Zcash anonymity set is actually very small. 3) Zcash is a company. I consider the political structure of a coin (or lack thereof) as an attackable surface. A government can force Zcash to back-door their software (hi NSA). There is no head of Monero.
  - the_stc 9y ago
    On 2: Monero is almost the same. ShapeShift does 7-15% of all tx at least. How many transactions are actually private after you consider hacks or LE warrants? Those TX are what you depend on to get false spends. On 3: How many people must agree in order to change something in Monero such as HF parameters like ringsize? There is not a single company but it looks [to an outsider like me] as a similar position. I chose Monero too for similar reasons inc ZCash people openly saying they support backdoors for LE [but promising ZCash would never have them]. And taking 20% of block reward and not doing anything useful with it [for millions I expect really polished clients and some quick upgrades]. But the low ringsize is weak [hence going from 3 to 5 to now 7]. All ring members are not equal to n^k is very naive. Fee, ringsize, payment ID, in/out count are all metadata that distinguish on-blockchain. Let alone off-blockchain such as keys being hacked/warranted. Given this and Monero's lack of disclaimer or warning at all about how to use it safely... a paranoid person might suspect ill-motives. [Consider: MyMonero, the Monero 'lead' Web Wallet, goes out of its way to suggest users use a few higher ringsizes to get better privacy, when we know this makes their TX stand out. This is something that presumably he could change with 1 or 2 lines of code but has not.]
tom_mellior 9y ago
> The likelihood that a particular output is positively identified depends heavily on its age relative to our regular protocol upgrades. That's mentioned explicitly in the article. With explicit dates of certain protocol changes that have improved things. > And it's not like we aren't actively working on ways to improve anonymity. In other words, there are threats now. Which is what the article says. > I always appreciate research into ways to improve Monero, but I don't think this article does the research justice. I haven't seen the original research, so I cannot tell if the article does it justice. But I can say that what you have said here doesn't call the article into question. You have just restated the things it says. (For whatever it's worth, I do own some Monero and I would like it to be successful. Part of that is accepting valid, constructive criticism.)
nickthemagicman 9y ago
Just wanted to say thanks for your work! It's my favorite crypto out there and the more I learn about it the more I realize how solid the tech is.
the_stc 9y ago
Because the decoy selection is not part of protocol not everyone is doing it. Some exchanges have increased ringsize but kept old selection system. Not to mention that exchanges make up a large bulk of Monero TX and hence are one warrant/hack away from killing a bunch of decoys anyways. Monero would gain credibility if it took a conservative approach to ringsize then used research to lower the ringsize. Instead we get no justification for ringsize saying there is no research that shows an increase needed. This is the opposite way of how security is approached. Indeed: The only MRL statement I know of on churn is that it does not work. I appreciate the work you do and MRL overall. But without practical examination of real-world threats it feels a bit empty. And Monero team refusal to provide any sort of disclaimer at all really undermines the sincerity.
sgp_ 9y ago
Most importantly, the vast majority of findings from this paper were first researched in late 2014 in MRL-0001. Since this research paper, improvements have been made, including increasing the minimum ringsize to 3, 5, and now 7. RingCT was added in January 2017, which hides the amount. The paper has 3 recommendations: 1. Warn users who made early transactions that they may have had their ring signatures compromised. The stealth addresses would still work. This isn't a suggested improvement, and I believe that any user interested in maintaining their privacy should have considered researching Monero, including reading MRL-0001. I'm sure not everyone did this, but keep in mind that Monero was a much smaller network back then made of mostly enthusiasts. If you were transacting on AlphaBay, the least you could have done is seem what the limitations of your tool are. They were much higher at the time than they are now. 2. Improve the decoy selection algorithm. There is definitely room for improvement to make the most out of the decoys selected for the ring signature. 3. Consider avoiding public pool payout outputs, which are known to be used in the pool transactions. This is a fair point, though from the proportion of pool payout transactions to total transactions as found in the paper, this case is likely still adequately covered with ringsize 7. Monero can still consider avoiding these outputs as decoys though in some way.

stochastic_monk 9y ago

I'm not involved with any cryptocurrencies, so I have no dog in this fight. I am curious, however. Whenever ZCash comes up Monero is mentioned as "also providing" anonymity. Being on the Monero team, can you comment on the differences between the privacy guarantees provided by the two platforms?

splintercell 9y ago
ZCash's biggest problem from a common man's perspective: It's privacy isn't enabled by default, it's opt-in. That means, people (i.e. the people you are interacting with) need to opt-in with it's privacy, in order for you to be able to achieve privacy. I have the same problem with Signal, it tries to be 'seamless' in it's integration with SMS. But now I could be talking to someone on Signal who also uses Signal so the communication is secured, but if they don't, Signal just sends messages as an unsecured SMS (though it shows you on the app with a slight UX tweak that this is an unsecured communication channel, but that's not good enough).
- vzcx 9y ago
  My understanding is that shielded transactions were made opt-in due to time and resource needs in computing their zero-knowledge proofs. Hopefully they can improve this and do away with unshielded transactions altogether in the future.
IIAOPSW 9y ago
I'm a user who picked the Monero side of things. Here's the short run down on the difference and why I ultimately sided with Monero. Monero uses ring signatures to prove that one out of n people signed a transaction without revealing which one of the n. Over the course of k steps the possible transaction history might be in any of n^k states. Typically n=5. Zcash uses Zero-Knowledge-Proofs for anonymity. Any private zcash tx may have gone to or come from any other private zcash tx. Here are the problems with Zcash as I see them 1) trusted setup. There is some toxic seed data that needed to be destroyed at the time Zcash was created. With that seed you could inflate the coin as much as you want. There was an elaborate ceremony of 6 people (5 of them Zcash employees) showing the seed was destroyed. But elaborate ceremony isn't cryptographic proof. 2) privacy is optional. If a transaction goes from non-private address, to private address, to non-private address it is traceable. The Zcash anonymity set is actually very small. 3) Zcash is a company. I consider the political structure of a coin (or lack thereof) as an attackable surface. A government can force Zcash to back-door their software (hi NSA). There is no head of Monero.
- the_stc 9y ago
  On 2: Monero is almost the same. ShapeShift does 7-15% of all tx at least. How many transactions are actually private after you consider hacks or LE warrants? Those TX are what you depend on to get false spends. On 3: How many people must agree in order to change something in Monero such as HF parameters like ringsize? There is not a single company but it looks [to an outsider like me] as a similar position. I chose Monero too for similar reasons inc ZCash people openly saying they support backdoors for LE [but promising ZCash would never have them]. And taking 20% of block reward and not doing anything useful with it [for millions I expect really polished clients and some quick upgrades]. But the low ringsize is weak [hence going from 3 to 5 to now 7]. All ring members are not equal to n^k is very naive. Fee, ringsize, payment ID, in/out count are all metadata that distinguish on-blockchain. Let alone off-blockchain such as keys being hacked/warranted. Given this and Monero's lack of disclaimer or warning at all about how to use it safely... a paranoid person might suspect ill-motives. [Consider: MyMonero, the Monero 'lead' Web Wallet, goes out of its way to suggest users use a few higher ringsizes to get better privacy, when we know this makes their TX stand out. This is something that presumably he could change with 1 or 2 lines of code but has not.]

tom_mellior 9y ago

> The likelihood that a particular output is positively identified depends heavily on its age relative to our regular protocol upgrades. That's mentioned explicitly in the article. With explicit dates of certain protocol changes that have improved things. > And it's not like we aren't actively working on ways to improve anonymity. In other words, there are threats now. Which is what the article says. > I always appreciate research into ways to improve Monero, but I don't think this article does the research justice. I haven't seen the original research, so I cannot tell if the article does it justice. But I can say that what you have said here doesn't call the article into question. You have just restated the things it says. (For whatever it's worth, I do own some Monero and I would like it to be successful. Part of that is accepting valid, constructive criticism.)

nickthemagicman 9y ago

Just wanted to say thanks for your work! It's my favorite crypto out there and the more I learn about it the more I realize how solid the tech is.

the_stc 9y ago

Because the decoy selection is not part of protocol not everyone is doing it. Some exchanges have increased ringsize but kept old selection system. Not to mention that exchanges make up a large bulk of Monero TX and hence are one warrant/hack away from killing a bunch of decoys anyways. Monero would gain credibility if it took a conservative approach to ringsize then used research to lower the ringsize. Instead we get no justification for ringsize saying there is no research that shows an increase needed. This is the opposite way of how security is approached. Indeed: The only MRL statement I know of on churn is that it does not work. I appreciate the work you do and MRL overall. But without practical examination of real-world threats it feels a bit empty. And Monero team refusal to provide any sort of disclaimer at all really undermines the sincerity.

sgp_ 9y ago

Most importantly, the vast majority of findings from this paper were first researched in late 2014 in MRL-0001. Since this research paper, improvements have been made, including increasing the minimum ringsize to 3, 5, and now 7. RingCT was added in January 2017, which hides the amount. The paper has 3 recommendations: 1. Warn users who made early transactions that they may have had their ring signatures compromised. The stealth addresses would still work. This isn't a suggested improvement, and I believe that any user interested in maintaining their privacy should have considered researching Monero, including reading MRL-0001. I'm sure not everyone did this, but keep in mind that Monero was a much smaller network back then made of mostly enthusiasts. If you were transacting on AlphaBay, the least you could have done is seem what the limitations of your tool are. They were much higher at the time than they are now. 2. Improve the decoy selection algorithm. There is definitely room for improvement to make the most out of the decoys selected for the ring signature. 3. Consider avoiding public pool payout outputs, which are known to be used in the pool transactions. This is a fair point, though from the proportion of pool payout transactions to total transactions as found in the paper, this case is likely still adequately covered with ringsize 7. Monero can still consider avoiding these outputs as decoys though in some way.