6 ms·

I work in blockchain / cryptocurrency (one and the same) for a long time now and zksnarks are a fundamental building block for the future of generalized financi

I work in blockchain / cryptocurrency (one and the same) for a long time now and zksnarks are a fundamental building block for the future of generalized financial privacy. Many people don’t understand why financial privacy is so crucial - although many of these same people will argue through the teeth that other forms of privacy are absolutely essential. Governments throughout the world are restricting cash more and more. Why? It’s not that cash is paper. It’s that cash eliminates state tracking. The purpose of cash in a digital world is to prevent the state from creating a financial panopticon. Cryptocurrency accomplishes the same goal, but far more effectively. How can I explain to you guys how crucial this is? I guarantee you in 40 years the creation of bitcoin will be seen as a watershed moment in society.

gspr 6y ago
I do want financial privacy. But I also want a sound and mild policy of inflation as managed by western central banks. Can I have both? I suspect that as with so many other matters of privacy, most of the solution is legal and political rather than technical.
- SkyMarshal 6y ago
  Privacy and inflation in cryptocurrency are not technologically mutually exclusive, they’re mostly orthogonal. Eg, yes, technically you can have both. The problem is that in purely a private, zero-knowledge cryptocurrency, it’s difficult or impossible to inspect the actual currency issuance rate and ensure that some Byzantine miner/validator hasn’t found a way to hack the issuance algorithm and issue more currency (to themselves) than the system is designed to. For example, ZCash had a famous bug regarding this issue a few years ago, that they patched before disclosing it. That’s an ongoing technical challenge the industry is working on.
  - aspenmayer 6y ago
    I’d like to know more about the bug mentioned in $ZEC, if you have a link?
    - dlubarov 6y ago
      Not the parent, but I think he was referring to https://electriccoin.co/blog/zcash-counterfeiting-vulnerability-successfully-remediated/ https://electriccoin.co/blog/zcash-counterfeiting-vulnerabil...
      - SkyMarshal 6y ago
        Yup that’s it.
        aspenmayer 6y ago
        Even stranger are comments made in this link: https://electriccoin.co/blog/defense-against-counterfeiting-in-shielded-pools/ https://electriccoin.co/blog/defense-against-counterfeiting-... Especially this part: >Upon detecting this condition, the Zcash Company would begin its investigation into the possible source of the vulnerability as well as which pool, or pools, are affected. If we are able to identify that the bug affects only a single shielded pool, we might choose to effectively deactivate that pool by invalidating any of its outgoing transactions. A necessary consequence of this action is that any legitimate funds would also be lost forever in the affected pool. The mechanisms for this remote disabling are not mentioned in detail, and I don’t really mind, but this feature seems difficult to square with their desire for transparency. It’s an anti-feature perhaps serving a justifiable goal, but if this feature is possible to be abused, how would we even know if it had been?
        abecedarius 6y ago
        I'm not sure what they mean there, but I'd guess they mean a hard fork. As with the Ethereum post-DAO fork, you don't have to accept it, but to the extent it seems legitimate, most of the value would go along.
        dlubarov 6y ago
        There's also this more recent post: https://electriccoin.co/blog/turnstile-enforcement-against-counterfeiting/ https://electriccoin.co/blog/turnstile-enforcement-against-c... It sounds like that plan has been codified in recent clients, so they should automatically reject transactions that would cause a pool's balance to go negative.
  - im3w1l 6y ago
    > The problem is that in purely a private, zero-knowledge cryptocurrency, it’s difficult or impossible to inspect the actual currency issuance rate Satoshi could have made mining reward increase at 2% per year, but very deliberately decided on hard cap on how many will exist. This decision made early adopters literally and metaphorically invested in bitcoin's success. Are you saying that some detail of zk-Snark makes that not possible for cryptocurrencies based on this technology?
    - SkyMarshal 6y ago
      No I’m saying the exact opposite. The inflation schedule can be any arbitrary algorithm. It can be a fixed amount like Bitcoin, or a continually increasing one like your 2% example. Zk-snarks don’t change that. It’s still a choice by the developers based on the economic objectives they’re trying to achieve, and snarks don’t prevent that. But problem is that in a fully-shielded, 100% private, snark-based blockchain, it’s difficult or impossible to verify that the actual coin supply is what the whitepaper says it should be. Since all the tx’s are hidden, you can’t inspect the blockchain data and just count all the coins in UTXOs or account holdings to see what the total money supply is at any given time and reconcile it with what the issuance algorithm says it should be.
      - tromp 6y ago
        Lack of transparent supply auditability is a feature not so much of zk-snarks but of Confidential Transactions, which use Pedersen commitments to obscure amounts. Knowing the discrete logarithm of just one particular point would completely break these commitments and all cryptocurrencies based on them, by allowing undetectable inflation. They thus require complete confidence in the computational hardness of the Elliptic Curve Discrete Log Problem.
        SkyMarshal 6y ago
        Yup, fwiw I'm not actually aware of a fully shielded zk-snark cryptocurrency in production yet, was just using that as a hypothetical example, like a ZCash with only z-addresses.
- AmericanChopper 6y ago
  Financial privacy is a political dead end. Aside from most governments wanting to snoop on essentially everything you do, they really, really want to know the state of your finances. Both domestically and internationally. Most governments will claim a stake in all income of their citizens, no matter where in the world the transaction occurs. This is why AML regulations exist essentially everywhere in the world.
  - jacobush 6y ago
    I thought mostly the US wants a cut of their citizens earnings, even if abroad.
    - AmericanChopper 6y ago
      I think most countries will stop demanding taxes from you if you legitimately move to another country, though meeting the criteria for doing that can be tedious. The US doesn’t have such a system, but the way it works most expats won’t end up paying any taxes if they leave the states. Though they’ll still need to file a return.
      - gspr 6y ago
        > I think most countries will stop demanding taxes from you if you legitimately move to another country Most is an understatement. Last I checked, it was all countries, except the US and the two bastions of freedom that are Eritrea and the Soviet Union (when it existed). > The US doesn’t have such a system, but the way it works most expats won’t end up paying any taxes if they leave the states. Though they’ll still need to file a return. Won't end up paying any taxes on earned income you mean. For any other income, it's a damn nightmare.
- tromp 6y ago
  For a cryptocurrency to be truly decentralized, its emission cannot depend on factors external to the blockchain. You can have any any predetermined mild inflation you want.
michaelsbradley 6y ago
It seems zksnarks are also poised to be an important building block in scaling transaction throughput. It’s not the only example and it hasn’t launched just yet but checkout the Hermez Network[1]. [1] https://hermez.io/ https://hermez.io/ [&] https://hermez.io/hermez-whitepaper.pdf https://hermez.io/hermez-whitepaper.pdf
beders 6y ago
I keep reading these fantasies about how cryptocurrencies will keep the evil government out of your business: It won't. It can't. Unless you magically change the government, get rid of all influence by special interests and create a shadow economy at the same time. The old system will not go easily and not without a fight. Already gov organizations are readying their significant sources to track all of this, distributed ledger or not. How can I explain to you guys, that nothing you do on the internet is private. Nothing.
bigcorp-slave 6y ago
I am generally a very privacy-minded person, but serious question here: is there any legitimate use case for financial privacy from the authorities? I don’t mean “ideologically, I am upset that the government can see I buy too many pastries”. When we look at cryptocurrency, it is used for a small collection of things: - Speculation on a high volatility, unregulated market - Money laundering - Distribution of illegal material These all seem like things Im fine with the government having visibility into. Perhaps this is ignorance on my part, but all legitimate uses I’ve ever heard of seem like rounding error next to the above. No one is buying pizza with bitcoin in 2020. The uptake for real transactions seems like it’s near zero. About the best I can come up with is that financial privacy permits low level lawbreaking for laws generally regarded as stupid or unethical (e.g., marijuana). I think it’s safe to say that people who want to feed their drug habits will find other anonymous ways to to pay, e.g. barter or proxy goods. The types of folks who are deeply affected by large governments having logs of their transactions are not the downtrodden masses. They’re the moderately wealthy engaged in corruption and trafficking. Cry me a river.
- darawk 6y ago
  What are the legitimate use cases for privacy from the authorities in other domains? What are the legitimate use cases for being allowed to speak to other humans without your voice being recorded in case the authorities want to know what you said later? Fundamentally financial privacy is just privacy. People desire financial privacy for all the reasons they desire any other kind of privacy. It's certainly fine to make the collectivist argument that individual privacy is not worth the social cost of opacity, but the idea that this is true only in finance seems odd and difficult to justify.
- pfortuny 6y ago
  Yours is not the right question. The use of money has always been assumed anonymous (not the property owned, that is a different thing). Governments have a duty to collect taxes but do not have a duty to know anything about how people use their money. Governments exist as a need not as something which has “rights”.
- scandox 6y ago
keyraycheck 6y ago
You might want to check out the report below. It should be a good explainer for importance of zero knowledge in context of blockchain (a bit more in context of scaling than privacy, but the fundamentals are the same). Our three cents to help explain why it is important. [1] https://ethworks.io/assets/download/zero-knowledge-blockchain-scaling-ethworks.pdf https://ethworks.io/assets/download/zero-knowledge-blockchai...
Kudos 6y ago
What about the practical limitations with moving cash, this puts _some_ limits on criminal activity. How do we get at least that level of control with cryptocurrencies while maintaining privacy?
lomonosovoc 6y ago
What cryptocurrency would you recommend to use if privacy were one's goal?
- clashmeifyoucan 6y ago
  not op but zcash is built on zk-snarks[0] and afaik monero offers complete anonymity as well[1]. [0]: https://z.cash/technology/zksnarks/ https://z.cash/technology/zksnarks/ [1]: https://www.getmonero.org/get-started/faq/#anchor-different https://www.getmonero.org/get-started/faq/#anchor-different
ipython 6y ago
Not to get too far off topic, but like many problems transitioning from the physical realm to the digital, we have to recognize that there are logistical challenges associated with carrying, transporting and exchanging cash that simply don’t exist in the digital realm. These logistical challenges essentially force legitimate transactions into the “visible” ledger and off the “private” books for most entities. Here are a few examples. Drug smuggling cartels are experts in transporting and accounting for cash across long distances and national borders. However even they have an issue with physical storage of cash - to the point where they had too much cash to even store, leading to piles of cash buried underground, getting eaten by rodents etc. this would not be an issue with cryptocurrency. Cash is still traceable in a crude fashion- unique serial numbers on each bill. This enables some level of oversight while keeping most transactions essentially private. It also enables replacement of damaged currency, something not possible with crypto currencies. Transacting in cash has a real economic and logistical cost, whereas crypto currencies essentially have none. You have to physically meet to exchange cash- imagine the difference between paying a ransomware in cash versus cryptocurrency from the perspective of the attacker. Same as above, you have a literal physical limitation on the amount of cash you can transact due to weight and volume of the bills themselves. You may also have to enlist (and trust and pay off) intermediaries to transport the cash, representing a real economic cost to transact privately in cash. Not to mention the possibility of surveillance. Honestly the best yet still flawed analogy I can come up with when thinking about the differences between cryptocurrency and cash is remembering back to why I hated high school physics so much. Who cares about a perfectly spherical cow on a frictionless surface? Cows aren’t perfectly round and there’s friction everywhere. I feel like cryptocurrency solves the spherical cow problem but doesn’t address the real messy world.

gspr 6y ago

I do want financial privacy. But I also want a sound and mild policy of inflation as managed by western central banks. Can I have both? I suspect that as with so many other matters of privacy, most of the solution is legal and political rather than technical.

SkyMarshal 6y ago
Privacy and inflation in cryptocurrency are not technologically mutually exclusive, they’re mostly orthogonal. Eg, yes, technically you can have both. The problem is that in purely a private, zero-knowledge cryptocurrency, it’s difficult or impossible to inspect the actual currency issuance rate and ensure that some Byzantine miner/validator hasn’t found a way to hack the issuance algorithm and issue more currency (to themselves) than the system is designed to. For example, ZCash had a famous bug regarding this issue a few years ago, that they patched before disclosing it. That’s an ongoing technical challenge the industry is working on.
- aspenmayer 6y ago
  I’d like to know more about the bug mentioned in $ZEC, if you have a link?
  - dlubarov 6y ago
    Not the parent, but I think he was referring to https://electriccoin.co/blog/zcash-counterfeiting-vulnerability-successfully-remediated/ https://electriccoin.co/blog/zcash-counterfeiting-vulnerabil...
    - SkyMarshal 6y ago
      Yup that’s it.
      - aspenmayer 6y ago
        Even stranger are comments made in this link: https://electriccoin.co/blog/defense-against-counterfeiting-in-shielded-pools/ https://electriccoin.co/blog/defense-against-counterfeiting-... Especially this part: >Upon detecting this condition, the Zcash Company would begin its investigation into the possible source of the vulnerability as well as which pool, or pools, are affected. If we are able to identify that the bug affects only a single shielded pool, we might choose to effectively deactivate that pool by invalidating any of its outgoing transactions. A necessary consequence of this action is that any legitimate funds would also be lost forever in the affected pool. The mechanisms for this remote disabling are not mentioned in detail, and I don’t really mind, but this feature seems difficult to square with their desire for transparency. It’s an anti-feature perhaps serving a justifiable goal, but if this feature is possible to be abused, how would we even know if it had been?
        abecedarius 6y ago
        I'm not sure what they mean there, but I'd guess they mean a hard fork. As with the Ethereum post-DAO fork, you don't have to accept it, but to the extent it seems legitimate, most of the value would go along.
        dlubarov 6y ago
        There's also this more recent post: https://electriccoin.co/blog/turnstile-enforcement-against-counterfeiting/ https://electriccoin.co/blog/turnstile-enforcement-against-c... It sounds like that plan has been codified in recent clients, so they should automatically reject transactions that would cause a pool's balance to go negative.
- im3w1l 6y ago
  > The problem is that in purely a private, zero-knowledge cryptocurrency, it’s difficult or impossible to inspect the actual currency issuance rate Satoshi could have made mining reward increase at 2% per year, but very deliberately decided on hard cap on how many will exist. This decision made early adopters literally and metaphorically invested in bitcoin's success. Are you saying that some detail of zk-Snark makes that not possible for cryptocurrencies based on this technology?
  - SkyMarshal 6y ago
    No I’m saying the exact opposite. The inflation schedule can be any arbitrary algorithm. It can be a fixed amount like Bitcoin, or a continually increasing one like your 2% example. Zk-snarks don’t change that. It’s still a choice by the developers based on the economic objectives they’re trying to achieve, and snarks don’t prevent that. But problem is that in a fully-shielded, 100% private, snark-based blockchain, it’s difficult or impossible to verify that the actual coin supply is what the whitepaper says it should be. Since all the tx’s are hidden, you can’t inspect the blockchain data and just count all the coins in UTXOs or account holdings to see what the total money supply is at any given time and reconcile it with what the issuance algorithm says it should be.
    - tromp 6y ago
      Lack of transparent supply auditability is a feature not so much of zk-snarks but of Confidential Transactions, which use Pedersen commitments to obscure amounts. Knowing the discrete logarithm of just one particular point would completely break these commitments and all cryptocurrencies based on them, by allowing undetectable inflation. They thus require complete confidence in the computational hardness of the Elliptic Curve Discrete Log Problem.
      - SkyMarshal 6y ago
        Yup, fwiw I'm not actually aware of a fully shielded zk-snark cryptocurrency in production yet, was just using that as a hypothetical example, like a ZCash with only z-addresses.
AmericanChopper 6y ago
Financial privacy is a political dead end. Aside from most governments wanting to snoop on essentially everything you do, they really, really want to know the state of your finances. Both domestically and internationally. Most governments will claim a stake in all income of their citizens, no matter where in the world the transaction occurs. This is why AML regulations exist essentially everywhere in the world.
- jacobush 6y ago
  I thought mostly the US wants a cut of their citizens earnings, even if abroad.
  - AmericanChopper 6y ago
    I think most countries will stop demanding taxes from you if you legitimately move to another country, though meeting the criteria for doing that can be tedious. The US doesn’t have such a system, but the way it works most expats won’t end up paying any taxes if they leave the states. Though they’ll still need to file a return.
    - gspr 6y ago
      > I think most countries will stop demanding taxes from you if you legitimately move to another country Most is an understatement. Last I checked, it was all countries, except the US and the two bastions of freedom that are Eritrea and the Soviet Union (when it existed). > The US doesn’t have such a system, but the way it works most expats won’t end up paying any taxes if they leave the states. Though they’ll still need to file a return. Won't end up paying any taxes on earned income you mean. For any other income, it's a damn nightmare.
tromp 6y ago
For a cryptocurrency to be truly decentralized, its emission cannot depend on factors external to the blockchain. You can have any any predetermined mild inflation you want.

michaelsbradley 6y ago

It seems zksnarks are also poised to be an important building block in scaling transaction throughput. It’s not the only example and it hasn’t launched just yet but checkout the Hermez Network[1]. [1] https://hermez.io/ https://hermez.io/ [&] https://hermez.io/hermez-whitepaper.pdf https://hermez.io/hermez-whitepaper.pdf

beders 6y ago

I keep reading these fantasies about how cryptocurrencies will keep the evil government out of your business: It won't. It can't. Unless you magically change the government, get rid of all influence by special interests and create a shadow economy at the same time. The old system will not go easily and not without a fight. Already gov organizations are readying their significant sources to track all of this, distributed ledger or not. How can I explain to you guys, that nothing you do on the internet is private. Nothing.

bigcorp-slave 6y ago

I am generally a very privacy-minded person, but serious question here: is there any legitimate use case for financial privacy from the authorities? I don’t mean “ideologically, I am upset that the government can see I buy too many pastries”. When we look at cryptocurrency, it is used for a small collection of things: - Speculation on a high volatility, unregulated market - Money laundering - Distribution of illegal material These all seem like things Im fine with the government having visibility into. Perhaps this is ignorance on my part, but all legitimate uses I’ve ever heard of seem like rounding error next to the above. No one is buying pizza with bitcoin in 2020. The uptake for real transactions seems like it’s near zero. About the best I can come up with is that financial privacy permits low level lawbreaking for laws generally regarded as stupid or unethical (e.g., marijuana). I think it’s safe to say that people who want to feed their drug habits will find other anonymous ways to to pay, e.g. barter or proxy goods. The types of folks who are deeply affected by large governments having logs of their transactions are not the downtrodden masses. They’re the moderately wealthy engaged in corruption and trafficking. Cry me a river.

darawk 6y ago
What are the legitimate use cases for privacy from the authorities in other domains? What are the legitimate use cases for being allowed to speak to other humans without your voice being recorded in case the authorities want to know what you said later? Fundamentally financial privacy is just privacy. People desire financial privacy for all the reasons they desire any other kind of privacy. It's certainly fine to make the collectivist argument that individual privacy is not worth the social cost of opacity, but the idea that this is true only in finance seems odd and difficult to justify.
pfortuny 6y ago
Yours is not the right question. The use of money has always been assumed anonymous (not the property owned, that is a different thing). Governments have a duty to collect taxes but do not have a duty to know anything about how people use their money. Governments exist as a need not as something which has “rights”.
scandox 6y ago

keyraycheck 6y ago

You might want to check out the report below. It should be a good explainer for importance of zero knowledge in context of blockchain (a bit more in context of scaling than privacy, but the fundamentals are the same). Our three cents to help explain why it is important. [1] https://ethworks.io/assets/download/zero-knowledge-blockchain-scaling-ethworks.pdf https://ethworks.io/assets/download/zero-knowledge-blockchai...

Kudos 6y ago

What about the practical limitations with moving cash, this puts _some_ limits on criminal activity. How do we get at least that level of control with cryptocurrencies while maintaining privacy?

lomonosovoc 6y ago

What cryptocurrency would you recommend to use if privacy were one's goal?

clashmeifyoucan 6y ago
not op but zcash is built on zk-snarks[0] and afaik monero offers complete anonymity as well[1]. [0]: https://z.cash/technology/zksnarks/ https://z.cash/technology/zksnarks/ [1]: https://www.getmonero.org/get-started/faq/#anchor-different https://www.getmonero.org/get-started/faq/#anchor-different

ipython 6y ago

Not to get too far off topic, but like many problems transitioning from the physical realm to the digital, we have to recognize that there are logistical challenges associated with carrying, transporting and exchanging cash that simply don’t exist in the digital realm. These logistical challenges essentially force legitimate transactions into the “visible” ledger and off the “private” books for most entities. Here are a few examples. Drug smuggling cartels are experts in transporting and accounting for cash across long distances and national borders. However even they have an issue with physical storage of cash - to the point where they had too much cash to even store, leading to piles of cash buried underground, getting eaten by rodents etc. this would not be an issue with cryptocurrency. Cash is still traceable in a crude fashion- unique serial numbers on each bill. This enables some level of oversight while keeping most transactions essentially private. It also enables replacement of damaged currency, something not possible with crypto currencies. Transacting in cash has a real economic and logistical cost, whereas crypto currencies essentially have none. You have to physically meet to exchange cash- imagine the difference between paying a ransomware in cash versus cryptocurrency from the perspective of the attacker. Same as above, you have a literal physical limitation on the amount of cash you can transact due to weight and volume of the bills themselves. You may also have to enlist (and trust and pay off) intermediaries to transport the cash, representing a real economic cost to transact privately in cash. Not to mention the possibility of surveillance. Honestly the best yet still flawed analogy I can come up with when thinking about the differences between cryptocurrency and cash is remembering back to why I hated high school physics so much. Who cares about a perfectly spherical cow on a frictionless surface? Cows aren’t perfectly round and there’s friction everywhere. I feel like cryptocurrency solves the spherical cow problem but doesn’t address the real messy world.