5 ms·

Bitcoin is as traceable as a SWIFT payment. Monero is about the truest to the original cypher punk dream as we have now.

brian_cloutier 6y ago
It depends on your trust model. If you believe in fancy cryptography then shielded zcash is even better than monero. Monero keeps increasing the size of the anonymity set as it becomes more clear to them that modern deanonymization techniques are quite good: https://mudit.blog/mixers-are-insufficient/ https://mudit.blog/mixers-are-insufficient/ Though, of course, neither are perfect, we're going to keep finding attacks on these things for a while: https://crypto.stanford.edu/timings/ https://crypto.stanford.edu/timings/
- blueprint 6y ago
  Monero is not a mixer, and actually calculations show a small ring size is usually very sufficient. Read more.
  - brian_cloutier 6y ago
    If you give me a link I'm happy to "read more" but you're going to have to give me a link or make an argument, I have no interest in going searching for something so likely to be wrong. Here is an active deanonymization attack [1]: > We show how an attacker can take advantage of Monero’s Bulletproof protocol, which reduces transaction fees, to flood the network with his own transactions and, consequently, remove mixins from transaction inputs. Assuming an attack timeframe of 12 months, our findings show that an attacker can trace up to 47.63% of the transaction inputs at a cost of just 1,746.53 USD. Sounds pretty bad to me. Here's another attack [2]: > First, about 62% of transaction inputs with one or more mixins are vulnerable to “chain-reaction” analysis — that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such away that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the “newest” input. We estimate that this heuristic can be used to guess the real input with 80 %accuracy over all transactions with 1 or more mixins. I don't care what "calculations" say, if so many transactions can be deanonymized then those calculations were calculating the wrong thing. [1] https://eprint.iacr.org/2019/455 https://eprint.iacr.org/2019/455 [2] https://arxiv.org/pdf/1704.04299/ https://arxiv.org/pdf/1704.04299/
    - john_alan 6y ago
      The attacks you link to have been mitigated. I’m an applied cryptographer, I like ZKPs but ZEC is dead in the water for obvious reasons.
- tootahe45 6y ago
  Wasn;t there a day where zcash had only 2 transactions total? these anon coins suffer from their very small user-base.
  - brian_cloutier 6y ago
    A small user base is absolutely a problem, if there are only so many zcash nodes then traffic analysis becomes very easy. Though, if there are only a few transactions each day that's not as large of an issue as it sounds; the blockchain still has no linkability between transactions. Active attacks might work but few attackers can pull those off, and no attacker is able to go back in time to deanonymize older transactions (assuming the cryptography holds).
jhoechtl 6y ago
Sure it is, thats the whole point of it. But nobody knows who I am.
jjeaff 6y ago
Bitcoin is not as traceable as a swift payment. You don't have to register your name and address and social security number to transfer bitcoin. You may be able to trace the addresses that bitcoin is connected to, but you will at some point have to do additional work to investigate ip addresses and hope that they don't all lead to anonymous VPNs ran through a coffee shop wifi before the bitcoin is passed on to someone else.
- closeparen 6y ago
  You have to register those things at the fiat currency entry/exit points, and every hop thereafter is public.
  - richardknop 6y ago
    You can buy bitcoin in cash.
jerry1979 6y ago
I think grin would like word with you.
- RandomBacon 6y ago
  It's been a while since I looked into Grin. My understanding is that it lacks some privacy features compared to Monero, which is what allows Grin to scale better.
  - tromp 6y ago
    Mimblewimble is about simplicity and elegance which benefit both scalability and privacy. It solves 2 of the 3 major privacy issues (amounts and addresses), while leaving potential to reduce the 3rd (linkability) by making coinjoins trivial (tx aggregation). Monero has much better privacy, but it pays a heavy price in having 20x more chain bloat, and needing to have random access to some info of all spent outputs. It also lacks (scriptless) scripts which makes possible things like payment channels.
- thinkmassive 6y ago
  Tari is an evolution grin’s mimblewimble chain combined with being merge-mined with monero for increased security. The testnet has been operational for a while, although I don’t follow it closely and haven’t heard anything since they were stress testing it a couple months ago. https://tarilabs.com/ https://tarilabs.com/
- john_alan 6y ago
  Interactive protocol, non-private notional.
bootcampwhere 6y ago
Bitcoin was NEVER, in ANYWAY meant to be anonymous, but you HNer turds just love this strawman so much.
shemnon42 6y ago
Only if people re-use bitcoin addresses, or deal with people who re-use addresses. If there is one thing I would change about the protocol it would be to prohibit address reuse. There are techniques like HD wallets that allow you to do this.

brian_cloutier 6y ago

It depends on your trust model. If you believe in fancy cryptography then shielded zcash is even better than monero. Monero keeps increasing the size of the anonymity set as it becomes more clear to them that modern deanonymization techniques are quite good: https://mudit.blog/mixers-are-insufficient/ https://mudit.blog/mixers-are-insufficient/ Though, of course, neither are perfect, we're going to keep finding attacks on these things for a while: https://crypto.stanford.edu/timings/ https://crypto.stanford.edu/timings/

blueprint 6y ago
Monero is not a mixer, and actually calculations show a small ring size is usually very sufficient. Read more.
- brian_cloutier 6y ago
  If you give me a link I'm happy to "read more" but you're going to have to give me a link or make an argument, I have no interest in going searching for something so likely to be wrong. Here is an active deanonymization attack [1]: > We show how an attacker can take advantage of Monero’s Bulletproof protocol, which reduces transaction fees, to flood the network with his own transactions and, consequently, remove mixins from transaction inputs. Assuming an attack timeframe of 12 months, our findings show that an attacker can trace up to 47.63% of the transaction inputs at a cost of just 1,746.53 USD. Sounds pretty bad to me. Here's another attack [2]: > First, about 62% of transaction inputs with one or more mixins are vulnerable to “chain-reaction” analysis — that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such away that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the “newest” input. We estimate that this heuristic can be used to guess the real input with 80 %accuracy over all transactions with 1 or more mixins. I don't care what "calculations" say, if so many transactions can be deanonymized then those calculations were calculating the wrong thing. [1] https://eprint.iacr.org/2019/455 https://eprint.iacr.org/2019/455 [2] https://arxiv.org/pdf/1704.04299/ https://arxiv.org/pdf/1704.04299/
  - john_alan 6y ago
    The attacks you link to have been mitigated. I’m an applied cryptographer, I like ZKPs but ZEC is dead in the water for obvious reasons.
tootahe45 6y ago
Wasn;t there a day where zcash had only 2 transactions total? these anon coins suffer from their very small user-base.
- brian_cloutier 6y ago
  A small user base is absolutely a problem, if there are only so many zcash nodes then traffic analysis becomes very easy. Though, if there are only a few transactions each day that's not as large of an issue as it sounds; the blockchain still has no linkability between transactions. Active attacks might work but few attackers can pull those off, and no attacker is able to go back in time to deanonymize older transactions (assuming the cryptography holds).

jhoechtl 6y ago

Sure it is, thats the whole point of it. But nobody knows who I am.

jjeaff 6y ago

Bitcoin is not as traceable as a swift payment. You don't have to register your name and address and social security number to transfer bitcoin. You may be able to trace the addresses that bitcoin is connected to, but you will at some point have to do additional work to investigate ip addresses and hope that they don't all lead to anonymous VPNs ran through a coffee shop wifi before the bitcoin is passed on to someone else.

closeparen 6y ago
You have to register those things at the fiat currency entry/exit points, and every hop thereafter is public.
- richardknop 6y ago
  You can buy bitcoin in cash.

jerry1979 6y ago

I think grin would like word with you.

RandomBacon 6y ago
It's been a while since I looked into Grin. My understanding is that it lacks some privacy features compared to Monero, which is what allows Grin to scale better.
- tromp 6y ago
  Mimblewimble is about simplicity and elegance which benefit both scalability and privacy. It solves 2 of the 3 major privacy issues (amounts and addresses), while leaving potential to reduce the 3rd (linkability) by making coinjoins trivial (tx aggregation). Monero has much better privacy, but it pays a heavy price in having 20x more chain bloat, and needing to have random access to some info of all spent outputs. It also lacks (scriptless) scripts which makes possible things like payment channels.
thinkmassive 6y ago
Tari is an evolution grin’s mimblewimble chain combined with being merge-mined with monero for increased security. The testnet has been operational for a while, although I don’t follow it closely and haven’t heard anything since they were stress testing it a couple months ago. https://tarilabs.com/ https://tarilabs.com/
john_alan 6y ago
Interactive protocol, non-private notional.

bootcampwhere 6y ago

Bitcoin was NEVER, in ANYWAY meant to be anonymous, but you HNer turds just love this strawman so much.

shemnon42 6y ago

Only if people re-use bitcoin addresses, or deal with people who re-use addresses. If there is one thing I would change about the protocol it would be to prohibit address reuse. There are techniques like HD wallets that allow you to do this.