3 ms·

It depends on your trust model. If you believe in fancy cryptography then shielded zcash is even better than monero. Monero keeps increasing the size of the ano

It depends on your trust model. If you believe in fancy cryptography then shielded zcash is even better than monero. Monero keeps increasing the size of the anonymity set as it becomes more clear to them that modern deanonymization techniques are quite good: https://mudit.blog/mixers-are-insufficient/ https://mudit.blog/mixers-are-insufficient/ Though, of course, neither are perfect, we're going to keep finding attacks on these things for a while: https://crypto.stanford.edu/timings/ https://crypto.stanford.edu/timings/

blueprint 6y ago
Monero is not a mixer, and actually calculations show a small ring size is usually very sufficient. Read more.
- brian_cloutier 6y ago
  If you give me a link I'm happy to "read more" but you're going to have to give me a link or make an argument, I have no interest in going searching for something so likely to be wrong. Here is an active deanonymization attack [1]: > We show how an attacker can take advantage of Monero’s Bulletproof protocol, which reduces transaction fees, to flood the network with his own transactions and, consequently, remove mixins from transaction inputs. Assuming an attack timeframe of 12 months, our findings show that an attacker can trace up to 47.63% of the transaction inputs at a cost of just 1,746.53 USD. Sounds pretty bad to me. Here's another attack [2]: > First, about 62% of transaction inputs with one or more mixins are vulnerable to “chain-reaction” analysis — that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such away that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the “newest” input. We estimate that this heuristic can be used to guess the real input with 80 %accuracy over all transactions with 1 or more mixins. I don't care what "calculations" say, if so many transactions can be deanonymized then those calculations were calculating the wrong thing. [1] https://eprint.iacr.org/2019/455 https://eprint.iacr.org/2019/455 [2] https://arxiv.org/pdf/1704.04299/ https://arxiv.org/pdf/1704.04299/
  - john_alan 6y ago
    The attacks you link to have been mitigated. I’m an applied cryptographer, I like ZKPs but ZEC is dead in the water for obvious reasons.
tootahe45 6y ago
Wasn;t there a day where zcash had only 2 transactions total? these anon coins suffer from their very small user-base.
- brian_cloutier 6y ago
  A small user base is absolutely a problem, if there are only so many zcash nodes then traffic analysis becomes very easy. Though, if there are only a few transactions each day that's not as large of an issue as it sounds; the blockchain still has no linkability between transactions. Active attacks might work but few attackers can pull those off, and no attacker is able to go back in time to deanonymize older transactions (assuming the cryptography holds).

blueprint 6y ago

Monero is not a mixer, and actually calculations show a small ring size is usually very sufficient. Read more.

brian_cloutier 6y ago
If you give me a link I'm happy to "read more" but you're going to have to give me a link or make an argument, I have no interest in going searching for something so likely to be wrong. Here is an active deanonymization attack [1]: > We show how an attacker can take advantage of Monero’s Bulletproof protocol, which reduces transaction fees, to flood the network with his own transactions and, consequently, remove mixins from transaction inputs. Assuming an attack timeframe of 12 months, our findings show that an attacker can trace up to 47.63% of the transaction inputs at a cost of just 1,746.53 USD. Sounds pretty bad to me. Here's another attack [2]: > First, about 62% of transaction inputs with one or more mixins are vulnerable to “chain-reaction” analysis — that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such away that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the “newest” input. We estimate that this heuristic can be used to guess the real input with 80 %accuracy over all transactions with 1 or more mixins. I don't care what "calculations" say, if so many transactions can be deanonymized then those calculations were calculating the wrong thing. [1] https://eprint.iacr.org/2019/455 https://eprint.iacr.org/2019/455 [2] https://arxiv.org/pdf/1704.04299/ https://arxiv.org/pdf/1704.04299/
- john_alan 6y ago
  The attacks you link to have been mitigated. I’m an applied cryptographer, I like ZKPs but ZEC is dead in the water for obvious reasons.

tootahe45 6y ago

Wasn;t there a day where zcash had only 2 transactions total? these anon coins suffer from their very small user-base.

brian_cloutier 6y ago
A small user base is absolutely a problem, if there are only so many zcash nodes then traffic analysis becomes very easy. Though, if there are only a few transactions each day that's not as large of an issue as it sounds; the blockchain still has no linkability between transactions. Active attacks might work but few attackers can pull those off, and no attacker is able to go back in time to deanonymize older transactions (assuming the cryptography holds).