5 ms·

That’s true for a lot of crypto but not for something like monero which has an anonymous blockchain.

gruez 6y ago
It's anonymous with some caveats. The transaction graph is still there, it's just that there are decoy inputs/outputs which provides plausible deniability. However, over repeated transactions the plausible deniability weakens. ie. having an output to a darknet market in one of your transaction is easily explainable by bad luck, but it's present in several transactions it becomes suspicious enough that the police can start investigating you.
- derefr 6y ago
  This might be true of the particular decoy approach used with Monero, but I don’t think it’s true in general; e.g. with mixer/tumbler services. If every transaction that everyone does has some outputs to darknet markets (because they’re popular and high-volume), and some outputs to legitimate businesses (because they’re also popular and high-volume) then that really is reasonable doubt that any particular individual did anything bad. It’s like how you can’t charge someone with possession of cocaine because there’s cocaine on the US dollar bills in their pocket: there’s actually trace amounts of cocaine on every US dollar bill.
  - Igelau 6y ago
    > If every transaction that everyone does has some outputs to darknet markets ... and some outputs to legitimate businesses ... then that really is reasonable doubt that any particular individual did anything bad. It says that no particular individual made a Bad Guy payment, but that all of them facilitated it by providing cover noise.
    - derefr 6y ago
      Are you facilitating a Bad Guy payment if you use a bank that the Bad Guy also uses?
  - gruez 6y ago
    >If every transaction that everyone does has some outputs to darknet markets (because they’re popular and high-volume), and some outputs to legitimate businesses (because they’re also popular and high-volume) then that really is reasonable doubt that any particular individual did anything bad. The problem is that transacting with a darknet market will still bring your illicit output % above average. Right now monero has 10 decoy outputs per transaction. If the proportion of illicit addresses to legitimate addresses were 50%-50%, then a legitimate transaction would have an average of 5 illicit outputs but a illicit transaction would have an average of 6 illicit outputs. The same applies to inputs. The difference between 5 and 6 might be small enough to be indistinguishable from background noise, but that result is heavily dependent on the proportion of illicit vs legitimate address. If the proportion is something like 95%-5%, then the difference would be 0.5 vs 1.5, which is significant. I won't bother to do the probability calculations for this, but I'm going to estimate you can get to 95% certainty within 10 transactions. >It’s like how you can’t charge someone with possession of cocaine because there’s cocaine on the US dollar bills in their pocket: there’s actually trace amounts of cocaine on every US dollar bill. The interesting bit is that they don't have to charge you based on that alone. If they're 80% sure you bought illegal drugs, they'll either get a warrant to search your house or perform surveillance on you and wait for you to slip up.
    - derefr 6y ago
      I get what you mean, I think — you’re talking about traffic fingerprinting. But you can use the same anti-traffic-analysis techiques used elsewhere in systems like Tox. For example, the darknet market itself could use some of its revenue to pay for “noise transactions” (wash transfers through the mixer, then intentionally “black-laundered” in the market) to keep the number of darknet-market-spent outputs constant per mixer step, by asking for advance notice from buyers for when transfers targeted at their sellers will happen, and then running N fewer “noise transactions” during the appropriate mixer steps. Though also, you’re assuming a constant “your account” in the above. If you mix 100% of your holdings every time you transact, setting it so that a set amount goes to a darknet market, and the rest goes back to a newly-created public-key-hash that you just generated the keypair for — and then when you want to use money from that address, you fully consume it to mix it again — then nobody ever gets the opportunity to fingerprint “your” traffic. There’s no stable “you.” (I have a theory that this is the goal Satoshi was aiming at with Bitcoin UXTOs, but never finished that element of the design, and launched it half-baked.) This also means that the mixer gets to eat a percentage fee off of your complete holdings every transaction, so it kind of sucks, but what can you do.
- qqii 6y ago
  This isn't the case, monero employs stealth addresses so there is no way to tell who the recipient is just just by observing the blockchain.
acdha 6y ago
That’s the hope but remember that it’s irrevocable: you’re gambling that they got the implementation perfect, the network is operated securely without practical side channels or timing analysis, no unrecognized attacks will become practical, and that your clients will not have any bugs or backdoors — for the rest of your life!
lottin 6y ago
Blockchains and privacy are antithetical. The whole purpose of a blockchain is to keep track of transactions so that everyone knows how many coins everyone else has in order to prevent double-spending. You can try to achieve anonymity through obscurity but this will never work in principle or in practice.
- kjjjjjjjjjjjjjj 6y ago
  Sure, this applies for bitcoin, because bitcoin is legacy technology and has no features or utility. Monero does not work like bitcoin https://steemit.com/monero/@sgp/7yjqso-a-monero-introduction-for-beginners https://steemit.com/monero/@sgp/7yjqso-a-monero-introduction...
- derefr 6y ago
  The process of reaching consensus on the current state doesn’t have to involve reaching consensus on the past state for all participants. A blockchain can be built such that all historical previous state + the txs required to get to those historical states are discarded after a quorum of nodes reach consensus on it, leaving only the current state. (This is basically what already happens if you do a “network version upgrade” on a Cosmos-based network: everyone keeps their balances, but just in the form of a new genesis block that all the nodes from the previous generation of the network separately deterministically generated from the state, but which new nodes have to just trust. If you join the network during the new generation, you just download the new genesis, and so can’t “see back” past that point.) Just make the whole network do an automatic “network upgrade” every block — and keep all the state in-memory in the meantime — and now you’ve got a blockchain with forward secrecy. (To be clear: nobody’s done this yet.)
  - stjohnswarts 6y ago
    wouldn't mean there wouldn't be any rolling back by consensus since there is nothing to roll back in case of an issue? Wouldn't the software have to perfectly retain state in the present since it always deletes old transactions?
  - lottin 6y ago
stjohnswarts 6y ago
Monero has been shown to not be completely anonymous on more than one occasion despite the claims. It's not as safe as people say. It's better than bitcoin in that respect though.

It's anonymous with some caveats. The transaction graph is still there, it's just that there are decoy inputs/outputs which provides plausible deniability. However, over repeated transactions the plausible deniability weakens. ie. having an output to a darknet market in one of your transaction is easily explainable by bad luck, but it's present in several transactions it becomes suspicious enough that the police can start investigating you.

derefr 6y ago
This might be true of the particular decoy approach used with Monero, but I don’t think it’s true in general; e.g. with mixer/tumbler services. If every transaction that everyone does has some outputs to darknet markets (because they’re popular and high-volume), and some outputs to legitimate businesses (because they’re also popular and high-volume) then that really is reasonable doubt that any particular individual did anything bad. It’s like how you can’t charge someone with possession of cocaine because there’s cocaine on the US dollar bills in their pocket: there’s actually trace amounts of cocaine on every US dollar bill.
- Igelau 6y ago
  > If every transaction that everyone does has some outputs to darknet markets ... and some outputs to legitimate businesses ... then that really is reasonable doubt that any particular individual did anything bad. It says that no particular individual made a Bad Guy payment, but that all of them facilitated it by providing cover noise.
  - derefr 6y ago
    Are you facilitating a Bad Guy payment if you use a bank that the Bad Guy also uses?
- gruez 6y ago
  >If every transaction that everyone does has some outputs to darknet markets (because they’re popular and high-volume), and some outputs to legitimate businesses (because they’re also popular and high-volume) then that really is reasonable doubt that any particular individual did anything bad. The problem is that transacting with a darknet market will still bring your illicit output % above average. Right now monero has 10 decoy outputs per transaction. If the proportion of illicit addresses to legitimate addresses were 50%-50%, then a legitimate transaction would have an average of 5 illicit outputs but a illicit transaction would have an average of 6 illicit outputs. The same applies to inputs. The difference between 5 and 6 might be small enough to be indistinguishable from background noise, but that result is heavily dependent on the proportion of illicit vs legitimate address. If the proportion is something like 95%-5%, then the difference would be 0.5 vs 1.5, which is significant. I won't bother to do the probability calculations for this, but I'm going to estimate you can get to 95% certainty within 10 transactions. >It’s like how you can’t charge someone with possession of cocaine because there’s cocaine on the US dollar bills in their pocket: there’s actually trace amounts of cocaine on every US dollar bill. The interesting bit is that they don't have to charge you based on that alone. If they're 80% sure you bought illegal drugs, they'll either get a warrant to search your house or perform surveillance on you and wait for you to slip up.
  - derefr 6y ago
    I get what you mean, I think — you’re talking about traffic fingerprinting. But you can use the same anti-traffic-analysis techiques used elsewhere in systems like Tox. For example, the darknet market itself could use some of its revenue to pay for “noise transactions” (wash transfers through the mixer, then intentionally “black-laundered” in the market) to keep the number of darknet-market-spent outputs constant per mixer step, by asking for advance notice from buyers for when transfers targeted at their sellers will happen, and then running N fewer “noise transactions” during the appropriate mixer steps. Though also, you’re assuming a constant “your account” in the above. If you mix 100% of your holdings every time you transact, setting it so that a set amount goes to a darknet market, and the rest goes back to a newly-created public-key-hash that you just generated the keypair for — and then when you want to use money from that address, you fully consume it to mix it again — then nobody ever gets the opportunity to fingerprint “your” traffic. There’s no stable “you.” (I have a theory that this is the goal Satoshi was aiming at with Bitcoin UXTOs, but never finished that element of the design, and launched it half-baked.) This also means that the mixer gets to eat a percentage fee off of your complete holdings every transaction, so it kind of sucks, but what can you do.
qqii 6y ago
This isn't the case, monero employs stealth addresses so there is no way to tell who the recipient is just just by observing the blockchain.

acdha 6y ago

That’s the hope but remember that it’s irrevocable: you’re gambling that they got the implementation perfect, the network is operated securely without practical side channels or timing analysis, no unrecognized attacks will become practical, and that your clients will not have any bugs or backdoors — for the rest of your life!

lottin 6y ago

Blockchains and privacy are antithetical. The whole purpose of a blockchain is to keep track of transactions so that everyone knows how many coins everyone else has in order to prevent double-spending. You can try to achieve anonymity through obscurity but this will never work in principle or in practice.

kjjjjjjjjjjjjjj 6y ago
Sure, this applies for bitcoin, because bitcoin is legacy technology and has no features or utility. Monero does not work like bitcoin https://steemit.com/monero/@sgp/7yjqso-a-monero-introduction-for-beginners https://steemit.com/monero/@sgp/7yjqso-a-monero-introduction...
derefr 6y ago
The process of reaching consensus on the current state doesn’t have to involve reaching consensus on the past state for all participants. A blockchain can be built such that all historical previous state + the txs required to get to those historical states are discarded after a quorum of nodes reach consensus on it, leaving only the current state. (This is basically what already happens if you do a “network version upgrade” on a Cosmos-based network: everyone keeps their balances, but just in the form of a new genesis block that all the nodes from the previous generation of the network separately deterministically generated from the state, but which new nodes have to just trust. If you join the network during the new generation, you just download the new genesis, and so can’t “see back” past that point.) Just make the whole network do an automatic “network upgrade” every block — and keep all the state in-memory in the meantime — and now you’ve got a blockchain with forward secrecy. (To be clear: nobody’s done this yet.)
- stjohnswarts 6y ago
  wouldn't mean there wouldn't be any rolling back by consensus since there is nothing to roll back in case of an issue? Wouldn't the software have to perfectly retain state in the present since it always deletes old transactions?
- lottin 6y ago

stjohnswarts 6y ago

Monero has been shown to not be completely anonymous on more than one occasion despite the claims. It's not as safe as people say. It's better than bitcoin in that respect though.