4 ms·

In terms of protocols, not specific coins, privacy is clearly technically viable. Take Zcash: for its underlying protocol, known as sapling, the performance iss

In terms of protocols, not specific coins, privacy is clearly technically viable. Take Zcash: for its underlying protocol, known as sapling, the performance issues went away. It's about 2.5 seconds to make a fully private transaction on a pixel 3 and you could get it down to 1 second with some optimizations to the underlying circuit. As a coin, Zcash still has privacy adoption problems, but the roots of that aren't some fundamental technical issue: Zcash isn't focusing on usability, leading to the usage problems. That may change. Also, there are a number of projects coming on line using the same privacy tech. Good privacy is feasible, we have the technical protocols. But product-market-fit niche isn't entirely there yet: the problem is few people grasp then need for on chain privacy yet.

baby 6y ago
There’s still the issue that you need to sync to the full history and look at all the outputs to see if they’re yours right? That’s a real challenge as a light client (which most people are).
- ianmiers 6y ago
  For zcash currently, yes. But for the underling tech, no. You scan the blockchain in Zcash to be notified of a payment. But the sender could just as easily send you an out of band message with everything you need to know to spend the money and find the payment. There's even a draft spec for doing it for Zcash. https://github.com/zcash/zips/pull/420/files#diff-635022fa4a51619d899746b1d35f47790cbee665059c85d22cc12b64fd77c750 https://github.com/zcash/zips/pull/420/files#diff-635022fa4a...
- tromp 6y ago
  Not in Mimblewimble coins where sender and receiver must interact to build a transaction. So there's no need to scan unless you just built a tx that is awaiting confirmation.
bawolff 6y ago
Privacy is a social problem just as much as it is a technical one. If it works in theory but in practise people don't adopt it properly, that means it doesn't work.
- ianmiers 6y ago
  A very good point and one I've learned over the years with Zcash. But the social problems, maybe, can change: someone can launch a new coin that fixes them or an existing one can get its act together. Or maybe not. But it's at least possible if the tech works. So I guess my view is: at least someone has a shot.
  - deleted 6y ago
    [deleted]
lottin 6y ago
> In terms of protocols, not specific coins, privacy is clearly technically viable. Can you provide some link to back this up? I am genuinely interested because in principle public ledgers and privacy seem to be antithetic to one another.
- knuthsat 6y ago
  https://elementsproject.org/features/confidential-transactions https://elementsproject.org/features/confidential-transactio... Here's Greg Maxwell (one of the Bitcoin core team members) explaining the confidential transactions. https://crypto.stanford.edu/bulletproofs/ https://crypto.stanford.edu/bulletproofs/ Here's an optimization used in Monero that optimizes the ledger size (initial confidential transaction proofs were too large). You can have a public ledger but all of the data in it is encrypted and verifiable. Each transaction, from the creation, to validation has its amounts and wallet ids hidden, the sender and the receiver cannot know anything about wallet contents of each other and receiver has no idea from where the sender is sourcing the coins.
  - toss1 6y ago
    OK, you and I exchanging coins do not know about each other's wallets or even the origin & destination of our transaction. This anonymity depends on encryption to hide the wallets & transaction, and decryption to verify it, and for the receiver to be able to use the funds in the future. So, who/what controls those keys? Seems they've just exchanged an open ledger problem for a key management problem - why is this not the case?
    - knuthsat 6y ago
      The keys are yours. The maths is here https://elementsproject.org/features/confidential-transactions/investigation https://elementsproject.org/features/confidential-transactio... The key insight is that you design a cryptographic algorithm that will preserve addition between amounts, even when encrypted but you need to also provide some encrypted data that will allow an independent verifier to validate the whole transaction. The problem is more nuanced because you need to guarantee that coins aren't produced from thin air. The problem of the approach in the linked article is that proofs are large. To support encrypted verification (there is no need to decrypt anything in any step of the process) you need thousands of bytes for verifying a 32-bit amount. Bulletproofs reduced the proof size significantly. There are then additional approaches like MimbleWimble where the proofs on the ledger can be discarded to make it even smaller.
ajkdhcb2 6y ago
Opt-in privacy is a fundamental technical issue. It is shown everywhere that it does not work. This due to human nature, timing analysis, lack of censorship resistance and lack of fungibility.
MrMan 6y ago
Is privacy feasible?

baby 6y ago

There’s still the issue that you need to sync to the full history and look at all the outputs to see if they’re yours right? That’s a real challenge as a light client (which most people are).

ianmiers 6y ago
For zcash currently, yes. But for the underling tech, no. You scan the blockchain in Zcash to be notified of a payment. But the sender could just as easily send you an out of band message with everything you need to know to spend the money and find the payment. There's even a draft spec for doing it for Zcash. https://github.com/zcash/zips/pull/420/files#diff-635022fa4a51619d899746b1d35f47790cbee665059c85d22cc12b64fd77c750 https://github.com/zcash/zips/pull/420/files#diff-635022fa4a...
tromp 6y ago
Not in Mimblewimble coins where sender and receiver must interact to build a transaction. So there's no need to scan unless you just built a tx that is awaiting confirmation.

bawolff 6y ago

Privacy is a social problem just as much as it is a technical one. If it works in theory but in practise people don't adopt it properly, that means it doesn't work.

ianmiers 6y ago
A very good point and one I've learned over the years with Zcash. But the social problems, maybe, can change: someone can launch a new coin that fixes them or an existing one can get its act together. Or maybe not. But it's at least possible if the tech works. So I guess my view is: at least someone has a shot.
- deleted 6y ago
  [deleted]

lottin 6y ago

> In terms of protocols, not specific coins, privacy is clearly technically viable. Can you provide some link to back this up? I am genuinely interested because in principle public ledgers and privacy seem to be antithetic to one another.

knuthsat 6y ago
https://elementsproject.org/features/confidential-transactions https://elementsproject.org/features/confidential-transactio... Here's Greg Maxwell (one of the Bitcoin core team members) explaining the confidential transactions. https://crypto.stanford.edu/bulletproofs/ https://crypto.stanford.edu/bulletproofs/ Here's an optimization used in Monero that optimizes the ledger size (initial confidential transaction proofs were too large). You can have a public ledger but all of the data in it is encrypted and verifiable. Each transaction, from the creation, to validation has its amounts and wallet ids hidden, the sender and the receiver cannot know anything about wallet contents of each other and receiver has no idea from where the sender is sourcing the coins.
- toss1 6y ago
  OK, you and I exchanging coins do not know about each other's wallets or even the origin & destination of our transaction. This anonymity depends on encryption to hide the wallets & transaction, and decryption to verify it, and for the receiver to be able to use the funds in the future. So, who/what controls those keys? Seems they've just exchanged an open ledger problem for a key management problem - why is this not the case?
  - knuthsat 6y ago
    The keys are yours. The maths is here https://elementsproject.org/features/confidential-transactions/investigation https://elementsproject.org/features/confidential-transactio... The key insight is that you design a cryptographic algorithm that will preserve addition between amounts, even when encrypted but you need to also provide some encrypted data that will allow an independent verifier to validate the whole transaction. The problem is more nuanced because you need to guarantee that coins aren't produced from thin air. The problem of the approach in the linked article is that proofs are large. To support encrypted verification (there is no need to decrypt anything in any step of the process) you need thousands of bytes for verifying a 32-bit amount. Bulletproofs reduced the proof size significantly. There are then additional approaches like MimbleWimble where the proofs on the ledger can be discarded to make it even smaller.

ajkdhcb2 6y ago

Opt-in privacy is a fundamental technical issue. It is shown everywhere that it does not work. This due to human nature, timing analysis, lack of censorship resistance and lack of fungibility.

MrMan 6y ago

Is privacy feasible?