4 ms·

Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say: > Is it possible to compromise the protocol and find out information

Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say: > Is it possible to compromise the protocol and find out information about depositors? -- No, Tornado Cash is a decentralized protocol based on zero knowledge proofs. Its smart contracts are immutable, have no admins, and the proofs are based on strong cryptography. Only the user possessing the Note is able to link deposit and withdrawal. That very much sounds like an impossibility statement like "Use Tornado Cash and no one will be able to trace your transaction". OTOH, they also say that > After depositing, users should wait some amount of time before withdrawing to improve their privacy. and that > To preserve privacy a relayer can be used to withdraw to an address with no ETH balance. So it seems privacy is not a binary switch here and, instead, it can be "improved" and "preserved". But what is it then? Can deposit and withdrawal be linked or not? Are the privacy guarantees as absolute and strong as the FAQ make them out to be?

MauranKilom 5y ago
I fail to see the contradiction. All they claim is that the protocol is secure. It obviously cannot prevent you from revealing your transaction via other means. For example, by publicly announcing it.
k__ 5y ago
If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain. It might not be evidence that A and B are your addresses, but strong implications. So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.
- Nextgrid 5y ago
  I wonder what would be a legitimate, non-suspicious reason to interact with such a service at all?
  - ceejayoz 5y ago
    There are entirely legal, legitimate things one might do while still wanting to have some privacy about it. Buying porn, for example, might be something you're fine with but not really want tied to your known address.
    - garbagetime 5y ago
      Even things like buying houses (and I have heard of people buying houses with ETH). People generally like privacy when it comes to medium and large purchases, regardless of what it is that they are purchasing.
      - pjc50 5y ago
        It would be illegal to anonymously buy property in the UK. https://www.gov.uk/government/publications/how-to-buy-a-home/how-to-buy#id-checks https://www.gov.uk/government/publications/how-to-buy-a-home... > People generally like privacy when it comes to medium and large purchases The "war on money laundering" goes against this.
        ceejayoz 5y ago
        https://www.cbsnews.com/news/pandora-papers-uk-real-estate-hiding-assets-shell-companies-corruption/ https://www.cbsnews.com/news/pandora-papers-uk-real-estate-h... > But the recent Pandora Papers leak has revealed that U.K. properties worth nearly $5.5 billion, according to those who've analyzed the documents, have been purchased through offshore shell companies that hide the owners' identities. > "Using a shell company means that no one need ever know that the asset is yours," said anti-corruption activist Duncan Hames, Director of Policy at Transparency International. "Indeed, the British government probably doesn't know."
  - k__ 5y ago
    All transactions are public. People can simply crawl the blockchain for addresses that have a good amount of money and then check which of them they can relate to persons. If they know you and how much your crypto net worth is, they might start to attack you in some kind of way to get your private key. If you tornadoed that money in an address that can't be linked to other addresses anymore, the work to relate the address to you might be too big so people won't try.
- i_like_waiting 5y ago
  If I am not mistaken, the mixer has function to define how much you want to get out and on which address so 123 in from address 1, 100 out to address 2, 10 out to address 3, 13 out to address 4, if there is 1000 transactions daily, it gets a bit messy to match input and output. Only real issue would be if you deposit 10k ETH to pool with 100ETH, then it would be hard to go unnoticed Edit: HN destroyed formatting
norswap 5y ago
It's a coin mixer: you deposit ETH into a common pool shared with a bunch of other people, and you get back (off-chain) a code that can be used to redeem your deposit at a later date. Since there is no link between the code and the sender on-chain, nobody knows which contributor to the pool withdrew. So if there are N deposits then later N withdrawals, the only thing you know is that each withdrawal matches one of the deposits, but not which one. As for privacy improvements: - If you deposit then immediately withdraw, observers might suspect that you instantly withdrew your deposit. - You need ETH for the withdrawal transaction, which has to come from somewhere (making it potentially traceable). With their relayers you can withdraw to an empty account while hiding the origin of the transaction fee.
- generalizations 5y ago
  > the only thing you know is that each withdrawal matches one of the deposits, but not which one. If there were e.g. three deposits for 5.542, 3.799, and 10.4322 ETH, and someone withdrew 3.799 ETH, then it seems like you'd know which deposit they made. Best case, you wait long enough and maybe someone else deposits 3.799 ETH.
  - dannyw 5y ago
    That is why they have a few standard sizes.
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
  - okwubodu 5y ago
    It only lets you use fixed multiples for this reason (0.1, 1, 10, etc.). You can reasonably narrow it down as the amounts get higher, though.
- numbsafari 5y ago
  I wonder if it could be argued in court that use of such a system makes you party to a conspiracy.

MauranKilom 5y ago

I fail to see the contradiction. All they claim is that the protocol is secure. It obviously cannot prevent you from revealing your transaction via other means. For example, by publicly announcing it.

k__ 5y ago

If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain. It might not be evidence that A and B are your addresses, but strong implications. So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.

Nextgrid 5y ago
I wonder what would be a legitimate, non-suspicious reason to interact with such a service at all?
- ceejayoz 5y ago
  There are entirely legal, legitimate things one might do while still wanting to have some privacy about it. Buying porn, for example, might be something you're fine with but not really want tied to your known address.
  - garbagetime 5y ago
    Even things like buying houses (and I have heard of people buying houses with ETH). People generally like privacy when it comes to medium and large purchases, regardless of what it is that they are purchasing.
    - pjc50 5y ago
      It would be illegal to anonymously buy property in the UK. https://www.gov.uk/government/publications/how-to-buy-a-home/how-to-buy#id-checks https://www.gov.uk/government/publications/how-to-buy-a-home... > People generally like privacy when it comes to medium and large purchases The "war on money laundering" goes against this.
      - ceejayoz 5y ago
        https://www.cbsnews.com/news/pandora-papers-uk-real-estate-hiding-assets-shell-companies-corruption/ https://www.cbsnews.com/news/pandora-papers-uk-real-estate-h... > But the recent Pandora Papers leak has revealed that U.K. properties worth nearly $5.5 billion, according to those who've analyzed the documents, have been purchased through offshore shell companies that hide the owners' identities. > "Using a shell company means that no one need ever know that the asset is yours," said anti-corruption activist Duncan Hames, Director of Policy at Transparency International. "Indeed, the British government probably doesn't know."
- k__ 5y ago
  All transactions are public. People can simply crawl the blockchain for addresses that have a good amount of money and then check which of them they can relate to persons. If they know you and how much your crypto net worth is, they might start to attack you in some kind of way to get your private key. If you tornadoed that money in an address that can't be linked to other addresses anymore, the work to relate the address to you might be too big so people won't try.
i_like_waiting 5y ago
If I am not mistaken, the mixer has function to define how much you want to get out and on which address so 123 in from address 1, 100 out to address 2, 10 out to address 3, 13 out to address 4, if there is 1000 transactions daily, it gets a bit messy to match input and output. Only real issue would be if you deposit 10k ETH to pool with 100ETH, then it would be hard to go unnoticed Edit: HN destroyed formatting

norswap 5y ago

It's a coin mixer: you deposit ETH into a common pool shared with a bunch of other people, and you get back (off-chain) a code that can be used to redeem your deposit at a later date. Since there is no link between the code and the sender on-chain, nobody knows which contributor to the pool withdrew. So if there are N deposits then later N withdrawals, the only thing you know is that each withdrawal matches one of the deposits, but not which one. As for privacy improvements: - If you deposit then immediately withdraw, observers might suspect that you instantly withdrew your deposit. - You need ETH for the withdrawal transaction, which has to come from somewhere (making it potentially traceable). With their relayers you can withdraw to an empty account while hiding the origin of the transaction fee.

generalizations 5y ago
> the only thing you know is that each withdrawal matches one of the deposits, but not which one. If there were e.g. three deposits for 5.542, 3.799, and 10.4322 ETH, and someone withdrew 3.799 ETH, then it seems like you'd know which deposit they made. Best case, you wait long enough and maybe someone else deposits 3.799 ETH.
- dannyw 5y ago
  That is why they have a few standard sizes.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- okwubodu 5y ago
  It only lets you use fixed multiples for this reason (0.1, 1, 10, etc.). You can reasonably narrow it down as the amounts get higher, though.
numbsafari 5y ago
I wonder if it could be argued in court that use of such a system makes you party to a conspiracy.