5 ms·

Generally when this happens, I assume services allowed/permitted by the fed are backdoored to the fed's advantage. Monero could be an excellent example. It's t

Generally when this happens, I assume services allowed/permitted by the fed are backdoored to the fed's advantage. Monero could be an excellent example. It's the tech they they haven't backdoored that poses a threat to their surveillance/control model. Tech like Tornado.

nootropicat 4y ago
Exactly. Monero's ringct model is easy to break statistically given some resources. Fees aren't that high. It's practical for a state to know 75+% of spent outputs by a combination of exchange info exchange and spamming. In addition there's zero output privacy (meaning honeypot->suspect->exchange creates extremely strong links when repeated). Zcash is good, but not popular. Same for zk.money
- cantSpellSober 4y ago
  Can you explain more about how/why Zcash doesn't share a weakness that could be exploited given the resources of the state
  - nootropicat 4y ago
    The anonymity set is the best theoretically possible - everyone in the shielded set. It's the same for zk.money and tornado - the difference compared to tornado is that tornado has fixed amounts. There's no possible attack to deanonymize the full zero-knowledge model beyond the utilization of always existing metadata - which needs separate solutions for every such system. In practice, zcash doesn't have that many users, so the anonymity set isn't big, but that's a separate issue to technology. The question which one is better in practice right now is a more complex one. Even a perfect solution like zcash/zk.money is useless if (just a random number) only 3 people use it, and ringct with (again a random number) 100k separate people with roughly equal tx count would obviously win. My estimate is that tornado.cash is the most anonymous. Monero is hard to estimate because there's no way to know how many spent outputs are known to the American government and/or cooperating chain analysis companies. Is it <1%? Then it's probably second best. Is it 90%? Run away. Last but not least monero can be deanonymized retroactively by quantum computers. Tornado, zk.money and zcash can't - they can be robbed (monero can be robbed too, obviously) but that's a much better failure mode.
dougk16 4y ago
Another possibility is they want to keep eyes off tech that people would go to in droves if they outright banned it. They want to avoid the Streisand effect. Part of that play is indeed making people think it's already backdoored. There is a big push to promote that narrative. Whether it's true or not, who knows!

nootropicat 4y ago

Exactly. Monero's ringct model is easy to break statistically given some resources. Fees aren't that high. It's practical for a state to know 75+% of spent outputs by a combination of exchange info exchange and spamming. In addition there's zero output privacy (meaning honeypot->suspect->exchange creates extremely strong links when repeated). Zcash is good, but not popular. Same for zk.money

cantSpellSober 4y ago
Can you explain more about how/why Zcash doesn't share a weakness that could be exploited given the resources of the state
- nootropicat 4y ago
  The anonymity set is the best theoretically possible - everyone in the shielded set. It's the same for zk.money and tornado - the difference compared to tornado is that tornado has fixed amounts. There's no possible attack to deanonymize the full zero-knowledge model beyond the utilization of always existing metadata - which needs separate solutions for every such system. In practice, zcash doesn't have that many users, so the anonymity set isn't big, but that's a separate issue to technology. The question which one is better in practice right now is a more complex one. Even a perfect solution like zcash/zk.money is useless if (just a random number) only 3 people use it, and ringct with (again a random number) 100k separate people with roughly equal tx count would obviously win. My estimate is that tornado.cash is the most anonymous. Monero is hard to estimate because there's no way to know how many spent outputs are known to the American government and/or cooperating chain analysis companies. Is it <1%? Then it's probably second best. Is it 90%? Run away. Last but not least monero can be deanonymized retroactively by quantum computers. Tornado, zk.money and zcash can't - they can be robbed (monero can be robbed too, obviously) but that's a much better failure mode.

dougk16 4y ago

Another possibility is they want to keep eyes off tech that people would go to in droves if they outright banned it. They want to avoid the Streisand effect. Part of that play is indeed making people think it's already backdoored. There is a big push to promote that narrative. Whether it's true or not, who knows!