3 ms·

Exactly. Monero's ringct model is easy to break statistically given some resources. Fees aren't that high. It's practical for a state to know 75+% of spent outp

Exactly. Monero's ringct model is easy to break statistically given some resources. Fees aren't that high. It's practical for a state to know 75+% of spent outputs by a combination of exchange info exchange and spamming. In addition there's zero output privacy (meaning honeypot->suspect->exchange creates extremely strong links when repeated). Zcash is good, but not popular. Same for zk.money

cantSpellSober 4y ago
Can you explain more about how/why Zcash doesn't share a weakness that could be exploited given the resources of the state
- nootropicat 4y ago
  The anonymity set is the best theoretically possible - everyone in the shielded set. It's the same for zk.money and tornado - the difference compared to tornado is that tornado has fixed amounts. There's no possible attack to deanonymize the full zero-knowledge model beyond the utilization of always existing metadata - which needs separate solutions for every such system. In practice, zcash doesn't have that many users, so the anonymity set isn't big, but that's a separate issue to technology. The question which one is better in practice right now is a more complex one. Even a perfect solution like zcash/zk.money is useless if (just a random number) only 3 people use it, and ringct with (again a random number) 100k separate people with roughly equal tx count would obviously win. My estimate is that tornado.cash is the most anonymous. Monero is hard to estimate because there's no way to know how many spent outputs are known to the American government and/or cooperating chain analysis companies. Is it <1%? Then it's probably second best. Is it 90%? Run away. Last but not least monero can be deanonymized retroactively by quantum computers. Tornado, zk.money and zcash can't - they can be robbed (monero can be robbed too, obviously) but that's a much better failure mode.

cantSpellSober 4y ago

Can you explain more about how/why Zcash doesn't share a weakness that could be exploited given the resources of the state

nootropicat 4y ago
The anonymity set is the best theoretically possible - everyone in the shielded set. It's the same for zk.money and tornado - the difference compared to tornado is that tornado has fixed amounts. There's no possible attack to deanonymize the full zero-knowledge model beyond the utilization of always existing metadata - which needs separate solutions for every such system. In practice, zcash doesn't have that many users, so the anonymity set isn't big, but that's a separate issue to technology. The question which one is better in practice right now is a more complex one. Even a perfect solution like zcash/zk.money is useless if (just a random number) only 3 people use it, and ringct with (again a random number) 100k separate people with roughly equal tx count would obviously win. My estimate is that tornado.cash is the most anonymous. Monero is hard to estimate because there's no way to know how many spent outputs are known to the American government and/or cooperating chain analysis companies. Is it <1%? Then it's probably second best. Is it 90%? Run away. Last but not least monero can be deanonymized retroactively by quantum computers. Tornado, zk.money and zcash can't - they can be robbed (monero can be robbed too, obviously) but that's a much better failure mode.