5 ms·

Can you explain the entry/exit thing of monero? I always thought i’m fine when using monero, but never looked into what ring signatures imply.

tmoravec 4y ago
It's about how you purchase and sell it. If you sell Monero for USD on a centralised exchange, they might ask you for your ID, the source of the funds, source of the funds of your source of the funds (really!) and similar. AFAIK ring signatures hold. It's like a mixer on every transaction so trying to track more than a few transactions back, the complexity explodes.
pclmulqdq 4y ago
If you do BTC-XMR-BTC in a specific amount, you can get traced through that. Tornado cash is the same. All the exit points from Monero are non-anonymous, so you need to be careful that you don't enter and exit in ways that can be correlated.
- MerelyMortal 4y ago
  A relatable, simplified, example: If you withdraw $3858.28 from a bank under the name Alice, and then deposit $3858.28 in a different bank under the name Bob, and those two banks share data, then someone could reasonably say Alice and Bob are connected.
cowtools 4y ago
He may be referring to opsec more generally (onramps, offramps), or he may be specificially referring to poisoned output attacks: https://www.youtube.com/watch?v=iABIcsDJKyM https://www.youtube.com/watch?v=iABIcsDJKyM TL;DR Ring signatures, like all sender-obfuscation methods, have a limited anonymity set: it limits you to a pool of possible senders. If Alice frequently sends funds to Bob, who frequently sends funds to Carl, who frequently sends to Alice, she can see that Alice->Bob->Carl->Alice is one possible outcome. She does this because she can trace the coin she associates with Bob to a coin she associates with Carl. There is a ton of plausible deniability at first, but the relationship between Bob and Carl becomes more obvious the more Alice->Bob->Carl->Alice continues to happen. Alice can be multiple exchanges collaborating using KYC. How to resist poisoning: limit your risk, churn, bigger ring-size/anonymity set, do atomic swaps (this severs chain of ownership, but is not generally sybil-proof), do multi-output transactions if you are sending to multiple people at once who can co-ordinate (this reduces the number of coins they can co-ordinate).

tmoravec 4y ago

It's about how you purchase and sell it. If you sell Monero for USD on a centralised exchange, they might ask you for your ID, the source of the funds, source of the funds of your source of the funds (really!) and similar. AFAIK ring signatures hold. It's like a mixer on every transaction so trying to track more than a few transactions back, the complexity explodes.

pclmulqdq 4y ago

If you do BTC-XMR-BTC in a specific amount, you can get traced through that. Tornado cash is the same. All the exit points from Monero are non-anonymous, so you need to be careful that you don't enter and exit in ways that can be correlated.

MerelyMortal 4y ago
A relatable, simplified, example: If you withdraw $3858.28 from a bank under the name Alice, and then deposit $3858.28 in a different bank under the name Bob, and those two banks share data, then someone could reasonably say Alice and Bob are connected.

cowtools 4y ago

He may be referring to opsec more generally (onramps, offramps), or he may be specificially referring to poisoned output attacks: https://www.youtube.com/watch?v=iABIcsDJKyM https://www.youtube.com/watch?v=iABIcsDJKyM TL;DR Ring signatures, like all sender-obfuscation methods, have a limited anonymity set: it limits you to a pool of possible senders. If Alice frequently sends funds to Bob, who frequently sends funds to Carl, who frequently sends to Alice, she can see that Alice->Bob->Carl->Alice is one possible outcome. She does this because she can trace the coin she associates with Bob to a coin she associates with Carl. There is a ton of plausible deniability at first, but the relationship between Bob and Carl becomes more obvious the more Alice->Bob->Carl->Alice continues to happen. Alice can be multiple exchanges collaborating using KYC. How to resist poisoning: limit your risk, churn, bigger ring-size/anonymity set, do atomic swaps (this severs chain of ownership, but is not generally sybil-proof), do multi-output transactions if you are sending to multiple people at once who can co-ordinate (this reduces the number of coins they can co-ordinate).