Hacker News Reader

Comment by bawolff | Hacker News Reader

Are they really any better? Zcash has performance issues resulting in fewer people using the private features (privacy is about blending into a crowd. Hard to do that if the crowd is small), dash sounds like a fancier version of normal bitcoin coin laundry. Monero is probably the best but still doesn't provide any math based garuntees, so it's hard to know what it really gives.

Then again, they dont need to provide privacy, just the preception thereof.

(I stopped paying attention to cryptocurrencies a while ago. My opinions may be outdated)

View on HN

In terms of protocols, not specific coins, privacy is clearly technically viable. Take Zcash: for its underlying protocol, known as sapling, the performance issues went away. It's about 2.5 seconds to make a fully private transaction on a pixel 3 and you could get it down to 1 second with some optimizations to the underlying circuit. As a coin, Zcash still has privacy adoption problems, but the roots of that aren't some fundamental technical issue: Zcash isn't focusing on usability, leading to the usage problems. That may change.

Also, there are a number of projects coming on line using the same privacy tech. Good privacy is feasible, we have the technical protocols. But product-market-fit niche isn't entirely there yet: the problem is few people grasp then need for on chain privacy yet.

There’s still the issue that you need to sync to the full history and look at all the outputs to see if they’re yours right? That’s a real challenge as a light client (which most people are).

For zcash currently, yes. But for the underling tech, no. You scan the blockchain in Zcash to be notified of a payment. But the sender could just as easily send you an out of band message with everything you need to know to spend the money and find the payment.

There's even a draft spec for doing it for Zcash. https://github.com/zcash/zips/pull/420/files#diff-635022fa4a...

Not in Mimblewimble coins where sender and receiver must interact to build a transaction. So there's no need to scan unless you just built a tx that is awaiting confirmation.

Privacy is a social problem just as much as it is a technical one. If it works in theory but in practise people don't adopt it properly, that means it doesn't work.

A very good point and one I've learned over the years with Zcash. But the social problems, maybe, can change: someone can launch a new coin that fixes them or an existing one can get its act together. Or maybe not.

But it's at least possible if the tech works. So I guess my view is: at least someone has a shot.

> In terms of protocols, not specific coins, privacy is clearly technically viable.

Can you provide some link to back this up? I am genuinely interested because in principle public ledgers and privacy seem to be antithetic to one another.

https://elementsproject.org/features/confidential-transactio...

Here's Greg Maxwell (one of the Bitcoin core team members) explaining the confidential transactions.

https://crypto.stanford.edu/bulletproofs/

Here's an optimization used in Monero that optimizes the ledger size (initial confidential transaction proofs were too large).

You can have a public ledger but all of the data in it is encrypted and verifiable.

Each transaction, from the creation, to validation has its amounts and wallet ids hidden, the sender and the receiver cannot know anything about wallet contents of each other and receiver has no idea from where the sender is sourcing the coins.

OK, you and I exchanging coins do not know about each other's wallets or even the origin & destination of our transaction.

This anonymity depends on encryption to hide the wallets & transaction, and decryption to verify it, and for the receiver to be able to use the funds in the future.

So, who/what controls those keys? Seems they've just exchanged an open ledger problem for a key management problem - why is this not the case?

The keys are yours. The maths is here https://elementsproject.org/features/confidential-transactio...

The key insight is that you design a cryptographic algorithm that will preserve addition between amounts, even when encrypted but you need to also provide some encrypted data that will allow an independent verifier to validate the whole transaction.

The problem is more nuanced because you need to guarantee that coins aren't produced from thin air.

The problem of the approach in the linked article is that proofs are large. To support encrypted verification (there is no need to decrypt anything in any step of the process) you need thousands of bytes for verifying a 32-bit amount.

Bulletproofs reduced the proof size significantly. There are then additional approaches like MimbleWimble where the proofs on the ledger can be discarded to make it even smaller.

To be honest, I don't see any maths. I see a document titled "investigation" which contains a bibliography consisting of a single forum post from 2013 by someone named Adam, and then the author goes on saying that he has invented some maths that allegedly would allow confidential transactions. Forgive me if I'm a bit sceptical... better wait until some experts review this material.

https://crypto.stanford.edu/bulletproofs/

Start reading this paper above then, it goes from the simplest form to data optimized form.

Sure. Starting from the academic beginning and then going to commercial usage: Zerocash[0], a paper from 2014 (I'm an author on it), proposes using zksnarks to get a public ledger + privacy with no centralized parties. Instead of identifying the origin of your money on the blockchain and moving it to someone, you just prove in zero-knowledge your payment is correct. This showed strong privacy on a public blockchain was feasible. But slow (2 minutes per payment IIRC)

Three years and much work by others later, it takes ~2 to 3 seconds on a Pixel three to make a zk-proof for a payment. This can be optimized down to 1 second fairly easily (on that you have only my assertion currently)

This is commercially deployed in Zcash (the above mentioned coin with usability and adoption issues), a few other straight up forks, and a new coin called IronFish. And related protocols are in a few things on Ethereum (e.g., Aztec). If you want to test performance numbers, you can download one of these systems and try it yourself (Nighthawk is a decent mobile wallet for Zcash)

Current technical objections (again, beyond criticisms of Zcash as a coin itself) 1) Current ZK proofs require trusted setup. New ZK proofs developed by engineers at Zcash removed this[1]. So its not longer an issue for the technology (or for Zcash once it's deployed)

2) you have to scan the blockchain to get notified of payments. No, this happens to be how Zcash does it. As I said in a separate comment, it's easy to send payment notifications out of band.

3) Vague objections about "scale." Even though zksnarks take a second or two to prove, they are very fast to verify. So adding privacy doesn't make blockchain's scaling problems worse. And the privacy tech is agnostic to the underlying consensus layer, so if you ever get a blockchain to scale, you can put privacy on it.

4) Other approaches(Monero/RingCt/Coinjoin) are better. The major problem is these don't offer strong privacy, just obfuscation. See [2] if you want a 20 minute talk on the issues or [3] for a blog post covering the same

5) There's an inflation risk. Yes, once you hide the values of a payment, because you want privacy, if the crypto breaks, things can go wrong. This is true of any serious approach to privacy. So you want to very carefully vet the crypto design. But if you don't hide payment values, you get no privacy and your blockchain is twitter for your bank account.

[0] https://www.cs.umd.edu/~imiers/pdf/zerocash-oakland2014.pdf [1]https://electriccoin.co/blog/technical-explainer-halo-on-zca... [2]https://www.youtube.com/watch?v=9s3EbSKDA3o [3]https://www.zfnd.org/blog/blockchain-privacy/

Opt-in privacy is a fundamental technical issue.

It is shown everywhere that it does not work. This due to human nature, timing analysis, lack of censorship resistance and lack of fungibility.

Is privacy feasible?

"Monero is probably the best but still doesn't provide any math based garuntees,"

Can you elaborate on why you say this and what you mean by it? From what i've seen no entities, including governments, have been able to crack Monero's privacy, so i'm pretty interested if there's an obvious flaw.

I do not know where they found the information to conclude there are no math based guarantees.

The initial version of Monero had a flaw but if you start transacting now I do not believe anyone can deanonymize wallet ids or amounts.

Even if there's a 51% takeover, those guys would just be able to mint new coins, they still wouldn't be able to see the amounts and wallet ids.

Also, confidential transactions and optimizations (bulletproofs) are math proven.

Zcash and Dash with their optional privacy just leave everyone vulnerable to deanonymization.

> privacy is about blending into a crowd. Hard to do that if the crowd is small

Hard to do that if the crowd is all criminals lol. I often say BTC is only used for speculation and crime. At least the criminals in BTC can hide among the speculators. Zcash and Monero are literally only used by criminals and a handful of die hard ancaps. That gives you nowhere to hide.

It's the equivalent of trying to cash out El Chapo Bux. Simple possession is enough to pretty much guarantee anyone looking you've been involved in one crime or another.

The thing about the law is, as Lavrentiy Beria (Stalin's head of the secret police) said, "You bring me the man, I'll find you the crime." Once someone's looking at you, it's too late.

This is crypto, almost all users are always going to be speculators even with monero.

Pretty much all countries still have presumption of innocence and a legal system

Except as privacy coins are delisted from exchanges more and more.

The ownership of the monero itself may be granted the presumption of innocence however if you have a bunch of El Chapo Bux they'll just start digging for other things.

Delistings are irrelevant and ineffective. Monero usage wouldnt be legally enough to start an investigation, by far most users really are just speculators

haha, of course it's enough to start an investigation. The police don't need probable cause to start an investigation. They need probable cause to obtain a warrant. Quite different. Remember, basically everything's a crime. The set of crimes in the US is actually uncountable (a few have tried). All you need to get convicted of something is to attract attention. I guarantee you've committed a handful of felonies today. [1]

[1] https://www.wsj.com/articles/SB10001424052748704471504574438...

Reply on news.ycombinator.com