Comment by codethief | Hacker News Reader

Comment by codethief | Hacker News Reader

Parent Full thread

Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say:

> Is it possible to compromise the protocol and find out information about depositors? -- No, Tornado Cash is a decentralized protocol based on zero knowledge proofs. Its smart contracts are immutable, have no admins, and the proofs are based on strong cryptography. Only the user possessing the Note is able to link deposit and withdrawal.

That very much sounds like an impossibility statement like "Use Tornado Cash and no one will be able to trace your transaction".

OTOH, they also say that

> After depositing, users should wait some amount of time before withdrawing to improve their privacy.

and that

> To preserve privacy a relayer can be used to withdraw to an address with no ETH balance.

So it seems privacy is not a binary switch here and, instead, it can be "improved" and "preserved". But what is it then? Can deposit and withdrawal be linked or not? Are the privacy guarantees as absolute and strong as the FAQ make them out to be?

It's a coin mixer: you deposit ETH into a common pool shared with a bunch of other people, and you get back (off-chain) a code that can be used to redeem your deposit at a later date. Since there is no link between the code and the sender on-chain, nobody knows which contributor to the pool withdrew.

So if there are N deposits then later N withdrawals, the only thing you know is that each withdrawal matches one of the deposits, but not which one.

As for privacy improvements:

- If you deposit then immediately withdraw, observers might suspect that you instantly withdrew your deposit.

- You need ETH for the withdrawal transaction, which has to come from somewhere (making it potentially traceable). With their relayers you can withdraw to an empty account while hiding the origin of the transaction fee.

> the only thing you know is that each withdrawal matches one of the deposits, but not which one.

If there were e.g. three deposits for 5.542, 3.799, and 10.4322 ETH, and someone withdrew 3.799 ETH, then it seems like you'd know which deposit they made.

Best case, you wait long enough and maybe someone else deposits 3.799 ETH.

That is why they have a few standard sizes.

It only lets you use fixed multiples for this reason (0.1, 1, 10, etc.). You can reasonably narrow it down as the amounts get higher, though.

I wonder if it could be argued in court that use of such a system makes you party to a conspiracy.

If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain.

It might not be evidence that A and B are your addresses, but strong implications.

So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.

I wonder what would be a legitimate, non-suspicious reason to interact with such a service at all?

There are entirely legal, legitimate things one might do while still wanting to have some privacy about it. Buying porn, for example, might be something you're fine with but not really want tied to your known address.

Even things like buying houses (and I have heard of people buying houses with ETH).

People generally like privacy when it comes to medium and large purchases, regardless of what it is that they are purchasing.

It would be illegal to anonymously buy property in the UK. https://www.gov.uk/government/publications/how-to-buy-a-home...

> People generally like privacy when it comes to medium and large purchases

The "war on money laundering" goes against this.

https://www.cbsnews.com/news/pandora-papers-uk-real-estate-h...

> But the recent Pandora Papers leak has revealed that U.K. properties worth nearly $5.5 billion, according to those who've analyzed the documents, have been purchased through offshore shell companies that hide the owners' identities.

> "Using a shell company means that no one need ever know that the asset is yours," said anti-corruption activist Duncan Hames, Director of Policy at Transparency International. "Indeed, the British government probably doesn't know."

All transactions are public.

People can simply crawl the blockchain for addresses that have a good amount of money and then check which of them they can relate to persons.

If they know you and how much your crypto net worth is, they might start to attack you in some kind of way to get your private key.

If you tornadoed that money in an address that can't be linked to other addresses anymore, the work to relate the address to you might be too big so people won't try.

A very legitimate use is if you have a public .eth address but want to keep your remaining private addresses private. Privacy is security.

If I am not mistaken, the mixer has function to define how much you want to get out and on which address so 123 in from address 1, 100 out to address 2, 10 out to address 3, 13 out to address 4, if there is 1000 transactions daily, it gets a bit messy to match input and output. Only real issue would be if you deposit 10k ETH to pool with 100ETH, then it would be hard to go unnoticed

Edit: HN destroyed formatting

I fail to see the contradiction. All they claim is that the protocol is secure.

It obviously cannot prevent you from revealing your transaction via other means. For example, by publicly announcing it.

Reply on news.ycombinator.com