Hacker News Reader

Hacker News

Comment by pclmulqdq | Hacker News Reader

Parent Full thread

pclmulqdq

As far as I know, the state of crypto privacy is that everything is directly traceable except:

* Bitcoin lightning transactions when the lightning nodes involved are trusted to not keep logs

* Transactions through mixers with a lot of users

* Monero transactions

* Zcash private transactions

And everything is de-facto traceable except:

* Tornado cash users who use standard-size amounts (or users of another equivalently large smart-contract-based mixer)

* Monero users who are careful about their entry/exit

Zcash privacy doesn't have enough users for anonymity, most mixers are too small, and lightning users generally use nodes from exchanges which do log a lot of information that isn't kept on chain.

Am I missing anything? This seems kind of bad for cryptocurrencies in general if everything is basically traceable.

View on HN

Satoshi's largest error was not making Bitcoin private by default and it strikes me as out of character given his/her level of commitment to being anonymous.

I don’t recall why that decision was made, but there could be a couple reasons.

First, it isn’t easy technically. Especially back when you’re designing the very first decentralized cryptocurrency and have no prior experience informing your design. ZCash, Monero, MimbleWimble and others came later after learning from Bitcoin, and there’s zero chance they could have come first.

Second, shielded transactions risk undetected inflation bugs, which actually happened to ZCash some years ago.

Third, Bitcoin was designed shortly after the Liberty Dollar founder was arrested and jailed, and everyone in Bitcoin was concerned about that too, including Satoshi. He may have decided just not to push his luck.

Let's not speculate:

https://satoshi.nakamotoinstitute.org/quotes/privacy/

https://bitcointalk.org/index.php?topic=770

It seems like satoshi thought pseudo-anonyminity was sufficient. The integration of zero-knowlege proofs into cryptocurrencies was not really well understood at the time.

Quit it with this revisionist history nonsense, your second link contains where Satoshi specifically mentioned that a ZK-based version of bitcoin would be better, he just didn't know how to do it: https://bitcointalk.org/index.php?topic=770.msg8637#msg8637

I wouldn't call it revisionist, he's referencing the source.

Thanks, I knew there were discussions of it back then on bitcointalk and probably bitcoin wizards irc, just not where to find them. The bitcointalk thread seems to confirm #1 - it was just technically difficult to do back then.

So is it safe to say Monero is a sort of Bitcoin 2.0? I mean if Bitcoin had 'versions' that would be great. Then we wouldn't have to invent entirely new cryptocurrencies, we could just iterate on existing ones, and have our userbase intact without having to 'gain traction' for an entirely new alt-coin.

I suppose the monero userbase has similar attitudes as the early bitcoin userbase, but monero/cryptonote is not a bitcoin fork in the same sense that zcash/zerocoin is.

>we could just iterate on existing ones, and have our userbase intact without having to 'gain traction' for an entirely new alt-coin.

I think there are some fundamental limits to the throughput of a single cryptocurrency due to network latency and bandwidth. Perhaps the solution to scalability is simply to have multiple cryptocurrencies and to facilitate atomic swaps between them. So in this sense, the creation of new cryptocurrencies with minor feature changes (litecoin, bitcoin cash, wownero, cheapeth, etc.) is actually good for network diversity.

That being said, the owners of existing "big" cryptocurrencies will usually want to make changes that increase its usability to compete with these "trivial forks"

Bitcoiners have been soured by the idea of a hard fork since the XT dispute, while the monero userbase has commited itself to regular hard forks every 6 months to upgrade the network.

No; Monero is not an improved Bitcoin; it just makes different tradeoffs [1].

[1] https://phyro.github.io/grinvestigation/why_grin.html

many cryptocurrencies do have 'versions' of a sort. See ethereum's recent one known as "the merge" which moved that currency to a completely different consensus algorithm!

He wanted to, but blockspace-efficient privacy cryptography wasn't discovered back then.

its not an error or oversight but a feature.

Being anonymous to the 'Real world' but carry an identity in the "BTC world". Wallets, mining, interactions are all public within the network and significantly contributed to it's 'Community', 'make btc wallet size go up', and increase account nonce with use.

Early in the community, these metrics where your 'leaderboards'.

BTC never was anonymous, but rather a 'seperate idenitity'.

Dude, he was the inventor of cryptocurrency, did you except him to get everything right at once.

"Alexander Graham Bell's largest error was to not build end-to-end encryption by default in the telephone."

Bitcoin may not be private but it's pseudonymous, multiple public keys per private key. I think if it had have been private though, it never would have taken off. The transparency and exploitability of blockchains is key to their success. Without Bitcoin & other prominent open source blockchain-based crypto-currencies and crypto-assets, private crypto-currencies and crypto-assets wouldn't stand up.

I couldn't disagree more. Without the silk road, bitcoin would have never taken off. monero has seemingly displaced bitcoin here.

The transparency of the ledger is key to the censorship, control, and abuse of the network.

>open source

Are you implying that the cryptonote/zerocoin projects like monero aren't open source?

Perhaps it was a tradeoff they knowingly made to not have it become illegal immediately.

Nope: https://bitcointalk.org/index.php?topic=770.msg8637#msg8637

No, it wasn't.

The BTC core team was highly concerned with the legality of the network due to previous failed currency's (eCash, B-money, Bit Gold, and Hashcash) that ended up driving certain decisions in architecture.

The original btc had a networked pokergame along with the wallet, but was taken out for a couple of reasons, including regulatory issues.

I'm not saying parent is right, or wrong but to dismiss it and to speak for the core team out of hand is folly.

Please share your reasoning - as the sibling comment mentions, there was a series of high profile online cash cases at the time, KYC being the biggest problem. It'd be weird if they didn't think hard about avoiding the same fate and perhaps this was they way they've chosen.

>Privacy for me, but not for thee

When using one’s own lightning node it doesn’t matter if individual nodes on the path to your destination node keep logs, they can’t collect much information besides who the last and next node are in the route. The original and final destination (as well as any other useful payment information) are obscured through onion routing and the information you can learn from traffic analysis is limited and difficult to perform well.

If you use your own lightning node, the other nodes on the path to your destination can still tell which node the information came from, and that can be used to de-anonymize your transaction. If you are the only user of your lightning node, it is trivial for the next person in the chain to attribute transactions to you.

No they can't, that's the whole point of onion routing. The next hop doesn't know if the packet started with you or if you're just another node in the payment path.

Reference: https://github.com/lightning/bolts/blob/master/04-onion-rout...

A couple of other projects for privacy on ethereum: zk.money and railgun.ch Also dark.fi is a project that aims to produce easy-to-use developer tools for private transactions.

A doctor that is also interested in privacy and crypto - so interesting. Do you have a blog?

Seems about right. More users would use Tornado Cash if regulation was clear and allowed it. Zcash and Monero lack smart contracts which limits their use cases.

ZK based privacy was possible and working fine for many users through TC before the sanctions. Now it is risky as you may end up with locked funds or in jail for seeking privacy.

Edit: Should also mention Aztec and Aleo. These are working currently but in the same position that TC was before its sanctions. Hard to know what regulators will do as these tools allow for absolute privacy which is antithetical to the US government’s goals.

> More users would use Tornado Cash if regulation was clear and allowed it

This is simply not going to happen in the current anti-money-laundering environment. The US made Switzerland give up hiding money, they're not going to let some random geeks make trillions of dollars vanish.

>they're not going to let some random geeks make trillions of dollars vanish.

i've heard this sentiment conveyed in the crypto space since 2011... still waiting on this prophecy to come true.

Due to incompetence, profit motive or traitors to their country, who can tell the difference? (Paraphrasing Robespierre here)

In what way has this not come true? It isn’t random geeks getting rich off of crypto anymore it’s institutions

well... these institutions are a bunch of random geeks? Have you ever been to any of the crypto hackathons? From Jump Capital, to Parity It's a bunch of geeks who where obssesed with flipping on the grand exchange in runescape, got into crypto and are now adept at Rust, flipping bots and essoteric coding concepts like "Ownership".

Didn't US and FATF pressure other nations into giving up 'hiding money' through threats to cut them off from the US or partner financial systems? What happens if some coin and its developers have no interest in being connected to the US financial system -- it seems like then there would be limited ability to influence them and off/on ramps would still exist through criminal networks (and the mere presence of an on/off ramp lends USD/"X" pair value, even if the person using "X" doesn't use the ramp).

The blockchain does pose new questions about digital privacy rights. Cryptography that privatizes transactional flow of USDC tokens is indistinguishable from the same cryptography that privatizes transactional flow of digital assets.

Want to purchase an ENS name without corporations and the US government having clear knowledge of it? Too bad, the US government will not allow that. The privacy that we enjoy wish cash purchases will erode as we continue down the path of stripping away privacy in digital transactional systems.

how would funds be locked

Many who had USDC on TC pools have had their assets frozen. Others might have a hard time sending or receiving these assets to typical US-based services because they will be hesitant to touch anything that has been through TC.

USDC has a block list in the smart contract. Other possibilities include validator block lists, and of course exchanges.

Can you explain the entry/exit thing of monero? I always thought i’m fine when using monero, but never looked into what ring signatures imply.

It's about how you purchase and sell it. If you sell Monero for USD on a centralised exchange, they might ask you for your ID, the source of the funds, source of the funds of your source of the funds (really!) and similar.

AFAIK ring signatures hold. It's like a mixer on every transaction so trying to track more than a few transactions back, the complexity explodes.

He may be referring to opsec more generally (onramps, offramps), or he may be specificially referring to poisoned output attacks: https://www.youtube.com/watch?v=iABIcsDJKyM

TL;DR Ring signatures, like all sender-obfuscation methods, have a limited anonymity set: it limits you to a pool of possible senders. If Alice frequently sends funds to Bob, who frequently sends funds to Carl, who frequently sends to Alice, she can see that Alice->Bob->Carl->Alice is one possible outcome. She does this because she can trace the coin she associates with Bob to a coin she associates with Carl. There is a ton of plausible deniability at first, but the relationship between Bob and Carl becomes more obvious the more Alice->Bob->Carl->Alice continues to happen.

Alice can be multiple exchanges collaborating using KYC.

How to resist poisoning: limit your risk, churn, bigger ring-size/anonymity set, do atomic swaps (this severs chain of ownership, but is not generally sybil-proof), do multi-output transactions if you are sending to multiple people at once who can co-ordinate (this reduces the number of coins they can co-ordinate).

If you do BTC-XMR-BTC in a specific amount, you can get traced through that. Tornado cash is the same. All the exit points from Monero are non-anonymous, so you need to be careful that you don't enter and exit in ways that can be correlated.

A relatable, simplified, example: If you withdraw $3858.28 from a bank under the name Alice, and then deposit $3858.28 in a different bank under the name Bob, and those two banks share data, then someone could reasonably say Alice and Bob are connected.

The category of risk I'd add is that a public ledger means you have to also consider the odds of future improvements — for example, if someone else's data leak contributes some information about a set of transactions[1] or the analysis tools get more sophisticated then people who thought they were secure at the time might turn out not to be. This seems like a fairly risky gamble versus simply not publishing a detailed transaction log.

1. e.g. what happens if a large exchange's records leak / are subpoenaed, a criminal group being compromised by law enforcement, etc. means that a fair fraction of a mixer's transaction volume at a particular time can be identified, making it easier to focus on the remainder?

> Am I missing anything?

Bitcoin transactions that use CoinJoin (e.g. Wasabi Wallet). https://en.bitcoinwiki.org/wiki/CoinJoin

It's been a couple of years, but I thought Chainalysis said they could break CoinJoin.

A 2020 Europol (European Cybercrime Center) report seemed to think it was effective[0]:

> is a very effective decentralised Bitcoin mixer with many privacy-focused options

> provides possibly the most convenient and secure way to mix Bitcoins

[0] https://www.tbstat.com/wp/uploads/2020/06/Europol-Wasabi-Wal...

They also say they can trace Monero, so I don’t fully trust their statements.

Genuine question: is there a possibility that Monero is being monitored covertly?

It seems an obvious target to be a Trojan horse in the midst of criminals and tax-evaders.

It is possible but unlikely. It is likely that clearnet use of monero is monitored, for example. But in terms of security, monero users are very cautious. The code has been independently audited, and has generally succeeded where other cryptonote-based cryptocurrencies have taken fatal missteps.

I suspect that most monero black markets are taken down by sting operations. The black markets all have a limited shelf life and these days they tend to intentionally retire before getting "silk-roaded"

Secret Network has private transactions as well

aztec.network is a L2 for Ethereum that is private while still allowing interactions with (some) smart contracts on L1. It batches requests to them.

Similar tech to this could become standard on Ethereum L2s in the future after more optimisations.

I'm pretty sure withdraws from Ren darknodes are private as they come from the network itself and aren't correlates to your node.

Reply on news.ycombinator.com