[XMR] Monero - A secure, private, untraceable cryptocurrency

[Anon136]

It is anonymous for those who want, transparent for those who want (like regulators)

http://www.coinssource.com/monero-interview/

This is a scary thing to read. The jack of all trades will always be the master of none. Any one who makes transparent transactions reduces the anonymity of all other participants or forces them to pay a higher cost to regain the same level of protection. It imposes externalities on other actors. Anyone who wants transparent transactions can just go use bitcoin, there is no need to have a single network that does both when we have 2 networks, where each does one of the two. I hope this sentiment is not echoed by too many on the dev team.

Actually, that's an interesting bigger-picture question.

Is the network stronger if an anonymous technology is used for all transactions, where a fraction of them are deliberately made transparent;

or is the network stronger if BTC is used for transparent transactions and XMR/BBR/foo is used only for anonymous transactions?

My concern about the latter is guilt-by-association.  We know, for example, that the NSA archives permanently all encrypted data, but (publicly says) that it does not retain certain classes of unencrypted data.

One or two anonymous transactions per minute may be much more easily traced via traffic analysis than 1000 anonymous transactions per minute mixed together with 10 deanonymized transactions.  This is based, admittedly, on the assumption that people who don't carefully ask the question of whether they want anonymity will default to BTC.

We're working now to add better privacy features, like mandatory participation in anonymity sets, a proper I2P protocol for transaction submission to network nodes, and more elaborate methods of transferring funds that obfuscate transaction submission time to the network and transaction destinations.

Of course, if the NSA is sitting sniffing your personal packets off your network, there may not be a lot to help you at the current time. Other persons are working on some censorship free networks for the near future, and there are becoming better ways to enter the internet using physical cash. Privacy online is a difficult thing to achieve.

This is a very reassuring thing to read. Particularly this "mandatory participation in anonymity sets" i am very strongly in favor of. What sort of mixin minimums are you guys thinking of at this time? it seems like a mixin count of 2 or greater would probably get the job done well enough and be a good trade off where as mixin 1 is probably too low.

[tacotime]

This is a very reassuring thing to read. Particularly this "mandatory participation in anonymity sets" i am very strongly in favor of. What sort of mixin minimums are you guys thinking of at this time? it seems like a mixin count of 2 or greater would probably get the job done well enough and be a good trade off where as mixin 1 is probably too low.

We're trying to model deanonymizing attack vectors on the network right now with some math grads, but at least mixin >= 1.

[uvt9]

Current price and volume of BCN would be the best explanation for the behavior of some BCN butthurt in this very thread 

[Mumbles]

Whoever said that is either a complete idiot or a liar. Ethereum is a platform that can run autonomous corporations and even create other currencies on top of it. Monero is just a (quite nice) currency.

- Will ETH be a threat to Monero?

Peter Todd said "everything Ethereum can do, Bitcoin can copy it". This holds even "truer" with Monero.

I guess this answers your question.

[Mumbles]

I'll take that bet. How many XMR/BTC do you want to bet? And what type of DAC do we want to use as the basis for the bet?

But with Monero, I bet it will be much easier.

[digicoin]

Current price and volume of BCN would be the best explanation for the behavior of some BCN butthurt in this very thread 

BCN is dead. XMR is the de facto standard for CryptoNote coins just by looking at BCN/XMR parings on Poloniex (similar to [YourCoinHere]/BTC)

[Mumbles]

So...lets see if I understand this correctly...

1) You have a ton of alt coins already...but you want to borrow more
2) You have hundreds of thousands in transactions in poker but you can't affort $500 to $1200 worth of some other alt coins?
3) You have been trading for 7 months, yet don't have enough money for your trading.

Got it. Where can I send you money? I would like to be part of this right away!  

Hi,

  I have been day trading alts since January and have made a bot to do all my work.  I am not really interested in investing in any new coins as I already have too much in alts at the moment and not trading some of the more popular is also wasted money. 

  This is what I am offering anyone interested.  If you loan me your coins (I only need about 1-2BTC worth) I will use them to trade and give you 35% of profits from the coins.  Yes I understand that there will be a lot of people saying that this is a scam and so on and so forth but I have a lot of backing.  In the poker community I have done hundred of thousands of dollars in transactions with a flawless record and am fairly well known.  I just do not wish to invest anymore BTCs in alts that I do not know enough about.  I have also borrowed with interest (and paid back fully) about 100 BTCs for trading purposes when the volume was about 20x what it is now.

  If anyone is interested please PM me, the three coins I currently am not trading that I would be looking for are the following:

CLOAK
XMR
SYNC

  So please PM me if interested, if you post in this coin thread I may miss your post.

  Thanks

[jwinterm]

So...lets see if I understand this correctly...

1) You have a ton of alt coins already...but you want to borrow more
2) You have hundreds of thousands in transactions in poker but you can't affort $500 to $1200 worth of some other alt coins?
3) You have been trading for 7 months, yet don't have enough money for your trading.

Got it. Where can I send you money? I would like to be part of this right away!  

lols, my thoughts exactly Mumbles...why not just claim you're a nigerian prince who enjoys trading alts?

[fluffypony]

So...lets see if I understand this correctly...

1) You have a ton of alt coins already...but you want to borrow more
2) You have hundreds of thousands in transactions in poker but you can't affort $500 to $1200 worth of some other alt coins?
3) You have been trading for 7 months, yet don't have enough money for your trading.

Got it. Where can I send you money? I would like to be part of this right away!  

lol - he reminds me so much of this dude: https://bitcointalk.org/index.php?topic=642090.0

[fluffypony]

It is anonymous for those who want, transparent for those who want (like regulators)

http://www.coinssource.com/monero-interview/

This is a scary thing to read. The jack of all trades will always be the master of none. Any one who makes transparent transactions reduces the anonymity of all other participants or forces them to pay a higher cost to regain the same level of protection. It imposes externalities on other actors. Anyone who wants transparent transactions can just go use bitcoin, there is no need to have a single network that does both when we have 2 networks, where each does one of the two. I hope this sentiment is not echoed by too many on the dev team.

As dga has already pointed out, you don't want to create a scenario where guilt-by-association exists. Monero's privacy is a feature, but it's not the only feature.

David's quote is misleading, he didn't mean that regulators can magically peer into the blockchain and trace transactions. He meant that in a situation where you run a charity, for instance, you would publish the viewkey along with some form of per-tx signature so regulators concerned with ensuring charities are run appropriately can peek into your books and see your accounts. Another use-case could be for a company to let its accountants, bookkeepers, and exco have visibility on the account and on the movement of funds. Or a married couple that want a shared account.

Monero is private by default, transparent optional. The choice of whether privacy is relinquished for a particular wallet is the user's and the user's alone.

[dga]

Noodle, wolf0, or others who've hacked on CryptoNight -- did I capture the salient points in this, or would you change anything?

https://www.dropbox.com/s/3yoovsi0gk9n88a/cryptonight_tmp.pdf

(Figure showing the basic processing steps in the inner loop of CryptoNight).

[Joshuar]

It is anonymous for those who want, transparent for those who want (like regulators)

http://www.coinssource.com/monero-interview/

This is a scary thing to read. The jack of all trades will always be the master of none. Any one who makes transparent transactions reduces the anonymity of all other participants or forces them to pay a higher cost to regain the same level of protection. It imposes externalities on other actors. Anyone who wants transparent transactions can just go use bitcoin, there is no need to have a single network that does both when we have 2 networks, where each does one of the two. I hope this sentiment is not echoed by too many on the dev team.

As dga has already pointed out, you don't want to create a scenario where guilt-by-association exists. Monero's privacy is a feature, but it's not the only feature.

David's quote is misleading, he didn't mean that regulators can magically peer into the blockchain and trace transactions. He meant that in a situation where you run a charity, for instance, you would publish the viewkey along with some form of per-tx signature so regulators concerned with ensuring charities are run appropriately can peek into your books and see your accounts. Another use-case could be for a company to let its accountants, bookkeepers, and exco have visibility on the account and on the movement of funds. Or a married couple that want a shared account.

Monero is private by default, transparent optional. The choice of whether privacy is relinquished for a particular wallet is the user's and the user's alone.

I'm glad to see this. Having options is better than having none

[Anon136]

It is anonymous for those who want, transparent for those who want (like regulators)

http://www.coinssource.com/monero-interview/

This is a scary thing to read. The jack of all trades will always be the master of none. Any one who makes transparent transactions reduces the anonymity of all other participants or forces them to pay a higher cost to regain the same level of protection. It imposes externalities on other actors. Anyone who wants transparent transactions can just go use bitcoin, there is no need to have a single network that does both when we have 2 networks, where each does one of the two. I hope this sentiment is not echoed by too many on the dev team.

As dga has already pointed out, you don't want to create a scenario where guilt-by-association exists. Monero's privacy is a feature, but it's not the only feature.

David's quote is misleading, he didn't mean that regulators can magically peer into the blockchain and trace transactions. He meant that in a situation where you run a charity, for instance, you would publish the viewkey along with some form of per-tx signature so regulators concerned with ensuring charities are run appropriately can peek into your books and see your accounts. Another use-case could be for a company to let its accountants, bookkeepers, and exco have visibility on the account and on the movement of funds. Or a married couple that want a shared account.

Monero is private by default, transparent optional. The choice of whether privacy is relinquished for a particular wallet is the user's and the user's alone.

Doesnt this impose a cost on people who want privacy? Having some of the network activity revealed allows concerned entities to deduce other information more easily. For example say you have a ring signature with 2 parties and the other party reveals which input is his, now they have deduced who the other participant is (atleast they have deduced his pseudonym, still not a good thing). This means that inorder to regain their privacy, people who want privacy now have to use a higher mixin count to achieve the same thing.

It seems to me that, unless this evaluation is totally wrong, this charity should just use bitcoin.

[Brilliantrocket]

It is anonymous for those who want, transparent for those who want (like regulators)

http://www.coinssource.com/monero-interview/

This is a scary thing to read. The jack of all trades will always be the master of none. Any one who makes transparent transactions reduces the anonymity of all other participants or forces them to pay a higher cost to regain the same level of protection. It imposes externalities on other actors. Anyone who wants transparent transactions can just go use bitcoin, there is no need to have a single network that does both when we have 2 networks, where each does one of the two. I hope this sentiment is not echoed by too many on the dev team.

As dga has already pointed out, you don't want to create a scenario where guilt-by-association exists. Monero's privacy is a feature, but it's not the only feature.

David's quote is misleading, he didn't mean that regulators can magically peer into the blockchain and trace transactions. He meant that in a situation where you run a charity, for instance, you would publish the viewkey along with some form of per-tx signature so regulators concerned with ensuring charities are run appropriately can peek into your books and see your accounts. Another use-case could be for a company to let its accountants, bookkeepers, and exco have visibility on the account and on the movement of funds. Or a married couple that want a shared account.

Monero is private by default, transparent optional. The choice of whether privacy is relinquished for a particular wallet is the user's and the user's alone.

I'm glad to see this. Having options is better than having none

Actually it isn't, if you want a high degree of anonymity. The more transparent transactions you have, the more you undermine the anonymity of the non-transparent transactions.

[Anon136]

It is anonymous for those who want, transparent for those who want (like regulators)

http://www.coinssource.com/monero-interview/

This is a scary thing to read. The jack of all trades will always be the master of none. Any one who makes transparent transactions reduces the anonymity of all other participants or forces them to pay a higher cost to regain the same level of protection. It imposes externalities on other actors. Anyone who wants transparent transactions can just go use bitcoin, there is no need to have a single network that does both when we have 2 networks, where each does one of the two. I hope this sentiment is not echoed by too many on the dev team.

As dga has already pointed out, you don't want to create a scenario where guilt-by-association exists. Monero's privacy is a feature, but it's not the only feature.

David's quote is misleading, he didn't mean that regulators can magically peer into the blockchain and trace transactions. He meant that in a situation where you run a charity, for instance, you would publish the viewkey along with some form of per-tx signature so regulators concerned with ensuring charities are run appropriately can peek into your books and see your accounts. Another use-case could be for a company to let its accountants, bookkeepers, and exco have visibility on the account and on the movement of funds. Or a married couple that want a shared account.

Monero is private by default, transparent optional. The choice of whether privacy is relinquished for a particular wallet is the user's and the user's alone.

I'm glad to see this. Having options is better than having none

Actually it isn't, if you want a high degree of anonymity. The more transparent transactions you have, the more you undermine the anonymity of the non-transparent transactions.

Yes this is what I am thinking. This talk worries me greatly.

[fluffypony]

Doesnt this impose a cost on people who want privacy? Having some of the network activity revealed allows concerned entities to deduce other information more easily. For example say you have a ring signature with 2 parties and the other party reveals which input is his, now they have deduced who the other participant is (atleast they have deduced his pseudonym, still not a good thing). This means that inorder to regain their privacy, people who want privacy now have to use a higher mixin count to achieve the same thing.

It seems to me that, unless this evaluation is totally wrong, this charity should just use bitcoin.

That's not the way it works. The "reveal" does not reveal which transaction it is, it reveals that they were involved in a transaction (this we could deduce already) and the exact amount (ie. let's ignore spurious outputs / change outputs), so it's not the same as revealing the one-time private key for a transaction. What we're talking about is a reveal that is no different to a screenshot of a person transacting (as has been posted in this thread) that contains full details of their transaction (destination address, amount, mixin count, payment ID). How exactly would you prevent that information from being revealed? You can't.

Monero is meant to solve that exact problem - what happens if we know the address of the recipient? Can we do anything with it? It's a stealth address, so good luck getting anything out of that. Ring signatures are an additional layer on top of that, and they exist to protect you when a transaction is compromised. They're a level of ambiguity, not a level of anonymity. Privacy is accorded by the stealth addresses, ambiguity gives you plausible deniability in the event that someone else in in the signature group for a particular input is compromised.

Edit: just to add, this stuff is inherent in the protocol. We're not suggesting changes, we're telling you what is already there. Reading the whitepaper is probably a good starting point to understanding why this exists in the protocol:)

[Anon136]

Doesnt this impose a cost on people who want privacy? Having some of the network activity revealed allows concerned entities to deduce other information more easily. For example say you have a ring signature with 2 parties and the other party reveals which input is his, now they have deduced who the other participant is (atleast they have deduced his pseudonym, still not a good thing). This means that inorder to regain their privacy, people who want privacy now have to use a higher mixin count to achieve the same thing.

It seems to me that, unless this evaluation is totally wrong, this charity should just use bitcoin.

That's not the way it works. The "reveal" does not reveal which transaction it is, it reveals that they were involved in a transaction (this we could deduce already) and the exact amount (ie. let's ignore spurious outputs / change outputs), so it's not the same as revealing the one-time private key for a transaction. What we're talking about is a reveal that is no different to a screenshot of a person transacting (as has been posted in this thread) that contains full details of their transaction (destination address, amount, mixin count, payment ID). How exactly would you prevent that information from being revealed? You can't.

Monero is meant to solve that exact problem - what happens if we know the address of the recipient? Can we do anything with it? It's a stealth address, so good luck getting anything out of that. Ring signatures are an additional layer on top of that, and they exist to protect you when a transaction is compromised. They're a level of ambiguity, not a level of anonymity. Privacy is accorded by the stealth addresses, ambiguity gives you plausible deniability in the event that someone else in in the signature group for a particular input is compromised.

Edit: just to add, this stuff is inherent in the protocol. We're not suggesting changes, we're telling you what is already there. Reading the whitepaper is probably a good starting point to understanding why this exists in the protocol:)

Yes I read the whitepaper. Of course i would be lying if i said that i understood all of it. I do think I understood it well enough to see the value in cryptonote especially as compared to other proposed anonymity schemes. I was also aware that there is technically no way to prevent people from revealing this information. People could reveal every single bit of information about their transactions except for their private key if they wanted.

So here is a question. Is your position that people who are trying to act transparently in the manner you have outlined have no effect what so ever on the privacy of individuals who are concerned about privacy. Or is your position that it has a very small or relatively small effect. If it is the latter than by what mechanism is the privacy of other individuals effected.

[fluffypony]

Yes I read the whitepaper. Of course i would be lying if i said that i understood all of it. I do think I understood it well enough to see the value in cryptonote especially as compared to other proposed anonymity schemes. I was also aware that there is technically no way to prevent people from revealing this information. People could reveal every single bit of information about their transactions except for their private key if they wanted.

So here is a question. Is your position that people who are trying to act transparently in the manner you have outlined have no effect what so ever on the privacy of individuals who are concerned about privacy. Or is your position that it has a very small or relatively small effect. If it is the latter than by what mechanism is the privacy of other individuals effected.

In fact, they could even reveal their private key on live TV if they wanted - as has happened with Bitcoin before:)

To your second question: the general consensus is that it has a relatively small effect. Here's a dump from a short discussion that was on IRC about the matter the other day:

smooth:    it is similar to a sybil attack
smooth:    let's say a lot of people post their information publically, that is the same to an observer as the observer launching a sybil attack with all those third parties as owned identities

There are solutions we are theorising at present that will reduce the effect of this, but please understand this is such an edge-case that we're taking about protection from an extremely sophisticated attacker with extremely large access to resources. Even in its current form with no edge-cases ruled out, Monero has a level of privacy heretofore unknown to "ordinary" persons who use Bitcoin. Sure, accessibility is an issue, and that is a long-term goal, but don't forget that Monero has an interesting value-proposition already.

We will close the final gates and reduce risks to privacy as time progresses; we do not have to solve everything now. Our dedication and commitment to doing so transcends price fluctuations, FUD from those unfamiliar with the matter, or snide remarks on social networks. Let's not try solve every apparent problem now, but let's work towards solving these as a group and as a community:)

[smooth]

So here is a question. Is your position that people who are trying to act transparently in the manner you have outlined have no effect what so ever on the privacy of individuals who are concerned about privacy. Or is your position that it has a very small or relatively small effect. If it is the latter than by what mechanism is the privacy of other individuals effected.

It can't have no effect. The nature of mixing is that you are hiding a needle in a haystack. The haystack is the combinatorial explosion of other potential paths that could point to you. (The animated graphic on the cryptonite site is helpful.) If the haystack gets smaller -- either because of people identifying their transactions, or because they aren't using the coin at all -- then it obviously becomes easier to find the needle (i.e. you).

We are working on various ways of making the process of finding the needle harder. Whether it is then "hard enough" for useful privacy will depend on various factors that are hard to quantify right now, including what people consider to be "useful," how much usage there is in the coin generally, and the nature of that usage. Arguably, for some use cases, it is already good enough. For other use cases it will become good enough once improved. For still others it may not be good enough until there are further improvements and/or much greater usage. Finally there may be some use cases for which it may never be good enough. I also think it is possible the latter case may not occur, since combinatorial explosions can be quite large (as in provably infeasible to untangle), but we don't know this yet.

[Anon136]

So here is a question. Is your position that people who are trying to act transparently in the manner you have outlined have no effect what so ever on the privacy of individuals who are concerned about privacy. Or is your position that it has a very small or relatively small effect. If it is the latter than by what mechanism is the privacy of other individuals effected.

It can't have no effect. The nature of mixing is that you are hiding a needle in a haystack. The haystack is the combinatorial explosion of other potential paths that could point to you. (The animated graphic on the cryptonite site is helpful.) If the haystack gets smaller -- either because of people identifying their transactions, or because they aren't using the coin at all -- then it obviously becomes easier to find the needle (i.e. you).

We are working on various ways of making the process of finding the needle harder. Whether it is then "hard enough" for useful privacy will depend on various factors that are hard to quantify right now, including what people consider to be "useful," how much usage there is in the coin generally, and the nature of that usage. Arguably, for some use cases, it is already good enough. For other use cases it will become good enough once improved. For still others it may not be good enough until there are further improvements and/or much greater usage. Finally there may be some use cases for which it may never be good enough. I also think it is possible the latter case may not occur, since combinatorial explosions can be quite large (as in provably infeasible to untangle), but we don't know this yet.

I guess the important point here is that there is not really any way to stop people from revealing information about their transactions if they chose to. So the devs may as well operate under the assumption that some people will. Hopefully we can at the very least create a social stigma against it and apply social pressure to help prevent people from doing that.

Based on some of the points you made up there, it bring up the point that perhaps we should encourage blocks to always be full. It would be a simple task. Just remove the minimum transaction fee and people would begin to use the blockchain for increasingly marginal purposes. Eventually the demand for space will overtake the supply of space and a market for space will appear. Just like that. Granted there is some pressure towards having some amount of fee or else it isnt worth it to miners to take the risk of getting their block orphaned, but none the less the argument remains just as valid even given this consideration.

*edit* im sure someone is going to point out that right now we are having to load the entire blockchain in ram so if anything, for the time being, the fee should probably be increased. But perhaps this will make more sense in the future when you guys get all of that mess figured out.