ianmiers

This is by no means a comprehensive analysis. This analysis misses the most major limitation with Monero's decoy based approach to transaction obfuscation: Eve-Alice-Eve attacks (also known as ABA attacks). It also misses an analysis of the possible insecurity of churning and a significant history of randomness implementation errors and flooding attacks specific to Monero. The exact consequences of some of these attacks remain an open question, but worthy of mention.

A simple and surprising limitation of Monero and any other decoy-based approach is that if you repeatedly withdraw money from one exchange and then deposit it to another, those transactions are not private (edit: even if we ignore payment value). This is a form of Eve-Alice-Eve attack.

Monero uses decoy transactions to obscure the transaction history on-chain, but it does not remove the history. There's a reason every other major privacy protocol (Zcash, Tornado Cash, Railgun, Aleo, Penumbra, etc.) does not use Monero's decoy-based approach, and even the Monero developers are moving to the standard zero-knowledge proof over an accumulator (IIRC a merkle tree like everyone else) based approach that they call Full Chain Anonymity Proofs.

As a meta-comment, this is one of a genre of Monero "privacy" analysis documents that are circulated as a way to claim there are no known actively used exploits. This is little better than the classic "my scheme is secure; here's a bounty for anyone who breaks it" form of cryptographic analysis we often see with flawed encryption schemes. Breaks will not always be public.

if you just sent Mick down the left path and he came out the right, then a video would conclusively show he knew the password.

And this is why "How to explain zero-knowledge protocols to your children" is probably the worst way to explain zero-knowledge protocols to anyone. Its not explaining what a zero-knowledge proof is or how it works. It's explaining what a simulator is when proving a protocol is zero-knowledge . Oh, and the explanation only works for interactive protocols.

Paying in cash, in addition to being a minor inconvenience that non-the-less outweighs most people's desire for privacy, does not work in online payments. It also doesn't work in businesses that get robbed.

The better question is, why do you need a new currency to get privacy? Why couldn't we have a private crypto currency backed by dollars or euros? There's no technical reason, indeed several groups are building this. What remains to be seen is if there's sufficient incentives to build anything around these or for any portion of the economy to move to them. Most purchases aren't sensitive, so for private payments to work, they need to be ubiquitous for non privacy reasons and just give people who need it the option for privacy. Much like cash does. But again, cash doesn't work online or increasingly offline

This is pretty cool. But you might want to update the credit for the zksnark +merkle tree + nullifier idea. It's from an academic paper, Zerocash in 2014. The approach is used in Zcash and then in Tornado.cash Though Tornado.cash is actually an odd hybrid between Zerocash's merkle tree+snark approach and an older academic paper, Zerocoin, which proposed a zk mix protocol as an add on to Bitcoin.

I don't think tagging people as ex 8200 is very helpful. Israel has mandatory military service and at this point if you have aptitude or are in a high school computer club in Tel Aviv or a few other places, you probably end up in 8200 for your service. For that matter, half the people who say there were in 8200 were either 1) listening to telephone calls 2) relegated to writing memos about the data people did hack and get. Of course, there are things one could have done that would raise serious questions. See, e.g., the issues raised for the people we know who worked on DualEC_DRBG.

On the other hand, there are other sketchy things about express VPN.

It's an important distinction. The fact that huge numbers of people rotate through the hacking side of 8200 (like the NSA, vast majority of 8200 members don't work on that) is what drives the supply.

Intelligence services typically have less turnover. Though that is changing, particularly for NSA, where people leave to go to contractors.

Also, frankly, describing NSO as ex Mossad just makes phone malware sound much more complicated than it is and much harder to stop. At the end of the day, its software, written by people in much the same way any software is written. It just exploits mistakes other software devs made so that it can run.

NSO group is ex unit 8200, which is military signals intelligence. So in American terms, it's the NSA not the CIA. The distinction is important in a country with mandatory military service. You get a large number of people who go through, get trained, and then leave because it never was a career. A number of them take their skills to the private sector.

Mossad, on the other hand, is a civilian intelligence service and I'm told there's a strong tradition that its members don't freelance their services after leaving.

Because Bitcoin is twitter for your bank account. It exposes everything you do to anyone who can download the blockchain.

You can argue that some gov/regulator should have access, though good luck finding one country everyone trusts. More realistically, and practically, you could require that, as many jurisdictions do with cash, we should have reporting requirements for when a merchant sells something for large amounts of cryptocurrency.

But its pretty hard to argue everyone should be financially naked and exposed to anyone who wants to look. To fix that, even if you're government surveillance friendly, you first need to make the blockchain zero-knowledge (which Monero actually isn't good at, but thats irrelevant here).

There are some Zcash forks with iffy dev support and no market traction. The problem is the kind of cryptography you need to do something like Zcash is very very very hard to get right. Zcash actually got the tech right and handled the issues they hit well. They just didn't do a good job with reputation outside of tech.

No one else as done the same tech yet themselves. A few things have launched and allegedly plan to add a privacy layer (Mina, Celo). But actually building that kind of tech is a lot harder than reputation management or standard blockchains.

It's still an open playing field.