Miers Warns Decoy Privacy Coins Like Monero Fail Under Basic Tracking

Satoshi Has No Clothes: Failures in On-Chain Privacy by Ian Miers (Devcon4) — Ethereum Foundation

Ethereum Foundation

Decoy-based privacy protocols collapse against repeated commercial or state interactions because backward and forward taint trees expose the underlying transaction graph, making zero-knowledge proofs the only viable defense.

AI-assisted summary of Satoshi Has No Clothes: Failures in On-Chain Privacy by Ian Miers (Devcon4) — original source. Check the original for full context.

Source published:

Key ideas

  • Transparent public blockchains expose personal and institutional financial activity to competitors, stalkers, and foreign nation-states, operating essentially as 'Twitter for your bank account.' (1:18)
  • Decoy-based privacy protocols such as Monero and CoinJoin fail under repeated transactions because historical and forward-facing 'taint trees' allow counterparties, states, and third parties to deanonymize users. (10:24)
  • Zcash's Sapling deployment demonstrates that strong zero-knowledge shielded transactions are practical for general adoption, running in under two seconds with less than 40 megabytes of memory. (19:09)
  • Mimblewimble and Grin fail to provide robust privacy because unaggregated transactions can be intercepted on peer-to-peer gossip networks before block cut-through occurs, exposing the transaction graph. (21:33)

Detailed notes

## Background Published by the Ethereum Foundation on YouTube on December 11, 2018, this presentation features Ian Miers speaking at Devcon4 in Prague. The talk's description highlights that default transparency in networks like Bitcoin and Ethereum creates major privacy and fungibility concerns, examining various proposed privacy techniques, their trade-offs, and which approaches provide sufficient protection against realistic threat models.

## TL;DR Ian Miers argues that the cryptocurrency ecosystem critically misunderstands privacy, warning that relying on default-transparent blockchains turns public ledgers into 'Twitter for your bank account.' He systematically dismantles decoy-based privacy schemes such as Monero and CoinJoin, presenting attacks—such as forward and backward 'taint trees' and dusting—that reliably deanonymize repeated transactions and user interactions. In contrast, Miers advocates for shielded zero-knowledge systems like Zerocash and Zcash's newly deployed Sapling upgrade, emphasizing that true privacy requires completely eliminating the transaction graph rather than patching exposure with marketing-driven 'privacy theater.'

## Atmosphere & style The presentation is candid, urgent, and intellectually rigorous, eschewing tribal project promotion in favor of an unsparing technical critique. Miers commands the stage with sharp wit, using relatable, biting analogies—from building a spacesuit out of overalls and duct tape to standing naked in Times Square—to illustrate the sheer scale of blockchain exposure. It feels like an authoritative reality check aimed directly at developers and enthusiasts who mistake cryptographic buzzwords for actual operational security.

## Bulletin - [01:18](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=78s) Transparent public blockchains expose personal and institutional financial activity to competitors, stalkers, and foreign nation-states, operating essentially as 'Twitter for your bank account.' - [10:24](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=624s) Decoy-based privacy protocols such as Monero and CoinJoin fail under repeated transactions because historical and forward-facing 'taint trees' allow counterparties, states, and third parties to deanonymize users. - [19:09](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1149s) Zcash's Sapling deployment demonstrates that strong zero-knowledge shielded transactions are practical for general adoption, running in under two seconds with less than 40 megabytes of memory. - [21:33](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1293s) Mimblewimble and Grin fail to provide robust privacy because unaggregated transactions can be intercepted on peer-to-peer gossip networks before block cut-through occurs, exposing the transaction graph.

## Key takeaways - [00:00](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=0s) The cryptocurrency ecosystem has severely neglected rigorous evaluation of on-chain privacy mechanisms despite one of these networks inevitably underpinning the future of global payments. - [01:18](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=78s) Public ledgers broadcast transaction data by default, creating acute operational risks for businesses, individuals, and sovereign governments facing economic espionage. - [02:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=165s) Empirical evaluation of crypto privacy today resembles evaluating web privacy in 1992 at CERN; researchers must instead anticipate surveillance mechanisms based on modern commercial tracking. - [02:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=165s) Commercial advertising tools and loyalty schemes—such as Target's predictive pregnancy detection and Venmo's public payment feed—illustrate the dangers of financial metadata harvesting. - [06:44](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=404s) Relying on plausible deniability is obsolete in an era of machine learning, social credit systems, targeted tracking, and legal search warrants. - [06:44](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=404s) Effective privacy must defend against active counterparties (merchants and recipients) rather than passive observers, requiring protocols to obscure the transaction graph itself. - [08:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=525s) Cryptocurrency privacy models fall into three categories: fully transparent (Bitcoin, Ethereum), decoy-based (CoinJoin, CryptoNote/Monero), and shielded zero-knowledge systems (Zerocash/Zcash). - [10:24](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=624s) Decoy-based transactions generate backward- and forward-expanding 'taint trees' whose historical roots intersect across repeated interactions, enabling the 'overseer attack' to deanonymize consumers. - [12:19](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=739s) State actors can deanonymize dissidents accepting public donations by sending multiple tracking payments and cross-referencing their intersection in exchange deposit taint trees. - [14:15](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=855s) Dusting attacks allow third-party observers to track and verify whether a specific person is making purchases at a particular merchant through overlapping forward taint trees. - [17:22](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1042s) Superficial feature lists like stealth addresses and ring signatures represent 'privacy theater' and fail to provide end-to-end security in hostile public environments. - [19:09](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1149s) Deployments such as Sapling prove that zero-knowledge proofs no longer suffer from prohibitive performance bottlenecks, rendering weak privacy primitives inexcusable. - [20:20](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1220s) The hardest remaining challenges in cryptocurrency privacy lie in user experience, lightweight mobile wallet integration, and preventing user practices that undo cryptographic protections. - [21:33](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1293s) P2P network-level eavesdropping on unaggregated Mimblewimble transactions undermines its privacy promises, as observers can reconstruct the underlying transaction graph before block confirmation.

## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=0s) The Urgent Need to Evaluate Cryptocurrency Privacy

Ian Miers opens by setting the record straight: the purpose of his talk is not to promote or shill Zcash, despite the fact that he is one of its co-founders and serves on the board of directors of the Zcash Foundation. Instead, the talk addresses a fundamental failure across the entire blockchain ecosystem: the community has done a remarkably poor job of evaluating privacy mechanisms. This deficiency must be corrected immediately. Whether the ultimate global payment network turns out to be Ethereum, Bitcoin, Zcash, or even Dogecoin, at least one cryptocurrency will eventually underpin the future of global commerce. If the industry waits until widespread adoption occurs before confronting its architectural privacy flaws, fixing the problem will be far too late.

Miers reflects on his own history in the space, having conducted research on cryptocurrency privacy since 2011. At that time, it was uncertain whether Bitcoin would succeed at all, but it was clear that if it did, its design harbored a massive privacy crisis. Back then, common belief held that Bitcoin was already private and anonymous—an assumption that Miers notes is completely laughable in retrospect. A decade of academic literature has systematically dismantled that assumption, complemented by the emergence of well-funded commercial analytics firms whose entire business model revolves around deanonymizing blockchains. As Ian Miers explains: “The point is that we as a community have done a very poor job evaluating privacy approaches for cryptocurrencies and the problem is that we need to get better at it and we need to get better at it now because at least one of these Ethereum, Bitcoin, Zcash, something that all of us have ever heard of, maybe Dogecoin, I don't know, is going to be the future of payments.”

- **Miers's Background**: Working on cryptocurrency privacy since 2011; co-founder of Zcash and board member of the Zcash Foundation. - **Academic and Commercial Reality**: Early beliefs in Bitcoin pseudonymity were overturned by academic deanonymization attacks and commercial tracking services (such as Chainalysis).

---

[01:18](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=78s) "Twitter for Your Bank Account" and Real-Life Tracking Cookies

Blockchains do not grant privacy; instead, Miers characterizes modern cryptocurrencies as “Twitter for your bank account.” By design, public ledgers expose all transactional activity and spending habits to the open world. This transparency is catastrophic for everyday users, businesses, and nation-states alike. For individuals, personal payment histories are visible to nosy acquaintances, stalkers, or creepy ex-partners. For commercial enterprises, transparent ledgers broadcast critical operational secrets: rival firms can audit entire supply chains, see exactly what vendors are charging, discover how much employees are paid, and use that compensation data to aggressively poach talent.

Even sovereign governments that advocate against financial privacy undermine their own national security on public ledgers. Whether the United States, Russia, or China, every major power faces foreign adversaries eager to harvest economic intelligence and exploit financial vulnerabilities revealed on-chain. Over the years, proposed remedies have ranged from mundane schemes that have no realistic chance of working to advanced cryptographic constructions, including Zerocash, which consumed five years of Miers's life as his doctoral dissertation. Yet cryptocurrency developers must understand the genuine protections these systems offer before integrating them. As Ian Miers observes: “If your government right and you think you want you don't want privacy for cryptocurrencies think again because there are other governments out there that don't like your government.”

```mermaid flowchart TD accTitle: Public Blockchain Surveillance Threats accDescr: Diagram illustrating how on-chain transparent transactions expose sensitive user and institutional data to diverse adversaries.

subgraph Ledger["Public Blockchain (Transparent Ledger)"] TX["Broadcast Transactions<br/>Sender, Recipient, & Amount"] end

subgraph Adversaries["Surveillance Vectors"] Adv1["Personal Adversaries<br/>• Stalkers & Creepy Exes"] Adv2["Competitors<br/>• Supply chain inspection<br/>• Employee poaching via salaries"] Adv3["Hostile Nation-States<br/>• Foreign intelligence gathering<br/>• Macro-economic espionage"] end

TX --> Adv1 TX --> Adv2 TX --> Adv3 ```

---

[02:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=165s) The Limits of Empirical Research and Parallels in Real-World Surveillance

Evaluating cryptocurrency privacy scientifically presents a unique methodological hurdle. Miers points out that attempting an empirical evaluation of blockchain privacy today is equivalent to assessing internet privacy in 1992, back when the World Wide Web consisted of early experiments running primarily at CERN. Contemporary cryptocurrency usage remains overwhelmingly speculative; there is no rich tapestry of daily human routines—purchasing a morning coffee, tapping into the subway turnstile, or buying lunch—with structured behavioral signals. Furthermore, academic researchers operate under strict ethical guidelines and limited budgets, meaning they cannot purchase the massive proprietary consumer datasets that commercial analytics entities exploit.

Consequently, researchers must rely on rigorous thought experiments and look to existing surveillance architectures to project what attacks will look like ten to twenty years down the line. Miers highlights real-world commercial advertising practices as the primary indicator: * **In-Store Payment Harvesting**: Companies like Google track not only digital spending but have partnered with financial aggregators to capture real-world point-of-sale transactions at retail outlets such as Walmart. While Google receives significant media pushback, far less scrupulous actors operate quietly with the same data. * **Predictive Profiling**: The famous Target retail scandal illustrated the power of purchase metadata: by tracking loyalty card purchases, Target's algorithms correctly inferred a teenage girl was pregnant and mailed baby-oriented promotional coupons to her household, alerting her father before she had disclosed the pregnancy herself. * **Social Payments (Venmo)**: Venmo popularized a default-public social feed broadcasting payment notes among peers. This resulted in widespread consumer tracking and blog guides instructing users on how to stalk their exes—a dynamic that Miers notes is deeply disturbing once stripped of lighthearted internet branding.

Without robust defenses, public blockchains will simply act as physical tracking cookies—a dystopian realization of Web 3.0 in physical space. As Ian Miers stresses: “Evaluating privacy for cryptocurrencies is not easy right to do it empirically would be akin to trying to evaluate privacy for the internet in 1992 when everything was just started when the first things that were running were only at CERN.”

---

[06:44](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=404s) The Fallacy of Plausible Deniability and Hiding the Transaction Graph

To design meaningful defenses, the cryptocurrency ecosystem must abandon outdated assumptions about operational security. Miers issues a sharp warning: in an era governed by machine learning, social credit scoring systems, and micro-targeted surveillance, relying on plausible deniability is fundamentally bankrupt. The original privacy ethos of Bitcoin was rooted in the notion that an individual accused of illicit purchases could simply claim, "You can't prove that address was mine." Miers dismisses this as the naive fantasy of a hobbyist mining coins on a Counter-Strike gaming rig in their parents' basement. Plausible deniability does not stop law enforcement from obtaining a search warrant, raiding a residence, and uncovering corroborating evidence.

Furthermore, blockchain privacy is inherently counter-intuitive. While encrypting data to block a passive outside observer who knows nothing about a transaction is relatively straightforward, passive observers are not the primary threat. Real privacy requires protecting users against the counterparties they interact with every day: the merchants accepting their payments, friends settling bills, or senders distributing funds. When an address is revealed to a merchant during checkout, merely hiding IP addresses or masking transaction values using Confidential Transactions is insufficient. To prevent counterparties from reconstructing a user's entire financial history, a protocol must conceal the transaction graph itself. As Ian Miers puts it: “The first thing if you take nothing else from this talk is that in a world of AI social credit systems you've probably seen that video going around on Twitter from the train in China and targeted advertising plausible deniability is not a plausible defense.”

- **The Fallacy of Deniability**: Shrugging off transactional linkage does not hold up against real-world search warrants, behavioral profiling, or legal scrutiny. - **Counterparty Threat Model**: The real danger is active counterparties (merchants, recipients, senders) who possess one anchor point in a transaction and use it to crawl the public graph. - **Structural Requirement**: Hiding transaction values (via Confidential Transactions) or obscuring networking layers (IP masking) fails if the transaction graph linking inputs to outputs remains visible.

[08:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=525s) Three Paradigms of Cryptocurrency Privacy

Ian Miers lays out three distinct design patterns for privacy in cryptocurrencies:

1. **Fully transparent systems (Bitcoin, Ethereum, etc.):** The transaction origin is explicitly specified, whether via UTXO or account balance. This completely exposes the transaction graph, providing zero privacy. 2. **Decoy transaction systems (CoinJoin, Mimblewimble, CryptoNote / RingCT / Monero):** These systems obscure the true origin by bundling the real transaction with a handful of decoy inputs (for example, selecting five possible decoy sources). The observer knows the real transaction is in that set, but cannot easily tell which one it is. It operates like throwing up chaff or visual noise, hoping the adversary lacks the visual acuity to isolate the signal. 3. **Shielded zero-knowledge systems (Zerocoin, Zerocash / Zcash):** These protocols do not identify the payment origin at all. If users take advantage of the shielded privacy-preserving transaction types, there is simply no transaction graph left to analyze or reconstruct.

Miers notes that extensive academic and empirical research has proven Bitcoin is not private, while Zerocash holds up well when shielded features are correctly utilized. The critical question is whether decoy-based approaches provide actual privacy. As Miers states bluntly: “The question is do these decoy based approaches work and spoilers the answer is no”.

```mermaid flowchart TD accTitle: Structural models of cryptocurrency privacy accDescr: Diagram contrasting transparent systems, decoy-based chaff systems, and shielded zero-knowledge systems.

subgraph Transparent["1. Transparent (Bitcoin, Ethereum)"] direction LR T1["Explicit Input"] --> T2["Explicit Output"] end

subgraph Decoys["2. Decoy-based (Monero, CoinJoin)"] direction LR D1["Real Source + N Decoys"] --> D2["Payment Chaff"] end

subgraph Shielded["3. Shielded (Zerocash, Zcash)"] direction LR Z1["Zero-Knowledge Proof"] --> Z2["Hidden Origin (No Graph)"] end ```

[10:24](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=624s) Taint Trees and the "Overseer Attack"

Decoy-based systems fall apart under analysis because of the underlying structural graph they inevitably generate. When a user pays a merchant using decoys (whether picking 3, 5, or 11 decoy inputs), the merchant does not just see those immediate decoys; they see the entire historical fan-out of every decoy's potential origins backwards in time. Miers terms this backward-branching cone a "taint tree." The exact same process works looking forward: when money is paid out, an observer can track all downstream spends that pick that payment as a real input or a decoy, forming an expanding forward-facing cone.

```mermaid flowchart LR accTitle: Forward and backward taint tree expansion accDescr: Visual depiction of how transactions expand backwards into historical decoy sources and forward into subsequent spend decoys.

subgraph Backward["Backward Taint Tree"] B3["Origins of Decoys"] --> B2["Selected Decoys (3-11)"] B2 --> B1["Payment Input"] end

B1 --> TX["Transaction"]

subgraph Forward["Forward Taint Tree"] TX --> F1["Merchant Spend"] F1 --> F2["Subsequent Spends"] F2 --> F3["Downstream Decoys"] end ```

This structural leakage enables what Miers calls the "overseer attack": - Suppose a consumer visits a merchant like Starbucks daily to buy coffee with a privacy coin, expecting cash-like anonymity. - If Starbucks were an adversary, could they construct a behavioral profile of coffee consumption and resell that data to health insurers? - While a single purchase might seem insulated by decoys, each consecutive visit generates its own backward taint tree. - Because customer funds often originate from a shared root—such as a single withdrawal from Coinbase or ShapeShift, or through recurring change addresses—the backward taint trees of multiple purchases will intersect. - By correlating these intersections across days, the merchant deanonymizes the buyer and links repeated purchases to one consumer profile.

[12:19](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=739s) Deanonymizing Dissidents via Targeted Deposits

The second attack vector exploits the danger of repeated interactions involving an adversary who controls or monitors a specific receiving point, such as a centralized exchange. Miers constructs an example involving a political dissident operating an anonymous dark-web donation portal from Saudi Arabia:

- The activist posts an address online to accept donations under the belief that decoy-based privacy shields their identity. - Believing the incoming funds are fully clean and untraceable, the activist deposits the received donations into a local Middle Eastern cryptocurrency exchange where they have completed full KYC (Know Your Customer) verification. - A state adversary (such as the Saudi government) subpoenas or compromises the exchange and inspects the backward taint trees for all customer deposits. - If the adversary sends a single tracking donation to the dissident's public address, seeing that transaction appear in a user's exchange taint tree is not absolute proof; innocent third parties may have randomly chosen that tracking output as a decoy input. - However, if the adversary sends multiple distinct tracking payments to the dissident's donation address, the probability that an unrelated third party randomly selected *all* of those specific tracking payments as decoys drops to near zero. - “And so what are the odds that some person has all of those payments in their taint trees right that all of these things are deposited in their account no approximately zero and so now you have with high probability identified the person and so this is really bad this is going to get you arrested or worse”.

As Miers emphasizes, repeated interactions with a sender or recipient represent the exact operational pattern where decoy-based privacy coins catastrophically fail.

[14:15](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=855s) Dusting Attacks and Third-Party Spend Tracking

The forward-facing taint tree enables third parties to link two completely separate entities without compromising either party's wallet. Miers illustrates this by demonstrating how an observer can verify whether a specific friend is spending money at a specific merchant:

- The attacker sends a tiny transaction ("dust") to the friend's address and another dust transaction to the merchant. - Over time, the forward taint trees for both payments fan out across the ledger as the funds and decoys are spent. - If a forward taint output from the friend's payment pool merges into the same transaction or address structure as an output from the merchant's payment pool, it raises suspicion. While a single overlap might be accidental decoy selection or internal merchant balance sweeping, repeated intersections across multiple rounds eliminate coincidence. - As Miers points out: “these the odds of this happening by happenstance because it's repeated interactions are approximately zero right and then you can watch this happen 3 4 5 10 20 times and now you really know for sure”. - He jokes about the social consequences: an observer could verify if their friend had an active Pornhub subscription, which would be embarrassing on multiple fronts—not only for paying for porn, but worse, “he's probably paying for porn with Verge which really like you have get better taste taste and friends”. - Because anyone can inject tracking dust into the system to unravel spending behavior, decoy-based architectures fail basic privacy guarantees: “And so are decoy based systems private the answer is no right with a little bit of thought and I emphasize this is a little bit of thought right we've come up with three plausible attacks that can break these things”.

[16:36](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=996s) Why Inadequate Privacy Tech Persists

Despite these structural vulnerabilities, decoy systems remain widely popular and defended across the cryptocurrency ecosystem. Miers explains that privacy engineering is profoundly counterintuitive and difficult:

- The developers designing these protocols are generally working hard and establishing dedicated, impressive communities, but evaluating privacy risks requires deep expertise: “to err is human”. - A major driver of the continued promotion of flawed schemes is the culture of cryptocurrency marketing and tribalism, where projects prioritize self-promotion and competing claims of superiority over rigorous security analysis.

[17:22](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1042s) The Illusion of Feature Lists and the Real Magnitude of Exposure

Ian Miers turns his critique toward what he characterizes as "privacy theater." Whenever one interacts with advocates of privacy coins—especially on Twitter, which he wryly notes is hardly the place to observe normal human behavior—the pitch invariably becomes a laundry list of cryptographic buzzwords: stealth addresses, ring signatures, cut-throughs, zk-SNARKs, VPNs, or Tor routing. While rattling off these features sounds remarkably impressive to prospective users, the list reveals absolutely nothing about the actual privacy delivered in practice. Miers insists that the ecosystem must stop evaluating privacy this way. While some of these techniques fail completely and others (like zk-SNARKs) show immense promise, a single primitive is merely a technique, not an end-to-end solution. A complete protocol must be evaluated by asking what is actually being hidden, whether the system succeeds in hiding it, whether it conceals everything else, and how safe the protocol remains under real-world usage patterns. In practice, most implementations hide very little, fail to hide it well, leave everything else exposed, and get used in inherently unsafe ways.

```mermaid flowchart TD accTitle: Feature List vs Ground-Up Protocol Evaluation accDescr: Contrasts superficial marketing lists with real-world threat models in cryptocurrencies.

subgraph FeatureList["Superficial 'Privacy Coin' Feature List"] F1["Stealth Addresses"] F2["Ring Signatures"] F3["zk-SNARKs / VPN / Tor"] end

subgraph Reality["Threat Model Reality Check"] R1["Public Blockchain = 'Twitter for your bank account'"] R2["Hostile, broadcast-by-default environment"] R3["Superficial features act like a band-aid on full exposure"] end

FeatureList -->|"Does not equal"| Solution["Ground-Up Secure Protocol"] Reality -->|"Requires"| Solution ```

To drive home the sheer scale of the problem, Miers offers a vivid metaphor: cryptocurrency is fundamentally "Twitter for your bank account." Because every payment is broadcast publicly to the entire world, using standard blockchains is the equivalent of standing completely naked in Times Square. Offering incremental, decoy-based privacy features in such an environment is like handing someone a tiny adhesive bandage to cover up that complete exposure. As Ian Miers puts it:

> “It's like trying to build a spacesuit out of duct tape and overalls, right? That's not how you go about protecting yourself from a very hostile and very exposed environment.”

Real security, he argues, cannot be retrofitted through half-measures; it must be engineered strictly from the ground up.

---

[19:09](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1149s) Zero-Knowledge Deployments: Sapling, BOLT, and Zexe

Miers temporarily sets aside his pledge not to shill Zcash to highlight that robust zero-knowledge solutions are no longer purely theoretical; they are live and highly practical. With the deployment of the Sapling upgrade—which launched within the previous 48 hours—generating a shielded zero-knowledge transaction takes under two seconds and consumes less than 40 megabytes of memory. These techniques can be implemented in any cryptocurrency, proving that performance bottlenecks are no longer a legitimate excuse to avoid strong layer-one privacy. Beyond layer-one Zerocash primitives, several next-generation research efforts and deployments are expanding these privacy guarantees:

- **Sapling (Layer 1):** Delivers fast zero-knowledge proofs (under 2 seconds generation time, < 40 MB memory usage) directly on-chain. - **BOLT (Blind Off-chain Lightweight Transactions):** A strongly private layer-two payment protocol being productized through an entity called Bolt Labs. - **Zexe (Zero-Knowledge Execution):** Academic work (co-authored by Sean Bowe and collaborators) enabling fully decentralized, private smart contract and application execution.

Miers emphasizes that developers have zero excuse today for leaning on flawed, weak privacy primitives when strong cryptographic tools—whether constructed using zk-SNARKs, Bulletproofs, or alternative constructions—are fully available. As Ian Miers argues:

> “There really isn't an excuse these days for using weak privacy techniques; we have strong ones, we have strong ones that use zk-SNARKs, you could do these with Bulletproofs, so you could use these other crypto, and you should do them—you shouldn't be using half-measures, and you shouldn't be telling people your things are private when they're not.”

---

[20:20](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1220s) The Hardest Unsolved Frontier: UX, Mobile, and User Education

Turning to the broader challenges facing privacy technologies, Miers stresses that having mathematically sound cryptography is insufficient if usability is neglected. Even Zcash has struggled with this exact barrier. Strong privacy guarantees fall apart when poor user interfaces permit or encourage counterproductive behaviors. For instance, across various cryptocurrencies, users frequently take amounts like $5.32, run them through an instant-exchange platform like ShapeShift into Monero, Zcash, or Dash, and immediately convert them straight back out on the other side. This round-trip swap provides zero meaningful privacy; any observer monitoring the blockchain can correlate the transactions in real time.

Solving this friction requires addressing mobile usability at the base protocol level. Users cannot be expected to download and synchronize an entire blockchain database just to execute private payments on a mobile device. While cryptographers can always design novel cryptographic underpinnings, tweak performance, or improve trust assumptions, Miers believes that the core protocol architecture is largely settled; designing clean usability, educational frameworks, and lightweight mobile experiences remains the hardest remaining challenge.

---

[21:33](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1293s) Conclusion and Q&A: TSA Cryptography and Mimblewimble/Grin

In his concluding remarks, Miers urges the community to stop treating privacy protocols like the TSA—systems that deploy flashy, reassuring rituals that give the illusion of safety while leaving critical vulnerabilities wide open. Under most deployed privacy-coin models, merchants can still trace customers across checkouts, intelligence services and governments can de-anonymize individuals from a single published online address, and friends can easily discover private personal expenses, such as recurring subscriptions to Adult entertainment sites like Pornhub. Decoy-based mechanisms simply fail to prevent these linkability exploits.

During the question-and-answer period, an audience member asks about Grin and the Mimblewimble protocol, specifically inquiring whether using blinding factors for each transaction—independent of CoinJoin aggregation—alters or improves privacy against transaction graph analysis. Miers responds that it does not:

> “The problem with Mimblewimble and Grin—so far, it's really promising techniques for compression—is that in a Mimblewimble transaction, you identify the UTXO you're spending and you generate a new output; you hide the values or hide the addresses, but the transaction graph is still there.”

In theory, Mimblewimble achieves privacy because non-interactive transaction aggregation can merge multiple payments into a single block-level mix. However, because individual transactions must first be broadcast across an open peer-to-peer gossip network, any listener running a node—whether an academic researcher or an intelligence agency—can capture, log, and reconstruct the un-aggregated individual transactions and their transaction graph before block inclusion. Miers concludes that until Mimblewimble designs an effective defense against network-level transaction snooping, it cannot be considered an adequate privacy solution.

## Notable quotes > [21:33](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1293s) The problem with Mimblewimble and Grin—so far, it's really promising techniques for compression—is that in a Mimblewimble transaction, you identify the UTXO you're spending and you generate a new output; you hide the values or hide the addresses, but the transaction graph is still there. — Ian Miers

## Mentioned Ian Miers, Zcash, Zcash Foundation, Bitcoin, Ethereum, Dogecoin, Chainalysis, Google, Walmart, Target, Venmo, Confidential Transactions, CoinJoin, Mimblewimble, CryptoNote, RingCT, Monero, Zerocoin, Zerocash, Coinbase, ShapeShift, Verge, Pornhub, Sapling, BOLT, Bolt Labs, Zexe, Sean Bowe, zk-SNARKs, Bulletproofs, Dash, Grin

## Video description Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more. https://archive.devcon.org/archive/watch/4/satoshi-has-no-clothes-failures-in-on-chain-privacy

Payments in Ethereum and Bitcoin are, by default, transparent. Transactions are conducted between pseudonyms with the sender, recipient and value exposed. While this transparency enhances auditability and decentralization, it is a major privacy issue. A growing volume of research shows that these pseudonymous identities are easily linkable. This is a major issue for privacy, fungibility, and a free market. A variety of techniques have been proposed to alleviate these issues. These include but are not limited to Confidential transactions + Conjoin, RingCT/Cryptnote, Zerocoin, Zerocash,  Hawk, and Solidus. These techniques span a large multidimensional performance envelope in terms of transactions generation and validation time, size, as well as a range of cryptographic assumptions and data retention requirements. At the same time, these protocols offer markedly different levels of privacy against various threat models. Which one should we use? If performance were the sole issue, then systems without such enhancements would likely be preferred. Clearly some amount of privacy is necessary and the cost of getting it acceptable. The question is thus, which approaches provide sufficient privacy, in what contexts, and at what cost?

Speaker(s): Ian Miers Skill level: Beginner Track: Privacy Keywords: security

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum Learn more about devcon: https://www.devcon.org/ Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. Devcon 4 was held in Prague, Czech Republic on Oct 30 - Nov 2, 2018. Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

[Source](https://www.youtube.com/watch?v=9s3EbSKDA3o)

中文简报

Miers警告基于诱饵的门罗币等隐私币在基础追踪下会失效 基于诱饵的隐私协议在重复的商业或国家级交互面前会崩溃，因为后向与前向“污点树”会暴露出底层的交易图谱，这使得零知识证明成为唯一可行的防御手段。 Ian Miers认为加密货币生态对隐私存在严重的误解，并警告称依赖默认透明的区块链会将公共账本变成“银行账户版的推特”。他系统性地驳斥了门罗币（Monero）和CoinJoin等基于诱饵的隐私机制，展示了前向与后向“污点树”以及粉尘攻击等手段如何能可靠地消除重复交易与用户交互的匿名性。相比之下，Miers推崇像Zerocash以及Zcash新部署的Sapling升级等屏蔽式零知识系统，并强调真正的隐私需要彻底消除交易图谱，而非依靠营销驱动的“隐私闹剧”来进行表面修补。 透明的公共区块链会将个人和机构的财务活动暴露给竞争对手、跟踪狂以及外国实体，其运作机制本质上如同“银行账户版的推特”。 (1:18) 门罗币（Monero）和CoinJoin等基于诱饵的隐私协议在重复交易下会失效，因为历史与前向的“污点树”能让交易对手、国家实体和第三方对用户进行去匿名化。 (10:24) Zcash的Sapling部署表明，高强度的零知识屏蔽交易已具备普遍采用的实用性，其运行时间低于两秒，占用内存不足40兆字节。 (19:09) Mimblewimble和Grin未能提供强大的隐私保护，因为未聚合的交易在区块合并削减（cut-through）发生之前，就可能在点对点Gossip网络中被拦截，从而暴露交易图谱。 (21:33)

Reading summary

Ian Miers argues that the cryptocurrency ecosystem routinely misjudges privacy by relying on superficial feature lists and flawed decoy-based mechanisms that fail against basic graph analysis. Real financial privacy requires concealing the transaction graph itself through zero-knowledge proofs before widespread adoption cements transparent or easily deanonymized payment rails. Transparent Ledgers and the Fallacy of Deniability (1:18) Miers describes modern transparent blockchains as "Twitter for your bank account," broadcasting financial activity to stalkers, corporate competitors auditing supply chains or poaching employees through salary data, and hostile foreign intelligence agencies. He contends that relying on "plausible deniability"—the claim that an address cannot be definitively tied to an identity—is an obsolete defense in an era of machine learning and targeted surveillance, as it provides no protection against subpoenas, search warrants, or behavioral profiling. Structural Vulnerabilities in Decoy-Based Privacy Systems (8:45) Cryptocurrency privacy models fall into three tiers: fully transparent ledgers (Bitcoin, Ethereum), decoy-based chaff systems (Monero, CoinJoin), and shielded zero-knowledge systems (Zerocash, Zcash). Miers asserts that decoy systems fail under scrutiny because they produce expanding cones of historical inputs and downstream spends, which he terms backward and forward "taint trees." These structures enable multiple deanonymization attacks. In an "overseer attack," a merchant correlates the intersecting backward taint trees of a recurring customer's payments to map their profile. In political dissident scenarios, a state adversary sending multiple distinct tracking donations can unmask a recipient depositing funds at a KYC-compliant exchange, because the probability of an unrelated user randomly selecting every tracking payment as a decoy approaches zero. Similarly, forward-facing "dusting attacks" allow third parties to monitor intersections between two targets' spending pools over repeated transactions. Privacy Theater Versus Production Zero-Knowledge Proofs (17:22) Miers criticizes the cryptocurrency industry's "privacy theater," where marketing materials promote laundry lists of cryptographic buzzwords—such as stealth addresses, ring signatures, and Tor integration—without assessing whether the protocol actually conceals the transaction graph. He compares adding decoy techniques to transparent ledgers to using an adhesive bandage to cover full exposure in Times Square, arguing that real security requires building protocols from the ground up. He emphasizes that performance bottlenecks are no longer an excuse to avoid robust cryptography. The Zcash Sapling upgrade demonstrated that shielded zero-knowledge proofs can be generated on-chain in under two seconds while consuming less than 40 megabytes of memory. Complementary projects like BOLT (for lightweight private layer-two channels) and Zexe (for private decentralized smart contracts) further prove that zero-knowledge architectures are deployable today. Network Leakage in Mimblewimble and Usability Hurdles (20:20) Even protocols designed to eliminate public transaction graphs face vulnerabilities at the networking and user-experience layers. Addressing the Mimblewimble protocol and Grin, Miers explains that while transaction cut-throughs merge inputs and outputs within a block, transactions must initially propagate across an open peer-to-peer gossip network. Any adversarial node logging un-aggregated network broadcasts can reconstruct the individual transactions and graph before block inclusion. Furthermore, Miers argues that the hardest remaining obstacle to privacy is usability rather than cryptography. Flawed user workflows—such as executing round-trip swaps of small amounts through instant exchanges—entirely strip away privacy. For privacy protocols to succeed, systems must deliver lightweight mobile experiences that do not force non-technical users to synchronize full node ledgers. Miers warns the industry against tolerating "TSA cryptography" that creates an illusion of security while leaving systemic linkability vectors intact. While mathematically rigorous zero-knowledge tools have solved performance constraints at layer one, resolving mobile usability and network-level privacy remains essential before a flawed cryptocurrency becomes the entrenched foundation of global commerce.

精炼阅读摘要

Zcash联合创始人兼Zcash基金会董事Ian Miers指出，主流区块链普遍存在的透明账本本质如同“银行账户的Twitter”，而业内广泛采用的诱饵式混淆方案在统计学攻击下极易失效，唯有从底层消除交易图谱的零知识证明才能提供真正的链上隐私。 公链透明度与商业监控的现实威胁 (1:18) Miers指出，当前主流公链公开广播交易发起方、接收方和金额，导致链上记录完全暴露。对于普通个人而言，这意味着日常开销会被熟人或跟踪者窥探；对于企业而言，竞对可以通过透明账本审计其整条供应链、掌握供应商报价，甚至利用员工薪资数据精准挖角；即便是主权国家，反对金融隐私也会使自身经济情报向外国敌对势力门户大开。 Miers将评估当前加密货币隐私比作在1992年万维网仅运行于CERN时评估互联网隐私，因为当前区块链缺乏日常真实支付的丰富行为数据。然而参考现实中的商业广告监测，从Google联合金融机构追踪实体零售收银数据，到Target通过购物元数据精准推断少女怀孕，乃至Venmo公开支付流导致的熟人监控，都证明了交易数据极易被算法利用。若公链不构建强防御，最终将沦为现实物理世界的追踪Cookie。 合理抗辩的破产与交易图谱隐藏需求 (6:44) 在机器学习、社会信用评分及精准监控普及的时代，Miers认为寄望于“无法证明地址属于我”的合理抗辩（Plausible Deniability）纯属不切实际的幻想。这种假设不仅无法阻止执法机构获取搜查令并在现实搜查中固定证据，更误解了链上隐私的真实威胁模型。链上隐私的核心威胁往往不是对交易一无所知的外在被动观察者，而是拥有交易锚点的主动交易对手方，如接受付款的商家、共同结账的朋友或资金分发方。 面对拥有业务交互信息的交易对手，仅靠隐藏IP地址或利用机密交易（Confidential Transactions）掩盖转账数值远远不够。只要输入与输出之间的关联未被切断，对手方就能以此为线索顺藤摸瓜遍历用户的完整财务历史。因此，协议必须从根本上彻底隐藏交易图谱本身。 诱饵混淆系统的三大致命攻击向量 (8:45) 针对主流隐私技术，Miers对比了完全透明系统（如Bitcoin、Ethereum）、诱饵混淆系统（如CoinJoin、Mimblewimble、Monero的RingCT）与屏蔽型零知识证明系统（如Zerocash、Zcash）。他明确指出诱饵类方案无法提供可靠隐私，其生成的双向“污点树”（Taint Tree）会导致结构性泄露。以“监视者攻击”为例，用户每日在星巴克等商户使用诱饵币消费，虽然单次交易有诱饵混淆，但若资金源自同一提币源（如交易所）或找零地址，多次消费的向后污点树将产生交集，商户便能通过统计关联勾勒出该用户的完整消费画像。 第二种是“定向充值攻击”，常用于去匿名化政治异见人士。若异见人士公开接收诱饵币捐赠并提现至受监控的实名合规交易所，敌对国家只需向其地址分发数笔特定标记款项。虽然单笔标记出现在充值污点树中可能归因于随机诱饵选取，但多笔标记同时被无关第三方全部选为诱饵的概率接近于零，足以导致身份暴露。第三种是“粉尘攻击”，第三方攻击者通过向目标朋友和特定商户分别发送微额粉尘，观察两者资金在链上扩散后的向前污点树。一旦二者输出在多次交易中反复合并，即可在无需入侵任何一方钱包的前提下，确认该朋友在特定平台的消费行为。 隐私剧场与零知识工程化进展 (17:22) Miers批判业内充斥着堆砌隐蔽地址、环签名、VPN或Tor等密码学词汇的“隐私剧场”。在全网广播的公链环境下使用打补丁式的微弱隐私方案，无异于“用胶带和工装裤拼凑宇航服”。他强调密码学原语仅仅是工具而非端到端方案，评估体系必须关注系统实际隐藏了什么、遗漏了什么以及在实际使用中是否安全。 与此同时，强隐私技术已不再停留在理论阶段。随着Sapling升级的上线，链上生成屏蔽零知识证明已缩短至2秒以内，内存消耗低于40MB，性能瓶颈不再是回避L1强隐私的借口。此外，基于链下轻量支付通道的BOLT协议以及支持去中心化隐私智能合约执行的Zexe研究，均展示了强隐私方案的可行性。Miers认为开发者已无理由继续采用存在已知缺陷的折中方案。 Miers呼吁行业摒弃虚假安全感的表面工夫。在底层密码学逐步成熟的背景下，真正的核心瓶颈转移到了用户体验与移动端轻量化：不当的用户习惯（如通过即时兑换平台进行无延迟的等额往返兑换）会彻底断送密码学保障，而要求普通移动端下载完整区块数据库亦不现实。此外针对Mimblewimble与Grin等方案，Miers在问答中强调，尽管其具备出色的数据压缩能力，但由于交易在区块聚合前必须经由P2P网络广播，监听节点仍可在广播层截获未聚合的独立交易并还原图谱，在解决网络层窥探前依然算不上充分的隐私方案。

Detailed notes — zh

## Background 该视频由以太坊基金会（Ethereum Foundation）于 2018 年 12 月 11 日发布在 YouTube 平台上，记录了密码学研究员兼 Zcash 联合创始人 Ian Miers 在 Devcon4 大会上的主题演讲。页面简介指出，比特币与以太坊等区块链默认是透明的，伪匿名交易极易被关联并带来严重隐私与可替代性隐患，演讲围绕业界提出的各类链上隐私技术方案的有效性、性能代价及适用场景展开深入探讨。 ## TL;DR Ian Miers 直言不讳地指出当前加密货币社区在隐私评估上的严重不足，形象地将透明区块链比作将用户财务底细广播给全世界的“银行账户的 Twitter”。他重点剖析了以 Monero、CoinJoin 为代表的“诱饵式（decoy-based）”系统的致命漏洞，证明通过监视者攻击、KYC 交易所交集比对以及前向尘埃追踪，攻击者能在多次交互中轻易瓦解诱饵并去匿名化。Miers 呼吁行业摒弃表面堆砌术语的“隐私安检剧场”与半吊子方案，转向以 ZK-SNARKs 为代表的彻底切断交易图谱的底层强隐私协议，并着力解决移动端体验与用户行为引导的落地瓶颈。 ## Atmosphere & style 演讲风格尖锐犀利、坦诚且极具学术底气，毫无吹捧自身项目的商业粉饰。Ian Miers 运用生动辛辣的比喻——从“时代广场上裸奔递创可贴”到“加密货币界的 TSA 剧场”——将深奥复杂的密码学与图论缺陷讲解得通俗而极具冲击力。整场分享节奏紧凑且充满技术理想主义的紧迫感，现场互动更是直面技术软肋，给听众带来如同冷水浇头般清醒的技术现实主义体验。 ## Bulletin - [00:00](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=0s) Ian Miers 直言透明加密货币是“银行账户的 Twitter”，若不彻底隐藏交易图谱，其透明特性将沦为现实世界中的“追踪 Cookie”与全景监控系统。 - [08:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=525s) 依赖诱饵（Decoy-based）的隐私方案在多次交互与图谱交集面前全面失效，攻击者可通过回溯污染树或发送尘埃交易轻易锁定用户真实身份。 - [19:10](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1150s) Zcash Sapling 升级已实现两秒内生成证明且内存消耗低于 40 MB，证明强隐私技术已具备高效落地的工程可行性，行业已无借口使用脆弱方案。 - [21:33](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1293s) Mimblewimble 与 Grin 虽能压缩链上数据并隐藏金额，但由于未经聚合的原始交易在广播至 P2P 内存池时完全暴露，仍无法阻断交易图谱被还原。 ## Key takeaways - [00:00](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=0s) 评估加密货币隐私的窗口期极短，若等到某种加密货币成为主流支付体系后再补救隐私缺陷，将在工程和现实中为时已晚。 - [00:00](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=0s) 透明链上交易会将用户的消费习惯、供应链数据及员工薪资无差别暴露给恶意见窥者、商业对手乃至敌对国家的情报机构。 - [02:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=165s) 当前加密货币缺乏日常真实消费图谱，加之学术界缺乏商业追踪数据库，评估未来 10 到 20 年的链上威胁主要依赖思想实验与现实违规先例。 - [06:44](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=404s) 面对 AI 分析与现实执法搜查，“合理推脱（Plausible Deniability）”在法律和现实对抗中根本构不成合格的运营安全防线。 - [06:44](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=404s) 区块链隐私的核心痛点不是防范无关的被动观察者，而是防范有直接资金往来的交易对手方，核心防御必须彻底切断并隐藏交易图谱。 - [08:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=525s) 诱饵系统（如 Monero、CoinJoin）本质上只是向信号中注入噪声，其向后辐射的“污染树”与向前扩散的圆锥体在数学上留下了可被破解的结构。 - [11:14](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=674s) “监视者攻击”表明，当用户在同一商户进行多次日常小额支付时，多笔交易的污染树会在共同资金源（如交易所提现或找零树）处产生交集，从而实现画像锁定。 - [12:19](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=739s) 国家级监视者只需向异见者收款地址发送少量标记交易，并在受监管交易所的客户充值图谱中求交集，即可在极低误报率下唯一锁定其 KYC 实名信息。 - [14:15](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=855s) 攻击者利用“尘埃交易”向前追踪，在多次重复交互后，前向概率圆锥的组合巧合迅速坍缩为零，足以确认用户的私密订阅或转账行为。 - [17:22](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1042s) 单纯罗列隐蔽地址、环签名、剪枝交易等“特性列表”并不等同于有效隐私，在暴露交易上下文的体系上打补丁犹如“在时代广场裸奔时贴创可贴”。 - [19:10](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1150s) 现代密码学（如 ZK-SNARKs、Bulletproofs）已能提供强隐私保障，而 Layer 2 支付通道 BOLT 与去中心化计算框架 ZEXE 进一步拓宽了强隐私的应用场景。 - [20:19](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1219s) 去中心化隐私目前最大的瓶颈在于用户体验与移动端实现，包括避免用户因畸形金额兑换泄露信息，以及无需同步全节点即可完成移动端隐私支付。 - [21:33](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1293s) 多数宣称隐私的项目本质上只是提供心理安慰的“安检剧场（Privacy Theater）”，并未真正抵御现实威胁。 - [21:33](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1293s) Mimblewimble 和 Grin 无法通过致盲因子彻底解决隐私问题，因为单笔交易在 P2P 内存池聚合前便被网络监听者捕获，依然泄露完整的交易图谱。 ## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=0s) 评估加密货币隐私的迫切性：“银行账户的 Twitter” 演讲者 Ian Miers 开门见山地表明本次演讲的核心目的并非为了推销（shill）Zcash——尽管他是 Zcash 的联合创始人，也是基金会董事会成员——而是探讨整个行业应如何科学评估加密货币的隐私性。他直言不讳地指出，整个社区在评估加密货币隐私方案上的表现非常糟糕，而现在必须尽快改掉这一短板。因为在不久的将来，以太坊、比特币、Zcash，甚至是狗狗币（Dogecoin）中的某一个，必将成为未来的支付体系。如果等到大规模落地之后才意识到这是个巨大的隐私灾难，届时想要修补将为时已晚。 Ian Miers 回忆起自己从 2011 年就开始研究加密货币隐私，当时他不确定比特币是否能成功，但他非常清楚一旦成功，必然会面临严重的隐私危机。而在那时，圈内几乎人人都天真地认为比特币是匿名的。如今看来，这种看法极其荒谬：不仅大量学术研究指出了比特币等币种的隐私漏洞，甚至已经催生了像 Chainalysis 这样以链上数据分析和地址追踪为核心业务的商业化公司。 他形象地将这种透明的加密货币称为“银行账户的 Twitter”——它把你所有的消费习惯、财务往来毫无保留地广播给所有人。这里的“所有人”包括： - 令人毛骨悚然的前任（窥探你的日常行踪与消费）； - 商业竞争对手（他们能借此完全看清你的供应链、掌握你给员工发放了多少薪水，进而进行恶意挖角）； - 各国政府（即使某国政府认为自己不想要加密货币隐私，但国际地缘政治中总有其他敌对政府想要掌握其经济情报）。 在区块链的公开透明特性下，没有任何实体愿意将这些敏感财务数据公开示众。针对这一痛点，业界提出了从极其粗糙到高度复杂的各种方案（例如 Ian Miers 本人历时五年博士论文研究攻关的 Zerocash 协议）。然而，核心问题始终摆在面前：这些隐私技术到底是否真正管用？ > “It wasn't clear to me that Bitcoin was gonna succeed, but it was clear to me that if it did, it was gonna have a pretty big privacy problem, and at the time everyone basically believed it was private.” —— Ian Miers --- ### [02:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=165s) 评估困境与现实启示：从定向广告到 Venmo 评估加密货币隐私的最大难点在于无法进行经验主义的实证测量（Empirical evaluation）。Ian Miers 将当下的加密货币生态比作 1992 年刚起步的互联网——那时整个万维网基本上只在欧洲核子研究组织（CERN）的几台机器上运行。当前的加密货币绝大多数充斥着投机交易，缺乏日常真实世界的消费数据结构（例如早晨刷卡买咖啡、乘坐地铁进站打卡、午餐购买快餐等具有时空关联的真实消费图谱）。此外，学术研究人员受限于科研伦理审查与经费预算，根本无力向商业分析公司采购链上追踪所使用的专有第三方数据库。因此，评估隐私只能依靠“思想实验（thought experiments）”，虽然这种方法极易在社交媒体上引发争议和偏见指责，但却是目前唯一可行的分析手段。 为了预判未来 10 到 20 年的链上威胁模型，必须参考现实世界中的隐私侵犯先例： 1. **定向广告追踪与线下支付**：以 Google 为代表的广告巨头不仅追踪线上浏览，还千方百计搜集用户在沃尔玛（Walmart）等实体店的线下支付数据。 2. **零售数据窥探生理隐私**：著名的 Target 超市案例显示，算法通过分析会员积分卡的购买记录，精准推断出一名青少年女孩怀孕，并直接向其家中寄送婴儿用品广告，导致其父亲意外发现了女儿怀孕的秘密。 3. **Venmo 的公开社交动态**：美国常用的转账软件 Venmo 曾默认开启社交动态信息流，将谁向谁付款以及付款备忘录向全网公开。媒体甚至刊发过诸如“如何用 Venmo 追踪你的前男友”的教程，其荒谬与窥探行为细思极恐。 加密货币正是将这一模式极端化——它不仅是银行账户的 Twitter，更是物理世界中的“追踪 Cookie（Tracking Cookie）”。如果不加防范，未来的区块链世界将会演变为以太坊或比特币版本的现实全景监控系统。 > “Cryptocurrency takes that and it's like web 3.0, but in reality, and this is clearly incredibly problematic.” —— Ian Miers --- ### [06:44](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=404s) 防御误区：为什么“合理推脱”不是隐私？ 面对如此严峻的隐私威胁，Ian Miers 告诫开发者首先要摒弃过去极度天真的防护思维：“合理推脱（Plausible Deniability）绝非合理的防御手段。” 在比特币早期，一种典型的极客心态是：如果在街角商店买了违禁品，面对质问只需坚称“你无法在数学上证明那个地址或交易属于我”。Ian Miers 讽刺这纯粹是“住在父母地下室里、用当年打反恐精英（Counter-Strike）的旧电脑挖矿的人才会想出来的逻辑”。在当今 AI 算法、人脸识别监控与精细化社会信用体系的时代，这种抗辩在现实面前不堪一击——当执法机关拿着搜查令上门时，所谓的合理推脱根本阻挡不了搜查和定罪，更称不上是合格的运营安全（OPSEC）。 区块链隐私的核心反直觉之处在于：向无关的被动观察者（Passive Observers）隐藏数据相对容易，但**隐私保护的核心目标是防范与你发生交易的对方**（向你付款的人、你付款的商家）。你不能让每一次交易的商家利用付款信息持续追踪你的后续财务。 因此，单纯隐藏 IP 地址或通过保密交易（Confidential Transactions）隐藏金额远远不够，核心防御必须切断并隐藏“交易图谱（Transaction Graph）”。正是在这一点上，现有的大多数方案仍然做得不够彻底。 ```mermaid flowchart TD accTitle: 链上隐私威胁与防护层级 accDescr: 展示从浅层混淆到深层交易图谱隐藏的不同防御维度 subgraph DefenseFailures ["失效或浅层的防护手段"] A["合理推脱 Plausible Deniability<br/>(无法对抗现实执法与司法搜查)"] B["隐藏 IP 地址 / 隐藏被动观察者<br/>(未解决交易对手方的持续追踪)"] C["仅隐藏交易金额<br/>(Confidential Transactions)"] end subgraph TrueCore ["区块链隐私的核心战场"] D["隐藏交易图谱 Transaction Graph"] E["切断交易双方与历史地址的关联"] end A -.->|"不足以应对"| D B -.->|"不足以应对"| D C -.->|"不足以应对"| D D --> E ``` - **早期认知偏差**：加密社区初期误以为地址字符串代表匿名，忽视了链上资金流向图谱的可关联性。 - **真实对抗环境**：商业分析公司（如 Chainalysis）结合法币入金口 KYC、链下数据爬取与聚类算法，使被动推脱彻底失效。 - **核心防御准则**：必须同时隐藏交易金额与交易图谱，才能防止收发双方反向追踪用户的资产全貌。 > “In a world of AI, social credit systems... and targeted advertising, plausible deniability is not a plausible defense.” —— Ian Miers ### [08:45](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=525s) 三种链上隐私设计范式与“诱饵系统”的假象 在讨论加密货币隐私时，Ian Miers 将现有的架构划分为三大流派。第一类是以 Bitcoin 和 Ethereum 为代表的透明系统，用户在发起支付时必须明确指明资金来源（无论通过 UTXO 还是账户模型），这使得完整的交易图谱（transaction graph）毫无保留地暴露在链上，根本谈不上任何隐私。第二类是以 CoinJoin、Mimblewimble 以及基于 CryptoNote、RingCT 的 Monero 为代表的“诱饵式”（decoy-based）系统；这类系统试图混淆交易图谱，通过引入例如 5 个甚至更多的可能来源（decoys）制造烟幕，对外宣称“这是真实来源，但这里还有 5 个其他可能性，谁也分不清谁是谁”。第三类则是以 Zerocoin 和 Zerocash（部署在 Zcash 等货币中）为代表的零知识证明方案，在启用隐私交易时完全不指明输入来源，交易图谱在数学层面上被彻底消除。 ```mermaid flowchart TD accTitle: 链上隐私架构分类与信息暴露对比 accDescr: 对比透明链、诱饵系统与零知识证明系统的输入暴露程度与交易图谱残留情况 subgraph Transparent["1. 完全透明链 (Bitcoin, Ethereum)"] T_In["明确指出唯一输入 (UTXO / Account)"] --> T_Graph["交易图谱完全泄露 (零隐私)"] end subgraph Decoy["2. 诱饵系统 (Monero, CoinJoin, Mimblewimble)"] D_In["真实输入 + 随机选取诱饵 (如 5/11 个)"] --> D_Graph["引入噪声干扰视线 (仍残留污染树)"] end subgraph Zero["3. 零知识方案 (Zerocash, Zcash)"] Z_In["完全隐藏输入来源 (Shielded Pool)"] --> Z_Graph["完全消除交易图谱"] end ``` 诱饵系统本质上是在信号中人工注入噪声（chaff），其核心假设是观察者只要“视力不够好”，就无法从杂乱的候选集中找出真实的交易路径。然而学术界和实证分析早已证明，虽然 Zerocash 这类系统在正确使用屏蔽功能（shielded features）时确实能提供坚不可摧的隐私，但基于诱饵的方法根本经不起推敲。Ian Miers 直言不讳地剧透：“The question is do these decoy based approaches work and spoilers the answer is no but are they private and the reason they aren't is because there's some interesting structure you can get out of this right”。当用户发起支付时，接收方看到的不仅是表面的几个诱饵，而是这些诱饵背后各自展开的可能来源；这种以 3、5 或 11 的倍数向后辐射的网状结构构成了一棵向后追溯的“污染树”（taint tree）。同理，资金向后流动时也会形成一个向前扩散的圆锥体（cone going forwards），正是这些固有的数学与图论结构彻底击溃了诱饵式隐私。 ### [11:14](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=674s) 监视者攻击：反复互动与共同来源交集 诱饵系统面临的第一个致命漏洞被称为“监视者攻击”（overseer attack）。Ian Miers 举了一个极为贴近日常的商业场景：假设某人在星巴克每天用自称具备隐私属性的加密货币购买咖啡，星巴克是否应该有能力据此建立该用户的每周咖啡因摄入画像，甚至将其出售给健康保险公司？理想状态下，真正像现金一样的隐私机制应当杜绝这种画像行为。但在诱饵系统中，这种保护完全失效。 当一名顾客连续向星巴克发起第一笔、第二笔、第三笔支付时，每次交易在链上都会生成一棵向前追溯的“污染树”。表面上看，每笔交易包含若干个独立的随机诱饵，单笔交易并不存在直接连线；然而只要将多笔交易的整张图谱放在一起比对，攻击者就会立即发现这些树状图谱的“交集”（intersections）。在现实经济活动中，用户用于日常小额支付的资金往往具有共同的源头——例如它们可能都来自用户不久前从 Coinbase 或 ShapeShift 提现的那笔大额交易，或者来自用户同一个找零地址树（change transactions）。通过寻找多棵“污染树”在回溯路径上的共同祖先节点，商家轻而易举就能将看似毫无关联的日常消费记录锁定在同一个人身上。 ### [12:19](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=739s) 异见者困境：定向追踪与 KYC 交易所的去匿名化 针对接收方的定向追踪则暴露了诱饵系统更加凶险的安全隐患，甚至会直接带来人身危险。Ian Miers 设定了一个极端的政治异见者案例：假设身处沙特阿拉伯的异见者 Bob 在暗网上建立了一个接受匿名捐款的网站，并对外公布了收款地址。由于轻信了诱饵系统的匿名宣传，Bob 以为外人绝对无法追踪这笔资金，便将其提现并存入了一家中东本地受监管的中心化加密货币交易所——而该交易所掌握着 Bob 详尽的 KYC 身份信息。 ```mermaid flowchart LR accTitle: 异见者捐款追踪与交易所 KYC 碰撞流程 accDescr: 攻击者向异见者地址发送多笔带有标记的交易，随后在被攻破的交易所客户污染树中求交集，唯一锁定异见者真实身份 subgraph Attacker["攻击者 (监视者)"] TX1["追踪交易 1 (绿色标记)"] TX2["追踪交易 2"] TXn["追踪交易 N"] end subgraph Target["目标 (Bob / 异见者)"] Site["暗网捐款地址"] --> Dep["提现并充值至本地交易所"] end subgraph Exchange["被传唤/攻破的 KYC 交易所"] DB["所有客户存款的向前污染树"] Hit["高概率唯一交集 = Bob 的实名账户"] end TX1 --> Site TX2 --> Site TXn --> Site Dep --> DB DB --> Hit ``` 当国家级监视机构（如沙特当局）想要查明站长身份时，他们只需向该暗网地址发起两到三次“追踪标记支付”（tracking payments），随后通过传票或黑客手段调取该交易所所有客户的充值链上记录。由于所有正常用户都会在链上随机选取诱饵，某个无辜客户的“污染树”中碰巧包含了某笔追踪支付是存在小概率可能的（例如 5% 的概率），执法机构或许不会仅凭这种微弱的概率去抓人。然而，一旦监视者发送了多笔追踪交易，任何一个无辜者同时在自身“污染树”中碰巧包含全部这几笔追踪交易的概率，在数学上便无限趋近于零。 - 攻击者只需利用少量几笔带标记的交易（tracking payments）进行定向测试。 - 交易所端全量客户“污染树”与攻击测试集的重合概率呈现指数级衰减，瞬间剔除所有误报。 - 最终锁定的充值账户 KYC 记录必然属于该异见者本人。 - 这种去匿名化直接导致目标被捕乃至面临更严酷的下场，而受害者自始至终误以为自己的交易坚不可摧。 Ian Miers 严厉警示道：“And so it turns out that repeated interactions with a sender or a recipient are dangerous and this is where most privacy coins break.”绝大多数隐私币之所以全线溃败，根本原因在于设计者完全脱离了真实应用场景中“多次往返交易”的现实规律。 ### [14:15](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=855s) 尘埃前向追踪：尴尬的订阅关联与“嗅探测试”的惨败 如果说向后回溯污染树已经足够危险，那么向前观察资金去向的攻击则更具侵略性。Ian Miers 描述了一种基于链上“尘埃”（dust payments）的前向追踪手法。假设攻击者想探查某位朋友是否在特定商户（例如成人网站 Pornhub）上有持续的消费行为，攻击者只需要分别向该朋友的地址和该商户的收款地址各发送一笔极微小额度的“尘埃交易”。 随着时间推移，这两笔资金分别向前流动，在链上各自演变成不断扩散的概率圆锥（被称为某种奇怪的“量子泡沫” quantum foam）。如果仅发生一次偶然重叠——例如朋友的某一笔支出与商户资金汇总到了同一个热钱包或冷钱包地址——这或许只是诱饵选取的巧合，信息量不足以下定论。但如果攻击者反复发送尘埃交易，观察到该现象重复发生 3 次、5 次甚至 20 次，那么这种多次交互纯属巧合的概率将彻底降为零。攻击者不仅能够坐实朋友在订阅成人网站，甚至还能调侃其消费品味：“And I guess worse actually he's probably paying for porn with Verge which really like you have get better taste in friends.” Ian Miers 总结指出，只需稍加推敲，就能设计出至少三种足以颠覆诱饵系统的合理攻击模式；这类方案在基本逻辑上根本通不过“嗅探测试”（smell test），不应在严肃环境中使用。至于为什么行业内仍有权威人士将其视为可行的隐私方案，一部分原因在于隐私本身极其复杂晦涩，开发者往往出于好意却能力有限（“to err is human”）；另一部分原因则是加密货币圈内盛行的吹嘘与自我营销文化（self-promotion）蒙蔽了客观的技术评估，造成了“中本聪其实没穿衣服”（Satoshi really has no clothes）的行业盲区。 - 攻击成本极低：无需巨额资金，攻击者仅凭少量甚至微尘级别的定向转账即可实施长期测绘。 - 多次统计锁定：前向扩散图谱在多次互动叠加后，诱饵带来的模糊性在组合数学层面迅速坍缩。 - 理论不达标：即便尚未在全网范围开展大规模实证测算，其底层假设的数学漏洞也决定了诱饵机制无法承担真正的隐私重任。 ### [17:22](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1042s) 隐私虚荣与“特性列表”的陷阱 Ian Miers 严厉批判了当前隐私币社区普遍存在的“特性列表”营销现象。特别是当你在 Twitter 上与某些隐私币的支持者交流时，他们往往会掏出一长串听起来极其高大上的技术术语清单：隐蔽地址（Stealth Addresses）、环签名（Ring Signatures）、剪枝交易（Cut-throughs）、ZK-SNARKs、VPN、Tor 等等。然而，堆砌特性根本无法说明用户究竟获得了什么样的实际隐私保障。Miers 直言，许多技术本身根本起不到保护作用，而像 ZK-SNARKs 这类确实极具前景的技术，也仅仅是一个工具或组件，并不能等同于完整的解决方案。评估一套系统，必须从整个协议的运作机制出发，看它实际隐藏了什么、是否真正隐藏彻底，而不是看它宣传了多少特性。 现实中，绝大多数方案不仅隐藏的信息极其有限，防范效果糟糕，更无法遮蔽其余暴露的交易上下文。由于缺乏严密的安全考量，实际使用方式往往充斥着危险。Miers 用了一个极为形象且尖锐的比喻：“加密货币就是给你的银行账户开了一个 Twitter，它是一个彻底的隐私黑洞，一切都被广播给所有人；这无异于我告诉你，你正光着身子站在时代广场上。”而现如今绝大多数隐私币所提供的解决方案，简直就像是递给你一个创可贴。面对全身赤裸的巨大暴露风险，创可贴根本起不到任何遮挡作用。依靠胶带和工装连体裤是造不出太空服的，想要在极端恶劣且全公开的敌对环境中生存，唯一可行的路径就是从底层开始全盘重构。 ```mermaid flowchart TD accTitle: 假隐私特性与真协议工程对比 accDescr: 对比单纯堆砌密码学特性的虚荣方案与从底层全盘重构的完整协议方案 subgraph Hollow["表面特性堆砌（隐私黑洞 / 创可贴式防护）"] A["口头宣传特性<br/>环签名 / 隐蔽地址 / 剪枝"] --> B["隐藏内容极少且漏洞百出"] B --> C["交易图谱与上下文完全暴露"] end subgraph Deep["从底层系统重构（全协议工程化方案）"] D["严密加密学基础<br/>ZK-SNARKs / Bulletproofs"] --> E["全链路协议评估与验证"] E --> F["强隐私保障与抗分析能力"] end ``` ### [19:10](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1150s) 强隐私方案与前沿协议落地 Miers 表示虽然不想单纯为 Zcash 站台，但他不得不提到强隐私技术目前已经取得的突破。在演讲当下的前两天（由于连续熬夜赶工，他幽默地表示自己甚至都过糊涂了日期），Zcash 刚刚上线了全新的升级版本（Sapling），成功实现了两秒内生成一笔交易、内存消耗低于 40 MB 的惊人性能。这意味着基于零知识证明的高强度隐私保护已经完全能够快速、轻量地落地，而且这些成果是开放给所有加密货币参考采用的。 除了用于 Layer 1 的 Zerocash 范式外，还有许多未上线的强隐私前沿技术正蓄势待发： - **BOLT（Blind Off-chain Lightweight Transactions）**：一种用于 Layer 2 的强隐私离线轻量级支付通道协议，他们目前正在为此建立 Bolt Labs。 - **ZEXE（Zero-knowledge EXEcution）**：源自一篇前沿学术论文，能够实现完全去中心化的隐私计算与隐私通信。 Miers 强调，当今行业在密码学上已经没有任何借口继续沿用脆弱的半吊子隐私技术：“如今真的没有任何借口再去使用那些脆弱的隐私技术了；我们拥有强大的工具，无论是使用 ZK-SNARKs、Bulletproofs 还是其他密码学方案，大家都应该用上强隐私，绝不该继续搞半吊子妥协，更不该在根本不安全时对用户谎称自身具有隐私。” ### [20:19](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1219s) 用户体验与移动端的终极挑战 摆在去中心化隐私面前的另一座大山是可用性（Usability）和用户体验（UX），这也是 Zcash 团队自身深有体会的痛点。拥有坚不可摧的底层密码学远远不够，如果 UX 糟糕，系统无法引导用户避开无意义且危险的盲目操作，隐私就会全面崩溃。一个典型例子就是用户常常用精确到几分钱的畸形金额去使用兑换服务（例如通过 ShapeShift 将 53.52 美元兑换成 Monero、Zcash 或 Dash，紧接着又立刻兑换回原币种），由于链上进出数额与时间完全吻合，任何人一眼就能串联出整个交易链条，用户费尽周折却连一丝隐私都没买到。 Miers 认为底层核心协议的设计在理论上“基本已经完成”，未来的性能优化或底层密码学假设的革新固然重要，但构建隐私当下最艰难、最迫切的工作落在了移动端和用户端： - **移动端全隐私支付**：这是根本性的协议层挑战，不能强迫移动端用户同步整条区块链数据库才允许发起隐私支付。 - **用户行为引导与教育**：在协议与产品设计层面阻止容易破坏匿名集的操作模式。 ### [21:33](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=1293s) 拒绝“安检剧场”与问答剖析（Mimblewimble 与 Grin） Miers 总结道，绝大多数所谓的隐私币在对抗现实审查时表现糟糕透顶：商家可以在你付款时顺藤摸瓜追踪你；只要你在网上公布过一个地址，政府就能直接锁定你的现实身份；甚至朋友都能轻而易举侦测到你是不是频繁向 Pornhub 等敏感网站转账。这种基于诱饵（Decoys）的混淆方法在根本上就是不可行的。他犀利地抨击许多项目不过是在效仿美国运输安全管理局（TSA）搞“隐私安检剧场”（Privacy Theater）：“这就像很多加密货币本质上就是 TSA，搞了一大堆看起来光鲜亮丽的排场，让你心理上感觉稍微安全了一点，但归根结底它们根本解决不了问题，无法为你提供真正的保护，这糟糕透顶。” 在演讲随后的问答环节中，一位听众提问：像 Grin 这样基于 Mimblewimble 协议、不谈 CoinJoin 混币部分、仅为每笔交易使用不同致盲因子（Blinding Factors）的设计，能否真正改善隐私？ Miers 明确回应：“并不能真正改善。”他解释道，Mimblewimble 和 Grin 虽然在链上数据压缩方面极其出色且令人期待，但其底层的 Mimblewimble 交易机制仍然明确指明了所花费的 UTXO 并生成新的输出。尽管金额被 Pederson 承诺隐藏，但交易图谱（Transaction Graph）依然赤裸裸地暴露在网络中。理论上，它们依靠非交互式的交易聚合（Cut-through / Aggregate）把多个交易混合在一起打碎图谱，但在现实中，所有未经聚合的单笔交易必须首先广播到开放的 P2P 内存池（mempool）中。任何连接到 P2P 网络的监听节点（无论是学术研究员还是情报机构）都可以直接监听并下载所有的原始单笔交易，从而轻而易举地还原出完整的交易图谱。在 P2P 广播层面的信息泄露找到根本解法之前，它绝不能算作一个合格的隐私方案。 ## Notable quotes > [06:44](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=404s) In a world of AI, social credit systems... and targeted advertising, plausible deniability is not a plausible defense. — Ian Miers > [12:19](https://www.youtube.com/watch?v=9s3EbSKDA3o&t=739s) And so it turns out that repeated interactions with a sender or a recipient are dangerous and this is where most privacy coins break. — Ian Miers ## Mentioned Ian Miers, Zcash, Ethereum Foundation, Bitcoin, Ethereum, Dogecoin, Chainalysis, Zerocash, Zerocoin, Google, Walmart, Target, Venmo, CoinJoin, Mimblewimble, Monero, CryptoNote, RingCT, Coinbase, ShapeShift, Pornhub, Verge, ZK-SNARKs, Bulletproofs, Sapling, BOLT, Bolt Labs, ZEXE, Dash, TSA, Grin ## Video description Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more. https://archive.devcon.org/archive/watch/4/satoshi-has-no-clothes-failures-in-on-chain-privacy Payments in Ethereum and Bitcoin are, by default, transparent. Transactions are conducted between pseudonyms with the sender, recipient and value exposed. While this transparency enhances auditability and decentralization, it is a major privacy issue. A growing volume of research shows that these pseudonymous identities are easily linkable. This is a major issue for privacy, fungibility, and a free market. A variety of techniques have been proposed to alleviate these issues. These include but are not limited to Confidential transactions + Conjoin, RingCT/Cryptnote, Zerocoin, Zerocash,  Hawk, and Solidus. These techniques span a large multidimensional performance envelope in terms of transactions generation and validation time, size, as well as a range of cryptographic assumptions and data retention requirements. At the same time, these protocols offer markedly different levels of privacy against various threat models. Which one should we use? If performance were the sole issue, then systems without such enhancements would likely be preferred. Clearly some amount of privacy is necessary and the cost of getting it acceptable. The question is thus, which approaches provide sufficient privacy, in what contexts, and at what cost? Speaker(s): Ian Miers Skill level: Beginner Track: Privacy Keywords: security Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum Learn more about devcon: https://www.devcon.org/ Learn more about ethereum: https://ethereum.org/ Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. Devcon 4 was held in Prague, Czech Republic on Oct 30 - Nov 2, 2018. Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/ [Source](https://www.youtube.com/watch?v=9s3EbSKDA3o)

Source quotes

[6:44] Ian Miers: In a world of AI, social credit systems... and targeted advertising, plausible deniability is not a plausible defense. [12:19] Ian Miers: And so it turns out that repeated interactions with a sender or a recipient are dangerous and this is where most privacy coins break.

Source quotes

[21:33] Ian Miers: The problem with Mimblewimble and Grin—so far, it's really promising techniques for compression—is that in a Mimblewimble transaction, you identify the UTXO you're spending and you generate a new output; you hide the values or hide the addresses, but the transaction graph is still there.

Original transcript

[0:00] really the point of this talk is how do [0:02] you evaluate privacy in cryptocurrencies [0:04] the point is not the shells e-cash I am [0:07] one of the cofounders of Z cash I am on [0:08] the board of directors of the foundation [0:10] but that's not why I'm here today the [0:13] point is that we as a community have [0:15] done a very poor job evaluating privacy [0:17] approaches for cryptocurrencies and the [0:20] problem is that we need to get better at [0:21] it and we need to get better at it now [0:23] because at least one of these aetherium [0:26] bitcoins e-cash something that all of us [0:28] have ever heard of maybe dogecoin I [0:30] don't know is going to be the future of [0:32] payments and it's gonna take a while but [0:35] at some point when this happens we're [0:36] gonna realize that this is a major [0:37] privacy problem we wait until then to [0:39] actually address it it will be far too [0:42] late so I've been working on privacy and [0:44] cryptocurrencies since 2011 for [0:47] precisely that reason it wasn't clear to [0:49] me that Bitcoin was gonna succeed but it [0:51] was clear to me that if it did it was [0:52] gonna have a pretty big privacy problem [0:53] and at the time everyone basically [0:55] believed it was private this was sort of [0:57] the best logic that everybody had and of [1:00] course we know now how laughable that is [1:02] not only are there a bunch of academic [1:06] research that identifies privacy flaws [1:08] in Bitcoin and other cryptocurrencies [1:10] there are actually commercial companies [1:12] in the business of doing analytics and [1:14] figuring out what's going on so this is [1:16] laughable right don't believe it [1:18] in fact far from being you know [1:20] anonymous it is in fact [1:22] Twitter for your bank account right [1:24] cryptocurrencies expose all of your [1:25] spending habits to everybody right and [1:28] by everybody I mean everybody your [1:30] creepy ex girlfriend or boyfriend your [1:32] business competitors right if you're [1:34] trying to compete with someone they can [1:36] figure out what your supply chain is how [1:37] much you're paying your employees use [1:39] that to poach them etc right everybody [1:41] right if your government right and you [1:43] think you want you don't want privacy [1:45] for crypto currencies think again [1:46] because there are other governments out [1:49] there that don't like your government I [1:50] don't care if you the Chinese the [1:51] Russians or the Americans somewhere in [1:53] that triangle there's someone out to get [1:55] you and they also would love to have [1:57] economic information about how to [1:58] you so nobody wants this [2:00] information to be public to everybody [2:02] and it really is today that's the nature [2:04] of a blockchain and so as we thought of [2:08] this there have been a lot of proposals [2:09] on how to [2:11] add some amount of privacy to [2:12] cryptocurrencies and these range from [2:15] very mundane systems that have no chance [2:17] of actually working all the way up to [2:19] very sophisticated ones zero cash on [2:21] there was actually my doctoral thesis [2:23] route took me about five years to finish [2:25] all the details of it the question is [2:28] how old are these things work because no [2:30] matter who you are if you're designing a [2:31] cryptocurrency at some point you're [2:33] gonna need to add privacy to it and you [2:35] really need to use one of these [2:36] techniques or something else that's come [2:38] along I need to know if it's actually [2:39] private and this is hard evaluating [2:45] privacy for cryptocurrencies is not easy [2:47] right to do it empirically would be akin [2:48] to trying to evaluate privacy for the [2:51] internet in 1992 when everything was [2:53] just started when the first things that [2:55] were running were only at CERN right we [2:57] can't measure it empirically right we [2:59] don't have really real-world usage that [3:02] isn't too speculative right we don't [3:03] have day-to-day usage we don't have this [3:05] rich tapestry of data where I buy a [3:08] coffee I go to the subway I could check [3:10] into the metro then I buy stuff at lunch [3:11] which has some structure none of that [3:13] exists so there was no way to do this [3:15] empirically and more of our I as a [3:17] researcher even what little data there [3:19] is out there I don't have access to [3:20] you're right I have budgetary [3:21] limitations I have ethics limitations I [3:23] can't buy these third-party data sets [3:25] that Chan alysus and other people use so [3:27] we really have no way to do this [3:29] empirically and as a result what we have [3:30] to do is we have to result the thought [3:32] experiments and this is somewhat [3:33] unsatisfactory because it's not [3:36] empirical evidence it's very easy to [3:37] accuse people of being biased at some [3:39] point Twitter will probably start going [3:41] on about that you know as people start [3:43] tweeting slides right now about me but [3:45] it's the only thing we have right and to [3:47] do that you need to understand what [3:49] attacks really look like and we need to [3:51] look to other things where you've had [3:52] privacy problems as inspiration because [3:54] we're looking 10 20 years down the line [3:57] for this since we can't look at [3:58] cryptocurrency today to find out what [3:59] the problems are going to be in 10 years [4:02] and so what are real-world threats well [4:05] the easiest thing to look at is what [4:08] advertisers do with payment data so [4:10] where you've seen advertisers such as [4:12] Google collecting all kinds of data [4:13] about payments you make not just online [4:16] but these are actually trying to get [4:17] real-world payments you make when you [4:19] walk into Walmart [4:20] all two-year something and try to make a [4:23] purchase and Google's gotten a lot of [4:25] headlines about this because hey Google [4:27] is evil it's a very good one but reality [4:29] the matter is everybody's doing this and [4:31] in fact Google is probably one of the [4:32] more scrupulous people at the moment [4:34] that they're doing it you can be assured [4:36] that there are people doing far sketch [4:37] you of things with this data right and [4:40] what can you do with that well one thing [4:42] that actually is a pretty old story you [4:44] can use payment shopping data to figure [4:46] out for example when someone is pregnant [4:47] in this case you can target was building [4:50] up profiles based on customer loyalty [4:52] cards of who bought what and then they [4:54] were identified for example pregnant [4:56] women and send them ads for baby [4:58] products and in this particular case [5:01] they did this to a teenager sent the ads [5:03] drawer house her father saw them and [5:05] from there well father found out that [5:08] her daughter whose daughter was having [5:09] sex and was pregnant kind of a problem [5:12] and so this is the kind of thing we're [5:13] looking at and in fact we've seen stuff [5:15] closer to home with payment systems [5:17] where venmo which for those of you who [5:19] don't know there know is a way that you [5:20] can pay your friends for example for [5:23] dinner in common in the states when we [5:25] don't have very effective payment [5:27] systems like European banking but anyway [5:29] VIN Moe US start-up had a social feed [5:32] because everything is social these days [5:34] of payments you made of who from who to [5:37] who and why and this was by default [5:40] public and so people found out about [5:41] this and started writing things like [5:43] here he was a nice guide to how to stack [5:46] the stock your ex-boyfriend and of [5:48] course this is you know kind of cute [5:49] it's got a fun laughy picture but if I [5:51] flip the genders on this or you know [5:53] really gave it any kind of appropriate [5:55] treatment you draw this it's completely [5:56] creepy right and this is really someone [5:58] actually doing this not tongue-in-cheek [5:59] and so no later if we keep doing this [6:02] you end up with the same thing but how [6:03] to stock your ex using aetherium or [6:06] Bitcoin or whatever and this is the [6:10] problem right so what I said [6:12] cryptocurrency was Twitter for your bank [6:14] account it's an accurate statement but [6:16] it doesn't entirely tell you how things [6:18] go wrong and I think one of the things [6:20] you should think of is that it's a [6:21] tracking cookie in real life right so [6:23] we're used to these notions of we are [6:25] tracked on the internet everything we do [6:26] on a day to day basis is catalogued by [6:28] Google by double-click by Facebook well [6:31] cryptocurrency takes that and [6:33] it's like web 3.0 but in reality and [6:36] this is clearly incredibly problematic [6:38] so we really need to get this to work to [6:42] stop this and so how do we do that what [6:44] are the defenses well the first thing if [6:47] you take nothing else from this talk is [6:49] that in a world of AI social credit [6:51] systems you've probably seen that video [6:53] going around on Twitter from the train [6:54] in China and targeted advertising [6:57] plausible deniability is not a plausible [6:59] defense right so the original model for [7:02] privacy and Bitcoin in particular was [7:04] this idea of if someone shows up and [7:07] says hey did you buy weed at you know a [7:09] corner store or whatever you can point [7:11] to and go oh well you can't prove that [7:12] transaction was mine and this is sort of [7:15] the kind of mentality that someone who [7:17] lives in their parents basement and been [7:19] mining cryptocurrency and what they used [7:20] to use to play counter-strike would come [7:22] up with but it doesn't work right it [7:24] doesn't work in reality now and it [7:26] didn't work in reality then right [7:27] because look if the police are gonna [7:29] show up at your door and ask you what [7:30] you were doing [7:31] plausible deniability isn't gonna get [7:33] you out of a search warrant isn't gonna [7:34] get you out of what they find and they [7:35] start to think this is not a good way to [7:37] do OPSEC in any way shape or form but it [7:39] was what people were trying to do so [7:40] don't do that do something at least [7:42] slightly better and the problem with [7:46] what is better is that blockchain [7:47] privacy is in fact not intuitive right [7:50] cryptocurrencies broadcast all of your [7:52] transactions to everybody and this is [7:54] the thing that people sort of revolt on [7:56] like you had a gag in your mouth ago [7:58] what we got to fix that and it actually [8:00] turns out to be easy enough to obscure [8:02] the data on a blockchain from passive [8:04] observers who have nothing to do with [8:05] you and know nothing about you it's not [8:07] easy to do perfectly but you can do it [8:09] but that's not who you need privacy from [8:12] you need privacy from people who send [8:14] you payments and people you send [8:15] payments to right merchants you don't [8:18] want to be able to track you you don't [8:19] want people to identify you based on [8:21] putting payment information up online [8:22] and once you get to that hiding [8:26] transaction values confidential [8:28] transactions or whatever or hiding your [8:30] IP address isn't enough you need to hide [8:32] the transaction graph and this turns out [8:33] to be really what a lot of the more [8:36] promising things in here focus on but [8:38] even then they don't do that good a job [8:40] right so there's sort of three sets of [8:42] approaches to privacy you can think of [8:45] there's Bitcoin [8:46] atheria etc where you just explicitly [8:48] identify the origin of your payment [8:50] either of you TXO or the account and [8:52] this leaks the transaction graph [8:53] completely there is no privacy right [8:55] then there are the so-called decoy [8:57] transaction based systems which try to [8:59] obscure the transaction graph these look [9:01] like something will you pick five [9:02] possible decoy sources and say look this [9:05] is the real origin for my payment but [9:07] here are five other things which it [9:09] could have been and no one knows which [9:10] ones which it's just sort of a mess and [9:14] this looks like coin join nimble Wimble [9:15] etc or crypto runo ring CT Manero and so [9:19] that's one set of approaches and then [9:21] finally though the approaches of zero [9:22] coin in zero cash are deployed in a [9:24] couple of different Kippur currencies [9:25] where you don't identify the origin at [9:27] all and you have no transaction graph to [9:29] recover at least if you use the [9:31] privacy-preserving transactions right so [9:33] what does this look like visually well [9:34] in Bitcoin you have to if you're paying [9:36] a merchant you have to identify the [9:38] exact origin in decoyroid system such as [9:42] Manero same thing you have to identify [9:44] the origin but it hides amongst a couple [9:47] of different locations right and then [9:49] that's sort of this is what you're doing [9:52] you're adding noise right it's chaff [9:53] right the real transaction is somewhere [9:55] in there but hopefully if you don't have [9:56] very good vision you can't figure out [9:58] where it is and then there are things [10:01] like zero cash z cash where this data [10:03] just is not there right and so we know [10:06] that Bitcoin isn't private we there's [10:09] been a lot of analysis on zero cash grow [10:10] academically and empirically we know [10:12] that the privacy holds up if you use the [10:14] shielded features and use them well the [10:17] question is do these decoy based [10:18] approaches work and spoilers the answer [10:20] is no but are they private and the [10:24] reason they aren't is because there's [10:26] some interesting structure you can get [10:27] out of this right when you make a [10:30] payment to a merchant what they see is [10:33] not these three decoys they see those [10:35] decoys and their possible origins as [10:37] well right there's you know each payment [10:39] is a possible source each one of those [10:41] has three possible sources of five or 11 [10:43] or whatever it is and sort of fans out [10:44] backwards and this sort of tree of [10:46] possible things that you weren't [10:47] interacted with you can call it I could [10:49] think of it as a taint tree and you can [10:52] also use this going forwards right if I [10:54] pay emergent right I see where the money [10:56] goes and then I see everyone who tries [10:58] to spend that [10:59] and some of those people are gonna be [11:00] spending it as a decoy right it won't be [11:02] legitimately theirs but one of those [11:04] will be the merchants and again this [11:05] fans out right there are three possible [11:07] things that were spent in each one of [11:08] those as three possible things that were [11:09] spent and we just keep going forward so [11:11] it's cone going back cone going forwards [11:14] and so this has a couple of immediate [11:17] problems that should make it clear that [11:19] you know things are not what you think [11:22] things are not completely private right [11:23] and so the most obvious one is what I'm [11:25] going to call an overseer attack which [11:27] is suppose your merchants say your [11:28] Starbucks and you have someone coming in [11:31] and buying coffee every day and they're [11:33] buying it with the cryptocurrency that's [11:35] private should Starbucks be able to [11:36] build a profile of how much caffeine [11:38] you're drinking on a week maybe sell it [11:39] to your health insurance company or [11:41] something ideally no right privacy [11:44] should mean that's not possible they [11:45] learned nothing should be as private as [11:47] cash except that's not true right [11:48] because if you make one payment to [11:50] Starbucks and then you make another and [11:52] you make a third they're gonna see these [11:54] different taint trees for each one of [11:55] these transactions and there's no [11:57] immediate linkage between them so you [11:59] might think it's private but of course [12:01] if you look through this entire graph [12:04] you're gonna see intersections in it [12:05] because the payments are going to have [12:07] common origins right you're gonna have [12:08] loaded all the funds off of some [12:09] transaction on coinbase or shape-shift [12:11] or whatever at one point or you change [12:13] transactions every use so this is a [12:15] basic intersection right so there's that [12:19] here's another one let's suppose you [12:21] were dissident right in Saudi Arabia you [12:23] have a website on the dark web that you [12:26] use to take donations right poor right [12:28] taking anonymous put another to dress up [12:30] your anonymous you should be completely [12:32] safe [12:33] they're never gonna figure out who you [12:34] are and so because you think it's [12:36] private you take that money and you [12:37] immediately deposit it in a [12:39] cryptocurrency exchange in the Mideast [12:40] that actually has all your kyc data they [12:42] know who you are because of things [12:44] private no one should be able to blink [12:46] the address online that's receiving [12:48] payments with your deposits that would [12:51] be another thing you'd expect from a [12:52] private cryptocurrency yeah [12:54] and well you don't get it here a reason [12:58] for this is that say Bob is this [13:01] dissident and he's taking funds and he's [13:03] going to deposit all of them right again [13:05] when you if you pay Bob two or three or [13:08] four times and you deposit these things [13:10] and you look at 13 [13:11] right if you are the Saudis and you [13:13] compromise this exchange you subpoena it [13:15] you hack into it whatever it is you're [13:17] gonna get for every customer [13:19] these taint trees of every possible [13:21] payment they got and if you see someone [13:23] who got one of these like tracking [13:24] payments you made say the green one [13:26] they're gonna be a couple of people who [13:28] got those right because everyone picks [13:30] decoys at random someone might have just [13:32] picked that by accident right and at [13:34] least right now things aren't bad enough [13:36] you're willing to just go shoot anyone [13:37] based on me like five percent chance [13:38] that they were actually your target [13:40] however you didn't send one payment you [13:43] sent a bunch and so what are the odds [13:44] that some person has all of those [13:46] payments in their taint trees right that [13:49] all of these things are deposited in [13:50] their account no approximately zero and [13:52] so now you have with high probability [13:53] identified the person and so this is [13:56] really bad this is going to get you [13:57] arrested or worse again you thought it [14:02] was private that's not right and so it [14:04] turns out they repeated interactions [14:05] with a cinder or a recipient are [14:06] dangerous alright and this is where most [14:08] privacy coins break right and this is [14:11] just because no one is thinking about [14:13] these things in the context they're [14:14] really gonna be used but that's not even [14:15] the worst thing you can do right so [14:17] remember I said there's at Aintree [14:19] you're looking backwards you can see [14:21] what where the coins have gone well I'm [14:22] also looking forward when you pay [14:24] someone as I mentioned you can see where [14:25] payments may have gone and this is again [14:27] it's uncertain it's some kind of sort of [14:29] weird quantum foam but there's a little [14:30] bit of information in there and what can [14:34] happen is let's suppose you want to find [14:37] out if a friend of yours is making [14:38] repeated payments to our particular [14:40] merchant so you send the merchant one [14:43] transaction and you send your friend one [14:45] transaction and these can be dust right [14:46] little tiny amounts and you're gonna see [14:49] these two sort of things fan out over [14:51] time of where the money goes and then [14:53] you don't learn anything until maybe [14:55] some of the money you paid your friend [14:56] ends up in the same address as somewhat [14:59] something you paid the merchants and [15:00] this doesn't tell you much it could be [15:02] that did someone just pick the decoy [15:04] that happened to overlap it could be [15:06] that the merchant that your friend paid [15:07] the merchant and was moving their money [15:09] into off of their hot wall into a cold [15:12] store or something you don't know [15:14] there's not enough information here to [15:15] really count but you suggest something [15:17] might be going on okay but what happens [15:19] if this again happens multiple times now [15:22] you know that something is wrong now you [15:23] actually have information these [15:25] the odds of this happening by [15:27] happenstance because it's repeated [15:28] interactions are approximately zero [15:30] right and then you can watch this happen [15:32] 3 4 5 10 20 times and now you really [15:35] know for sure and so for example you [15:38] could use this to you know if the [15:40] merchant was pornhub you would use this [15:42] to confirm that your friend was in fact [15:43] subscribing to pornhub and that would be [15:45] somewhat embarrassing right hey he's [15:47] looking at porn be he's paying for porn [15:49] and I guess worse actually [15:52] he's probably paying for porn with Verge [15:55] which really like you have get better [15:59] taste taste and friends so again this is [16:04] again I think fundamentally violates [16:05] what you'd expect from a privacy coin [16:07] right it shouldn't be the case that [16:08] random people by sending you know [16:10] tainted dust to a bunch of different [16:11] addresses can recover how things are [16:13] being spent but in fact you can do that [16:15] right and so our decoy based systems [16:18] private the answer is no right with a [16:20] little bit of thought and I emphasize [16:21] this is a little bit of thought right [16:23] we've come up with three plausible [16:25] attacks that can break these things [16:26] right and I'm not saying you can execute [16:27] these in practice in every case again we [16:30] don't have enough empirical data to [16:31] evaluate any of these things but at [16:33] least as hypotheticals these things [16:34] don't pass the smell test and so we [16:36] shouldn't be using them and so why is it [16:40] that these things are used why is it [16:42] that these are regarded by credible [16:44] people as viable approaches to privacy [16:47] right like I basically disturbed you [16:49] like Satoshi really has no clothes so oh [16:51] god that's a horrible overlap or phrase [16:53] with that slide but why are we still [16:58] using them and the answer is in part [17:00] because privacy is hard it's hard to [17:02] understand the people who are building [17:03] these things are trying really hard [17:05] they're doing very impressive things [17:07] right it's building up impressive [17:09] communities but if you don't understand [17:11] privacy it's a little tricky to get [17:12] right so that's just you know to err is [17:14] human but part of it is the way that you [17:16] know self-promotion works and [17:18] cryptocurrencies right that we have this [17:19] like you've got to be better than the [17:20] other one kind of thing and this ends up [17:22] with sort of privacy fear right one of [17:25] the typical things that happens when you [17:27] interact with someone who's an advocate [17:28] for a privacy coin particularly on [17:30] Twitter which I guess is not a good way [17:32] to get normal behavior but whatever is [17:35] that they'll give you these lists of [17:37] features at the coin [17:38] that's right it has stealth addresses it [17:39] has rings signatures it has cut throughs [17:41] it has ZK snarks it uses VPN sort or [17:44] right and this whole list of features [17:46] right doesn't tell you anything about [17:48] what actual privacy you get but it [17:49] sounds really impressive and this is the [17:53] thing that we just need to stop doing [17:54] right and this applies you know to some [17:56] of these techniques really don't work at [17:57] all to other ones like ZK snarks are [17:59] quite promising but the technique isn't [18:02] the solution right this is a technique [18:03] the whole protocol is what you actually [18:05] have to build and when you build a whole [18:07] protocol you need to actually evaluate [18:08] it not based on the features it has but [18:10] based on you know what it actually does [18:12] what does it use and so you should [18:14] really ask yourself like here's all [18:15] these features what are they hiding and [18:17] do they actually accomplish it and the [18:19] answer was typically they don't hide [18:21] much and they don't actually hide it [18:22] very well [18:24] does it hide everything else and the [18:26] answer there is almost certainly not [18:27] and then like really how is this thing [18:29] being used and the answer there is going [18:31] to be in a way that probably isn't safe [18:33] right and what this comes down to is [18:37] cryptocurrency is Twitter for your bank [18:38] account it's a total privacy void it's a [18:40] vacuum the thing everything is broadcast [18:42] to everybody right this is the akin to [18:45] me telling you you were standing naked [18:46] in Times Square right and what most of [18:49] these privacy coins want to do is hand [18:50] you a band-aid right and like given the [18:53] magnitude of exposure right that you [18:55] know that's not really gonna cover [18:56] everything that doesn't really work [18:57] right and it's you know it's like trying [19:00] to build a space shoot without a duct [19:02] tape and overalls right that's not how [19:04] you go about protecting yourself from a [19:05] very hostile and very exposed [19:07] environment you need to actually do this [19:09] from the ground up and we do actually [19:10] have strong approaches to do that I said [19:13] the point wasn't to shell Zee cash but I [19:15] am going to for just a second because [19:17] you can use these two techniques - and [19:19] your cryptocurrency right we've gotten [19:20] no strong privacy that's actually quick [19:22] less than two seconds to create a [19:24] transaction less than 40 megabytes of [19:26] memory this went live sometime in the [19:28] last two days I haven't gotten much [19:30] sleep so not sure what day it is and we [19:33] also have strong privacy techniques for [19:35] other things these aren't deployed yet [19:36] but you know zero cache for layer one [19:38] again use this and whatever [19:39] cryptocurrency you want we have vault [19:41] blind off chain lightweight transactions [19:43] this is strongly private layer two and [19:46] thing called bolte labs that were in the [19:48] process of setting up and then lastly [19:50] this is actually academic work serafall [19:51] I think [19:52] called Z Exe which enables decentralized [19:54] private communication both of these are [19:56] papers those QR codes go to them and the [20:01] point is there really isn't an excuse [20:03] these days for using weak privacy [20:05] techniques we have strong ones we have [20:07] strong ones that uck snarks you could do [20:10] these with bullet proof so you could use [20:11] these other crypto and you should do [20:14] them you shouldn't be using [20:15] half-measures and you shouldn't be [20:17] telling people your things are private [20:18] when they're not I'd like to briefly [20:20] touch on a different problem because I [20:22] said I wasn't gonna cryptocurrencies I'm [20:24] not gonna call anyone out by name but [20:26] usability is particular as a problem and [20:28] it's actually one that we d'caché have [20:30] had issues with ourselves right turns [20:32] out if you have strong privacy that [20:34] isn't enough you actually need good UX [20:35] you need also to discourage people from [20:38] doing meaningless behavior like say [20:40] shape-shifting in five 3.52 cents into [20:43] shape-shift and to say Manero zeke ash [20:45] to ash whatever and then immediately [20:47] shifting it shape-shifting it back out [20:49] because that gets you no privacy right [20:51] you sit there and you look and anyone [20:52] can see what happened and yet people do [20:54] this right we've seen this happening [20:55] across the number of crypto currencies [20:56] and that isn't their fault but you need [20:58] to educate users right you need to have [21:00] full privacy on mobile right that's a [21:02] protocol issue and you can't require [21:04] people syncing the whole database just [21:06] to get privacy private payments and this [21:07] is really important this is probably [21:09] actually the hardest thing that we have [21:11] left for building privacy is getting [21:13] good usability and getting good answers [21:15] on mobile the core protocols in my [21:17] admittedly somewhat biased opinion are [21:19] mostly done you can do tweaks to make [21:20] them more performant you can develop [21:22] novel new cryptographic underpinnings to [21:24] make them faster or have better trust [21:26] assumptions but we know basically how to [21:28] build these things we know the basic [21:29] parts you want to assemble right [21:33] so in conclusion um we need to [21:34] critically evaluate privacy [21:36] vulnerabilities and cryptocurrencies [21:37] right most privacy preserving [21:38] cryptocurrencies have terrible privacy [21:41] right like merchants can't race you when [21:43] you make payments governments can [21:44] identify who you are if you put a single [21:46] address up online I mean that would [21:48] really surprise a bunch of people for [21:49] how these things are getting used right [21:52] your friends can find out if you're [21:53] making repeated payments to pornhub [21:55] that's kind of embarrassing [21:57] these decoy based approaches just don't [22:00] work right and in general we need to get [22:04] better at evaluating these things we [22:05] need [22:05] like avoid having people do privacy [22:07] theater right a lot of these [22:08] cryptocurrencies are effectively like [22:10] the TSA right they have a lot of things [22:12] that look really shiny [22:14] they make you maybe feel a little safer [22:15] but at the end of the day they don't [22:17] actually fix the problem they don't [22:19] actually give you protections and that's [22:22] just bad [22:23] and lastly usability is important and [22:25] that really is probably the the thing [22:26] that we need a lot of work on the space [22:28] more than anything else [22:29] and so with that I'll take questions [22:32] comments Rotten Tomatoes whatever I'm [22:38] curious about grin specifically and as [22:43] as far as I know with like the decoy [22:45] based approach that uses like different [22:49] different blinding factors for each [22:51] transaction right I'm curious if that [22:54] changes at all like an improvement over [22:56] if not even talking about the coin joint [22:58] aspect of the transactions just with the [23:00] planning factors does that change at all [23:02] the privacy symptoms not really so the [23:05] problem with member raynbow and grins so [23:07] far it's really promising techniques for [23:10] compression is that a member Wimble [23:12] transaction is you identify the you TXO [23:15] your spending and you generate a new [23:16] output you hide the values or hide the [23:18] addresses but the transaction graph is [23:19] still there the way they get privacy is [23:21] in theory you can not interactively [23:24] aggregate all those transactions [23:25] together and get a bigger mix the [23:27] problem is that those transactions are [23:32] broadcast to our open peer to peer [23:33] network and anyone who connects can just [23:34] download and see every individual [23:36] transaction and cover the transaction [23:38] graph if you're a researcher this is [23:39] easy if you're an intelligent service [23:41] this is really easy it just that's not a [23:45] privacy answer yet they need an answer [23:46] for that and they don't have one so far [23:56] you