I really don't understand why anyone thinks that anonymous money is a good idea. I'm as big a fan of freedom as the next person, but it seems to me that the primary purpose of anonymous money is to do an end-run around the law.
[UPDATE] Let me try to make this a little more precise: I don't understand the appeal of anonymous digital money. Physical cash is very useful, and I would not want it to go away. But even physical cash is not completely anonymous because you have to be physically present to exchange it, which entails a certain amount of risk, and that puts some checks-and-balances on potential abuses. Anonymous digital money does away with those checks-and-balances and makes a lot of activities with questionable societal value like crypto-extortion much more lucrative than they were before. For example, malware that encrypts your hard drive for ransom was unheard of before the advent of Bitcoin.
Silver and gold and other coins, without serial numbers, have existed as a store of value for far longer than pieces of paper or linen with serial numbers.
People have used anonymous money in the form of coins for millennia. It wasn't until the 1860s that the first one-dollar bill in the U.S. was printed with serial numbers. For ~95% of the time that money has existed, it has been what you would call "truly anonymous."
If you go back to pre-coin history and use weights of silver as opposed to minted or hammered coins, you're looking at maybe 153 years of serial numbers vs. about 5,000 years of non-serial numbers. "Truly anonymous money" is the historic norm; the current situation with numbers printed on paper/linen/plastic is something of a historical aberration.
This argument boils down to "a lot of the law is unjust, so a bunch of programmers will overrule the law en masse". That's great if you're an an-cap but doesn't so much address the question upthread.
Not just an-caps; that's also the basic justification given to the whole "don't talk to police" thing and to the Fifth Amendment whenever someone says, "If you're innocent, you can just tell the truth, so obviously silence should count as evidence of guilt." [1]
Which is to say, the specter of "you're violating a bunch of laws all the time anyway, so better to make it harder in general to prosecute stuff".
It's easier to influence the direction of an international cabal of open source software developers than it is to get a sane result from international politics.
I think it's great that Uber is undercutting the absolutely shitty medallion system. But that doesn't mean I'm okay with them underpaying their workers, for example.
Nobody else's business so long as you aren't committing fraud or breaking a contract, aren't avoiding alimony or other legal commitments, have paid (all of) your taxes, haven't stolen it, aren't money laundering, etc. Not quite so simple after all.
What is basically desirable is that (some kinds of) transactions can be made anonymously.
The only purpose of money is to trade work and the captured value of work with other people, therefore it is by definition always someone else's business what you do with your money.
But I know what you mean, you don't want non-directly-involved third parties to know about transactions you make. But then there are always contracts, laws and regulations you must follow and be held to account on. These are the things which bind the economy together and make modern civilisation work.
Your bank balance and the things you buy with your money do not exist in a vacuum. There will always be a trail of your spending left behind anyway, even if it's just asking the people you bought things from what you bought and when. It's an inescapable fact deeply embedded into the nature of what money is, and the function it serves in society.
Well, no. I can think of a very good use case right now: sending money is a PITA.
Say I want to pay somebody in another country for perfectly legal goods. (Example I've personally done: local food from a friend in Japan)
My options are:
* Bank wire transfers (expensive and annoying to set up, requires paperwork)
* Cash transfer services like Western Union or Moneygram (expensive and inconvenient, requires physical presence at a branch location for both parties, if one exists in the location)
* Electronic cash transfer services like PayPal (awful and opaque CS/policies, expensive, requires linking a physical bank account/credit card, something people in many countries don't have - if they operate in the country at all)
* Currency through the mail (danger of never getting there)
* Something like Bitcoin (annoying to set up.. once)
The last one ticks all the boxes in a way that the previous few do not.
- It's available everywhere with an internet connection without exception
- It's not subject to any middleman fees (though you can splash out a very tiny amount of money to get the transaction processed quicker)
- It's not subject to any middleman misbehavior, the transaction is strictly between you and the other person.
- There's no paperwork or going to a physical location required, it's all electronic
- Once you send a transaction, it will most assuredly reach its destination
- It requires nothing from the sender/receiver other than a piece of software
The (pseudo?)anonymity is just a bonus in this instance. It's none of the GCHQ, NSA, their associated cronies, etc business knowing what I'm buying and why.
I typically agree with that sentiment..... but then I think about all the information that Amazon has about me: e.g. political and religious views, cosmetic and OTC pharmaceuticals....... I'd really rather I could buy things anonymously online. I'm ok with the government seeing these things with a warrant; I just don't want the stores I'm interacting with to have such a thorough profile.
And lately we're seeing that governments often don't restrict themselves to warrants. It'd be nice if we could fix that with reforms but so far we haven't had much success.
Of course if you're getting something physical shipped to your house, anonymous currency doesn't help you.
You still have to pick up the items or have them delivered. Even if you open a PO Box or something, Amazon would still aggregate your purchases all shipped to one PO Box into a profile. That data is still valuable, even if it's not personally connected to you.
>I'm ok with the government seeing these things with a warrant
Really? Maybe okay with your current government, but I bet their are governments out there that you would not be fine with seeing this information when they are in a position to attack you, warrant or not. And there is no guarantee that your government will not become the same.
One thing Jeff Bezos can't do is trump up "structuring" charges, arrest me, prevent access to decent legal representation by freezing my assets, and then use the threat of decades in prison to extort me into accepting a plea deal of being locked in a cage with violent people for just a few years.
I'd be FAR more accepting of Amazon having full detailed knowledge of my financial life than an entity with the real power to destroy my life on a whim.
Blockchain currencies make all transactions public. Given that, if they're not anonymous it's kinda like posting everyone's credit card statements online.
Maybe you are living in China and want to donate to a group fighting for freedom of speech. Maybe you are in the US and want to buy medicine for your child that you can't afford to pay the US price for. Maybe you are in Venezuela and want to sell something for what it is really worth given the actual exchange rate. Maybe you want to make an online purchase of something embarrassing that you don't want anyone to know about even if they see your card statement.
In short, those checks and balances are starting to become corrupt and thus people create a means to do away with them.
Non-anonymous payment systems can be blacklisted to deny people rights (most importantly, the ability to publish, travel, and hire legal representation) without due process.
Witness this occurring recently with Wikileaks being banned by Visa, MC, and PayPal without any criminal complaint filed against them, much less a trial.
The government cannot have the ability to censor payments or perform traffic analysis on one's payments and receipts if we are to maintain a free and civil society. The US Supreme Court has ruled several times that free speech is not free speech without anonymous speech.
Dependency chart:
(anonymous payments) <- (anonymous publishing) <- (freedom to publish unpopular opinions without reprisal) <- (freedom to publish with the intent of changing public opinion and changing society) <- (free and civil society)
Another:
(anonymous payments) <- (untracked travel) <- (freedom of association with unpopular groups) <- (ability to form new political parties) <- (free and civil society)
Your argument is that exchanging anonymous digital money is like cash, except without the risks to personal safety that exchanging cash requires...and that is a bad thing?
Mostly. I think society would collapse if civil disobedience had zero cost to the individual engaging in it. I think having that cost come in the form of risk to personal safety is far from optimal, but still far better than nothing.
Ever used a vending machine? Did it take your photo before dispensing your purchase? If not, congratulations; you enjoyed a completely legal, completely anonymous transaction.
If you have never read A Clockwork Orange by Anthony Burgess, it is a 20-minutes-from-now sci-fi story that briefly explored the consequences involved in making people physically unable to break the law. Go ahead and read it. It's considered by some to be a classic in the same vein as 1984.
I consider it vitally important that there be some avenue by which a person can choose to break the law, even if there is only a miniscule likelihood of subsequently escaping punishment for it. Otherwise, the law becomes the iron collar around our necks, and those at the other end of the chain are able to drag us wherever they choose, just by rewriting the statutes.
"One has a moral responsibility to disobey unjust laws." --M.L. King Jr.
"Protest beyond the law is not a departure from democracy; it is absolutely essential to it." --H. Zinn
"It is not always the same thing to be a good man and a good citizen." --Aristotle
"An unjust law is itself a species of violence. Arrest for its breach is more so." --M. Gandhi
"...if it is of such a nature that it requires you to be the agent of injustice to another, then I say, break the law." -- H.D. Thoreau
How then will you engage in nonviolent civil disobedience when you find that you cannot break the law, even when throwing your whole strength against it? What will happen when every person who stands in protest vanishes into an oubliette the instant after they rise to their feet?
The impulse to stamp out crime so thoroughly as to make it practically impossible is an open invitation to the tyranny of the totalitarian police state. I much prefer the sort of society where people can choose between doing good and doing evil, by the measure of their own moral standard, over one where people are forced to obey the commandments of others.
> I really don't understand why anyone thinks that anonymous money is a good idea. I'm as big a fan of freedom as the next person, but it seems to me that the primary purpose of anonymous money is to do an end-run around the law.
To be perfectly honest, that's exactly the reason I think anonymous money is a good idea. In a world where laws for huge nations are made by corporations, overthrow of government is impossible, and change within the system is too slow to solve problems now, breaking the law and getting away with it is one of the few remaining recourses an individual wishing to exercise their freedoms has.
The kinds of crimes this enables are exactly the kinds of crimes I don't think should be crimes: drug use, prostitution.
Yes, it also enables tax evasion. However, I would argue that it's merely leveling the playing field in this respect: the ultra-rich already have legal means of avoiding taxes which aren't available to most people. Anonymous currency just makes it possible for average-to-poor people to avoid taxes. And ultimate, I'm not entirely against tax evasion: I like my roads, schools and libraries, but the US has spends more on the military than the next 7 top spenders combined to kill people for economic reasons, and I don't have any way of preventing my tax money from going to that.
The kinds of crimes I do care about leave behind lots more evidence besides a money trail: murder leaves behind bodies, rape leaves behind witnesses (victims). Typically money trails have little to do with investigations on these kinds of things.
In the end, though, I don't think talking about the upsides and downsides of anonymous money makes any difference. Bitcoin isn't really anonymous, but it's only a matter of time before easily anonymous money exists, and there's really nothing that can be done to stop that.
Selective disclosure means you decide who can see your transaction information (value, recipients, etc.) and that it's not publicly knowable by default.
No, the rest of the paragraph makes it clear(?) that the user who created the transaction can show it was them.
I don't understand the math at all, but the claims on Zerocoin are rather strong. But it does depend on a high enough volume to hide in.
People pay a large premium, like 10%, to get anonymous BTC, as evidenced by the "cash by mail" prices on Localbitcoin. (Other methods are even more expensive, but that's usually due to risk of default/reversing - like taking PayPal or gift cards). If you control the supply of Zerocoin then it's basically a license to print money.
Zerocoin is really what BTC needs to increase volume, I hope[0]. This is assuming most people care about buying BTC anonymously, out of the people that profess to get anonymous BTC. I tried to buy truly anonymous BTC last year. Things I compensated for:
- Physical evidence (fingerprints, hair, face/body recognition) in every transaction - much harder than it seems!
- That means wearing gloves when getting the cash out of the bank and exchanging $100s for change at stores. As well as using double bags when transporting the cash. This raises lots of suspicion.
- Also means you cannot: Deposit cash for BTC (bank video) or meet a seller in person (obvious, yet often recommended on BTC forums).
- ATM/Bank teller note serial recognition. Wells Fargo claims they don't do this[1] but it is too easy and makes too much sense. This means going to the bank to get $100 bills, then changing them at shops. (ATMs only provide 20s, making it much more difficult.) And even then, you'll want to use a shop with high cash turnover.
- Handwriting. Easiest way around this is to ask a stranger to help write for you, faking incompetence or an injury.
- Stamps: Buying from the USPS is actually very difficult. The automated machines only take traceable cards. Video cameras are all over the place. Fortunately there are plenty of third party sellers that'll hand you a couple of stamps for a few bucks.
- Location. This is the hardest to conceal. If it isn't clear, the only way to buy BTC anonymously is wish cash. And since you don't want to meet in person, cash by mail. (A dead drop is a possible alternative, but further constrains your location and is far easier to be recorded (like leaving cash in a locker).) I went to drop off my envelope in an out-of-the-way USPS mailing box. But that still gives away my location generally. To be extra paranoid, one must consider all USPS mailboxes to be monitored (video surveillance), and that USPS mail recording will know which potential mailboxes were used for any given piece, along with some time window. Involving a stranger is a good idea, or perhaps leaving the envelope at a hotel/concierge.
Even with all that, one must assume that your general physical location has been leaked. If you need to make multiple purchases, this leaks a lot more information, as it shows where you were over time. (I travel a bit, so if I bought whenever I felt like it, that pattern alone would narrow me down to a few hundred thousand people, perhaps even less.)
Zerocoin promises to eliminate this info leak as well as Tor eliminates your IP. It's got a huge potential.
0: Edit: It's not that I'm some kind of BTC believer. I actually find most "true BTC" users to be morons. But I think it's a good thing because it provides a way to force a partial step back against government invasion of privacy. The mere idea that most people consider "money laundering" to even be a thing, let alone something bad, just shows how far the government has corrupted people's minds.
1: The teller gave me a fake $100 note. When I went to return it, the manager said he had no way of verifying. OTOH, I guess they would say that, regardless.
This technology already exists today in the form of the Cryptonote based coins - of which Monero is the leading example.
Cryptonote, by default, is an opaque blockchain - your transactions are not visible to the world. But, let's say you're a non-profit organization and you do wish for your donations to be public. Cryptonote allows for that using a "view key".
In this way, you get the best of both worlds - privacy by default, and openness when you need it.
The cryptonote wallets are still in their early stages, but the various coins are available and trading on exchanges today. And you can even use them to pay bitcoin based merchants using a service like ShapeShift or xmr.to .
What would happen to transactions on Monero in a post-quantum world? Would all of the transactions become transparent to the 3/4 letter agencies?
Does the 'mixing' of coins happen on a server (so you trust the server not to log anything) or does it happen p2p so said agencies can analyze the network?
I'm not sure that anyone can speak to what happens to crypto in a post quantum world.
Mixing does not happen on a server - that would be an atrocious violation of privacy. Monero (and other cryptonote coins ) use ring signatures - https://lab.getmonero.org/pubs/MRL-0004.pdf
All anonymity is not created equal: you're better off if we can only figure out that one out of 6 billion people bought a Nickelback album, then if we know it was either you or one guy in Tristan da Cunha. The size of you're anonymity set matters and Cryptonote provides a rather small one in comparison to Zerocash. This is not to say Cryptonote is worthless, there are tradeoffs between the two, but Zerocash has a distinct advantage in terms of anonymity and I think it matters.
Cryptonote's ring signatures scale linearly in the number of people your transactions are mixed with. As a result, you can't mix an individual transaction with that many people without it getting too big and too computationally costly(chaining transactions doesn't solve this). In contrast, Zerocash mixes every transaction with every other transaction ever[1].
If you are worried about maintaining privacy given repeated interactions with merchants or others who already have some partial information about you, the size of the anonymity set matters considerably. Longterm intersectional attacks are a major problem with anonymity systems. The smaller the set you mix with on any given transaction, the easier it is for some third party to use outside information to eliminate everyone else in the mixing set (e.g because she knows no one else in the set was online at the time of the transaction or was in your approximate geographic area), and determine the true spender. One of the few effective defenses we have for this is to simply include as many people as possible in the anonymity set. If you want to avoid companies building financial profiles of users from the blockchain, this is precisely the type of attack you need to thwart.
[1] Technically, up to 2^64 transactions and the networks ability to handle the spent serial number list. So there is a limit, but it's rather large.
The point you're actually trying to make is "every privacy scheme has trade-offs".
Zerocoin's trade-offs are massive: untested / unreviewed cryptography, a trusted initial accumulator that can ruin the anonymity for everyone forever, a significantly larger transaction size, and a blockchain so opaque that double-spends and false coin creation cannot be seen.
Those are the issues that matter, and Monero suffers from none of those problems.
> a trusted initial accumulator that can ruin the anonymity for everyone forever
This is false: even if somebody compromises the initial setup (which, if implemented using the proposed MPC protocol, would require compromising every single participant; compromising n-1 parties doesn't do anything), the system continues to enjoy the same zero-knowledge guarantees. Compromised setup or not, in Zerocash the anonymity set is all participants of the system.
On further consideration I agree with you. Knowledge of the accumulator would merely allow for the arbitrary creation of forged spends that appear valid, but the rest of the system would still remain opaque (much to its detriment in this instance).
Also there is nothing so suggest that a clever MPC will solve the collusion problem. Of course the participants will make claims about their honesty, but if ZeroCoin is worth massive amounts of money the temptation to seek collusion will be there.
Of course, whilst it's true that some participants might stick to their proverbial guns, what is going to prevent a motivated state-level attacker from monitoring as many participants as they can during the computation? Then they only need to compromise the handful that they couldn't monitor, and for that they have rubberhose cryptanalysis.
The way you phrase it makes it seem like the parties involved are perpetually at risk of being compromised, as though they must retain and store the secrets necessary for parameter generation forever. When in fact it will be done once, and well in advance of any significant value in the currency which would incentivize crazy government yatta yatta.
Sending money is a PITA because there's so much risk, because there's so much incentive if you can game the system.
That said, I'm not sure how they will ever be able to scale their product and comply with all the reporting requirements of the feds. Traditionally, the primary users of anonymous money transfer systems have been those trying to evade either the law man or the law (or both).
I wonder how it will stack up against Bitcoin. Zero-knowledge proofs (zk-SNARKs) should eliminate the need to store gigabytes of data on everyone's computer that wishes to participate in the network, which is a win in and of itself.
57 comments
[ 5.7 ms ] story [ 127 ms ] thread[UPDATE] Let me try to make this a little more precise: I don't understand the appeal of anonymous digital money. Physical cash is very useful, and I would not want it to go away. But even physical cash is not completely anonymous because you have to be physically present to exchange it, which entails a certain amount of risk, and that puts some checks-and-balances on potential abuses. Anonymous digital money does away with those checks-and-balances and makes a lot of activities with questionable societal value like crypto-extortion much more lucrative than they were before. For example, malware that encrypts your hard drive for ransom was unheard of before the advent of Bitcoin.
Regions like Scandanavia are trying to eliminate anonymous money.
If you eliminate anonymous money, it is unclear how freedom of speech, religion, inquiry etc can be preserved.
Anonymous money is always going to be less convenient that paying in the clear. But it should exist.
Good Luck Electric Coiners
Consider that if the money was truly anonymous, we wouldn't be able to use serial numbers to track down who used it.
People have used anonymous money in the form of coins for millennia. It wasn't until the 1860s that the first one-dollar bill in the U.S. was printed with serial numbers. For ~95% of the time that money has existed, it has been what you would call "truly anonymous."
If you go back to pre-coin history and use weights of silver as opposed to minted or hammered coins, you're looking at maybe 153 years of serial numbers vs. about 5,000 years of non-serial numbers. "Truly anonymous money" is the historic norm; the current situation with numbers printed on paper/linen/plastic is something of a historical aberration.
Even if the bank gives me a tracked 20, I can easily "launder" it by using it to buy something. Now I have $19 in anonymous cash and stick of gum.
Which is to say, the specter of "you're violating a bunch of laws all the time anyway, so better to make it harder in general to prosecute stuff".
Recall the Bennett Haselton (sp?) fracas:
http://yro.slashdot.org/story/13/06/07/1439220/seeking-fifth...
[1] Of course, it always will, irrespective of a judge's sheepish instructions.
Great contribution there, Tom.
I think it's great that Uber is undercutting the absolutely shitty medallion system. But that doesn't mean I'm okay with them underpaying their workers, for example.
The reason I am for anonymous money is that it is of no one else's business what I do with my money. It's really that simple.
EDIT: David Friedman wrote a good piece on the misuse of "externality" arguments that every Freedom-loving person should know (and I'd be surprised if lisper did not know of it): http://www.daviddfriedman.com/Machinery_3d_Edition/The%20Mis...
What is basically desirable is that (some kinds of) transactions can be made anonymously.
I think you might be surprised.
> it is of no one else's business what I do with my money
If you use your money to, say, hire a hit man to kill me, how is that not my business?
> It's really that simple.
No, it's really not that simple at all. You should read this:
https://en.wikipedia.org/wiki/Externality
But I know what you mean, you don't want non-directly-involved third parties to know about transactions you make. But then there are always contracts, laws and regulations you must follow and be held to account on. These are the things which bind the economy together and make modern civilisation work.
Your bank balance and the things you buy with your money do not exist in a vacuum. There will always be a trail of your spending left behind anyway, even if it's just asking the people you bought things from what you bought and when. It's an inescapable fact deeply embedded into the nature of what money is, and the function it serves in society.
Say I want to pay somebody in another country for perfectly legal goods. (Example I've personally done: local food from a friend in Japan)
My options are:
* Bank wire transfers (expensive and annoying to set up, requires paperwork)
* Cash transfer services like Western Union or Moneygram (expensive and inconvenient, requires physical presence at a branch location for both parties, if one exists in the location)
* Electronic cash transfer services like PayPal (awful and opaque CS/policies, expensive, requires linking a physical bank account/credit card, something people in many countries don't have - if they operate in the country at all)
* Currency through the mail (danger of never getting there)
* Something like Bitcoin (annoying to set up.. once)
The last one ticks all the boxes in a way that the previous few do not.
- It's available everywhere with an internet connection without exception
- It's not subject to any middleman fees (though you can splash out a very tiny amount of money to get the transaction processed quicker)
- It's not subject to any middleman misbehavior, the transaction is strictly between you and the other person.
- There's no paperwork or going to a physical location required, it's all electronic
- Once you send a transaction, it will most assuredly reach its destination
- It requires nothing from the sender/receiver other than a piece of software
The (pseudo?)anonymity is just a bonus in this instance. It's none of the GCHQ, NSA, their associated cronies, etc business knowing what I'm buying and why.
Of course if you're getting something physical shipped to your house, anonymous currency doesn't help you.
Really? Maybe okay with your current government, but I bet their are governments out there that you would not be fine with seeing this information when they are in a position to attack you, warrant or not. And there is no guarantee that your government will not become the same.
One thing Jeff Bezos can't do is trump up "structuring" charges, arrest me, prevent access to decent legal representation by freezing my assets, and then use the threat of decades in prison to extort me into accepting a plea deal of being locked in a cage with violent people for just a few years.
I'd be FAR more accepting of Amazon having full detailed knowledge of my financial life than an entity with the real power to destroy my life on a whim.
In short, those checks and balances are starting to become corrupt and thus people create a means to do away with them.
Witness this occurring recently with Wikileaks being banned by Visa, MC, and PayPal without any criminal complaint filed against them, much less a trial.
The government cannot have the ability to censor payments or perform traffic analysis on one's payments and receipts if we are to maintain a free and civil society. The US Supreme Court has ruled several times that free speech is not free speech without anonymous speech.
Dependency chart:
Another:For instance, it was impossible at one stage to donate to Wikileaks by Credit Card or Paypal due to Senatorial Pressure on private business.
If you have never read A Clockwork Orange by Anthony Burgess, it is a 20-minutes-from-now sci-fi story that briefly explored the consequences involved in making people physically unable to break the law. Go ahead and read it. It's considered by some to be a classic in the same vein as 1984.
I consider it vitally important that there be some avenue by which a person can choose to break the law, even if there is only a miniscule likelihood of subsequently escaping punishment for it. Otherwise, the law becomes the iron collar around our necks, and those at the other end of the chain are able to drag us wherever they choose, just by rewriting the statutes.
How then will you engage in nonviolent civil disobedience when you find that you cannot break the law, even when throwing your whole strength against it? What will happen when every person who stands in protest vanishes into an oubliette the instant after they rise to their feet?The impulse to stamp out crime so thoroughly as to make it practically impossible is an open invitation to the tyranny of the totalitarian police state. I much prefer the sort of society where people can choose between doing good and doing evil, by the measure of their own moral standard, over one where people are forced to obey the commandments of others.
To be perfectly honest, that's exactly the reason I think anonymous money is a good idea. In a world where laws for huge nations are made by corporations, overthrow of government is impossible, and change within the system is too slow to solve problems now, breaking the law and getting away with it is one of the few remaining recourses an individual wishing to exercise their freedoms has.
The kinds of crimes this enables are exactly the kinds of crimes I don't think should be crimes: drug use, prostitution.
Yes, it also enables tax evasion. However, I would argue that it's merely leveling the playing field in this respect: the ultra-rich already have legal means of avoiding taxes which aren't available to most people. Anonymous currency just makes it possible for average-to-poor people to avoid taxes. And ultimate, I'm not entirely against tax evasion: I like my roads, schools and libraries, but the US has spends more on the military than the next 7 top spenders combined to kill people for economic reasons, and I don't have any way of preventing my tax money from going to that.
The kinds of crimes I do care about leave behind lots more evidence besides a money trail: murder leaves behind bodies, rape leaves behind witnesses (victims). Typically money trails have little to do with investigations on these kinds of things.
In the end, though, I don't think talking about the upsides and downsides of anonymous money makes any difference. Bitcoin isn't really anonymous, but it's only a matter of time before easily anonymous money exists, and there's really nothing that can be done to stop that.
I don't understand the math at all, but the claims on Zerocoin are rather strong. But it does depend on a high enough volume to hide in.
People pay a large premium, like 10%, to get anonymous BTC, as evidenced by the "cash by mail" prices on Localbitcoin. (Other methods are even more expensive, but that's usually due to risk of default/reversing - like taking PayPal or gift cards). If you control the supply of Zerocoin then it's basically a license to print money.
Zerocoin is really what BTC needs to increase volume, I hope[0]. This is assuming most people care about buying BTC anonymously, out of the people that profess to get anonymous BTC. I tried to buy truly anonymous BTC last year. Things I compensated for:
- Physical evidence (fingerprints, hair, face/body recognition) in every transaction - much harder than it seems!
- That means wearing gloves when getting the cash out of the bank and exchanging $100s for change at stores. As well as using double bags when transporting the cash. This raises lots of suspicion.
- Also means you cannot: Deposit cash for BTC (bank video) or meet a seller in person (obvious, yet often recommended on BTC forums).
- ATM/Bank teller note serial recognition. Wells Fargo claims they don't do this[1] but it is too easy and makes too much sense. This means going to the bank to get $100 bills, then changing them at shops. (ATMs only provide 20s, making it much more difficult.) And even then, you'll want to use a shop with high cash turnover.
- Handwriting. Easiest way around this is to ask a stranger to help write for you, faking incompetence or an injury.
- Stamps: Buying from the USPS is actually very difficult. The automated machines only take traceable cards. Video cameras are all over the place. Fortunately there are plenty of third party sellers that'll hand you a couple of stamps for a few bucks.
- Location. This is the hardest to conceal. If it isn't clear, the only way to buy BTC anonymously is wish cash. And since you don't want to meet in person, cash by mail. (A dead drop is a possible alternative, but further constrains your location and is far easier to be recorded (like leaving cash in a locker).) I went to drop off my envelope in an out-of-the-way USPS mailing box. But that still gives away my location generally. To be extra paranoid, one must consider all USPS mailboxes to be monitored (video surveillance), and that USPS mail recording will know which potential mailboxes were used for any given piece, along with some time window. Involving a stranger is a good idea, or perhaps leaving the envelope at a hotel/concierge.
Even with all that, one must assume that your general physical location has been leaked. If you need to make multiple purchases, this leaks a lot more information, as it shows where you were over time. (I travel a bit, so if I bought whenever I felt like it, that pattern alone would narrow me down to a few hundred thousand people, perhaps even less.)
Zerocoin promises to eliminate this info leak as well as Tor eliminates your IP. It's got a huge potential.
0: Edit: It's not that I'm some kind of BTC believer. I actually find most "true BTC" users to be morons. But I think it's a good thing because it provides a way to force a partial step back against government invasion of privacy. The mere idea that most people consider "money laundering" to even be a thing, let alone something bad, just shows how far the government has corrupted people's minds.
1: The teller gave me a fake $100 note. When I went to return it, the manager said he had no way of verifying. OTOH, I guess they would say that, regardless.
Cryptonote, by default, is an opaque blockchain - your transactions are not visible to the world. But, let's say you're a non-profit organization and you do wish for your donations to be public. Cryptonote allows for that using a "view key".
In this way, you get the best of both worlds - privacy by default, and openness when you need it.
The cryptonote wallets are still in their early stages, but the various coins are available and trading on exchanges today. And you can even use them to pay bitcoin based merchants using a service like ShapeShift or xmr.to .
Does the 'mixing' of coins happen on a server (so you trust the server not to log anything) or does it happen p2p so said agencies can analyze the network?
Mixing does not happen on a server - that would be an atrocious violation of privacy. Monero (and other cryptonote coins ) use ring signatures - https://lab.getmonero.org/pubs/MRL-0004.pdf
There is also work being done to employ gmaxwell's Confidential Transactions: https://github.com/ShenNoether/MiniNero/blob/master/RingCT0....
Cryptonote's ring signatures scale linearly in the number of people your transactions are mixed with. As a result, you can't mix an individual transaction with that many people without it getting too big and too computationally costly(chaining transactions doesn't solve this). In contrast, Zerocash mixes every transaction with every other transaction ever[1].
If you are worried about maintaining privacy given repeated interactions with merchants or others who already have some partial information about you, the size of the anonymity set matters considerably. Longterm intersectional attacks are a major problem with anonymity systems. The smaller the set you mix with on any given transaction, the easier it is for some third party to use outside information to eliminate everyone else in the mixing set (e.g because she knows no one else in the set was online at the time of the transaction or was in your approximate geographic area), and determine the true spender. One of the few effective defenses we have for this is to simply include as many people as possible in the anonymity set. If you want to avoid companies building financial profiles of users from the blockchain, this is precisely the type of attack you need to thwart.
[1] Technically, up to 2^64 transactions and the networks ability to handle the spent serial number list. So there is a limit, but it's rather large.
Zerocoin's trade-offs are massive: untested / unreviewed cryptography, a trusted initial accumulator that can ruin the anonymity for everyone forever, a significantly larger transaction size, and a blockchain so opaque that double-spends and false coin creation cannot be seen.
Those are the issues that matter, and Monero suffers from none of those problems.
This is false: even if somebody compromises the initial setup (which, if implemented using the proposed MPC protocol, would require compromising every single participant; compromising n-1 parties doesn't do anything), the system continues to enjoy the same zero-knowledge guarantees. Compromised setup or not, in Zerocash the anonymity set is all participants of the system.
Also there is nothing so suggest that a clever MPC will solve the collusion problem. Of course the participants will make claims about their honesty, but if ZeroCoin is worth massive amounts of money the temptation to seek collusion will be there.
Of course, whilst it's true that some participants might stick to their proverbial guns, what is going to prevent a motivated state-level attacker from monitoring as many participants as they can during the computation? Then they only need to compromise the handful that they couldn't monitor, and for that they have rubberhose cryptanalysis.
That said, I'm not sure how they will ever be able to scale their product and comply with all the reporting requirements of the feds. Traditionally, the primary users of anonymous money transfer systems have been those trying to evade either the law man or the law (or both).
https://bitcointalk.org/index.php?topic=279249.0