plasticmachine
Also two of the Monero Research Lab papers both identify and quantify the problem, and then suggest solutions to it. At no point do the papers dismiss them as theoretical: https://pbs.twimg.com/media/C9nIqDmUQAAqP-R.jpg:large
MRL-0001 is nearly 7000 words, the entirety of which is devoted to showing how dangerous mixin-0 transactions are (ie. the bulk of this 'empirical analysis' paper). MRL-0004 similarly consists of nearly 7000 words, although this time they don't only have an entire section devoted to "traceability with zero mix-in spending", but they cover knock-on effects of banning them ("change and dust force zero mix spending"). They then identify further issues including "temporal associations", "association by use of outputs within a transaction", and "combinatorial attacks to reveal outputs".
The MRL-0004 paper provides a roadmap to defeating some of these by forcing a minimum ring size, but notes that a perfect output selection strategy could not (at the time as now) be determined. They note that "although we have identified this security issue, we are not making formal recommendations yet until we have further data to inform our choices".
Subsequent to that the Monero developers switched to a triangular distribution for selection, and then more recently they added a %-of-outputs-must-be-recent scheme (I can't recall what %). This, combined with the advent of RingCT, has defeated the claims of the research paper. There is no double-think about older transactions, because nobody could use them for anything of note, and it was during a time when 'fluffyass' kept telling people not use buy Monero (which I believe he continues to do).
That's because RingCT removed the ability to create a ring signature with those outputs, so adding a complex whitelist / blacklist mechanism would have been a massive waste of time.
How about one of the authors Tweeting out that 80% of the Monero transactions have been deanonymized (https://twitter.com/random_walker/status/852918816455655425), a claim that is neither true nor remotely correct?
This paper is akin to me publishing a paper noting how insecure Windows for Workgroups 3.11 is, providing advice for securing it, and then Tweeting out that that the paper found that "Windows is trivially insecure out the box". Sure, the paper would technically be correct, and my Tweet might even technically be correct, but it would be irrelevant since nobody uses Windows for Workgroups 3.11.
Nobody CAN use mixin-0 transactions in Monero, because they've been banned since a March 2016 hard fork that took over a year for them to plan and roll out. Nobody can be affected by down-chain use of those mixin-0 transactions because RingCT doesn't allow you to create ring sigs form them, which was added in the December 2016 hard fork.
It's no wonder, then, that the paper, and accompanying website, only go up to the end of 2016 - they have no valid data from the beginning of 2017 onwards, and have published the paper seemingly only as a 'hit piece'.
Perhaps you should familiarise yourself with the papers that Monero themselves published on this in September 2014, and the follow-up in January 2015? Here-
https://lab.getmonero.org/pubs/MRL-0001.pdf
https://lab.getmonero.org/pubs/MRL-0004.pdf
Now the recommendations made in that 2nd paper were only instituted in the v2 hard fork in March 2016, because hard forks are hard and it was their first one, but it doesn't change the fact that they published two papers on it to warn the community, made immediate changes so that updated clients used minimum ring sig sizes, and then hard forked to ban mixin 0. Publishing a paper on an already-discovered and already-solved issue two years later isn't particularly interesting or novel.
Obviously there are implementation risks, but in terms of cryptographic risk you are correct.
Also, obscure origins are irrelevant when the technology is solid. Take the following examples: TrueCrypt, Bitcoin, MimbleWimble. Are you honestly arguing that TrueCrypt was bad?
2. No, it's not in my hands to do so. The onus is on ZCash to demonstrate this the way any other cryptography is proven: peer review, and time. ZeroCash has little of either.
3. Anyone that sees it as an advantage has no clue about disincentives or game theoretic attacks.
4. The exact point of failure is that they all booted off the same ISO that was provided by one person. Additionally, when an observer at one of the stations had their phone compromised they didn't shut the ceremony down and restart, they just continued. Also, the participants are just Zooko's buddies - who's to say they aren't conspiring together, and merely compromising the procedure for anyone who isn't part of that (e.g. Peter Todd)?
5. If privacy is not the default, and is immensely hard to use (due to the system requirements), it will hardly be used. The entropy of the private system will be restricted to a relative handful of users.
1. It's controlled by a corporation with VC backing. This leads to a single point of failure, a ton of disincentives, and makes it easier for an attacker.
2. The cryptography is untested, unproven, and too new to be trusted. Since when did technically competent people advocate for cryptography like that??
3. The 20% tax puts a crazy amount of strain on the economic system, and is inordinately high.
4. The trusted setup is hard to get right, but they completely screwed it up (see my comment upthread).
5. Private transactions take 8gb+ of RAM and several minutes to compute on my laptop, how is that at all scalable or useful?
We should be immensely critical of new cryptography being rushed into production at the behest of investors, and we should not be promoting a centralized, corporate-controlled cryptocurrency.
Per the ZCash website (https://z.cash/blog/state-of-the-network-2016-10-31.html) -
"There is one known bug, which causes private transactions (those in which all of the inputs and outputs are shielded addresses) to not get mined."
https://github.com/zcash/zcash/commit/9eb852edd0c9a20d7e3925...
As to the video, the talk was pathetic. The speaker claimed he was going to explain zk-SNARKS to the layperson, then immediately claimed to not understand them. It presented none of the risks of ZCash, and only really covered how joinsplits work.
You must be joking.
- https://github.com/zcash/zcash/issues/1705
- https://www.cryptocoinsnews.com/zcash-bug-prevents-private-t...
As to the trusted setup, there are a few salient points:
- you don't have to "just trust one participant", what if 3 of them collude and 3 were compromised?
- every participant booted off the same ISO which was provided by a single person. The claim is that the ISO can be built deterministically, but that still does not prevent it being compromised in subtle ways, and it seems that hardly anyone has bothered to try verify the ISO build process even subsequent to the ceremony.
- even when there was clear evidence that someone's phone was compromised, the ceremony went ahead. This is a huge red flag - why not just stop the ceremony and rethink it, given the fact that there was obvious infiltration?
- why only 6 participants? Why were they chosen by Zooko? Why was there no open application process where applicants could be considered by the community? Why were no members of academic institutions involved as participants?
The way the trusted setup was conducted is shocking, this is privacy theatre at best.
On your closing remark about it being innovative: nobody doubts that the ZeroCash white paper is innovative, but it is also too new for us to be trusting it. Would you advocate for TLS 1.3 to default to only use some encryption method that was in a very recent, largely unreviewed whitepaper, especially when that whitepaper contains math that is particularly hard to grok (Greg Maxwell calls it "moon math")? Why do we hold all of our cryptography to such high standards, distrusting everything that is new and unproven, but we're expected to give a financial system a pass? Would you feel the same if all of your net worth was held in that financial system?