Satoshi Has No Clothes: Failures in On-Chain Privacy by Ian Miers (Devcon4)

There are multiple attacks in that video. IP is one, but a much bigger one is knowing the real output (or maybe real output plus one other output) among 16 ring signature members. They do not explain how they achieved it but one could guess that maybe by just doing a lot of tx themselves - 15 decoys is just way too small and flooding blockchain with transactions all but ensures that someone picking random ring members will pick a lot of your outputs (and thus have little privacy from you). It is also for sure too small for targeted active attacks (e.g., it is not safe to have repeat interactions with the same entity), see ▶ this video You really want more than 16 ring members, preferably all outputs ever created like in Zcash. FCMP work promises to bring similar privacy to Monero but is years on the roadmap.

Sure. Starting from the academic beginning and then going to commercial usage: Zerocash[0], a paper from 2014 (I'm an author on it), proposes using zksnarks to get a public ledger + privacy with no centralized parties. Instead of identifying the origin of your money on the blockchain and moving it to someone, you just prove in zero-knowledge your payment is correct. This showed strong privacy on a public blockchain was feasible. But slow (2 minutes per payment IIRC) Three years and much work by others later, it takes ~2 to 3 seconds on a Pixel three to make a zk-proof for a payment. This can be optimized down to 1 second fairly easily (on that you have only my assertion currently) This is commercially deployed in Zcash (the above mentioned coin with usability and adoption issues), a few other straight up forks, and a new coin called IronFish. And related protocols are in a few things on Ethereum (e.g., Aztec). If you want to test performance numbers, you can download one of these systems and try it yourself (Nighthawk is a decent mobile wallet for Zcash) Current technical objections (again, beyond criticisms of Zcash as a coin itself) 1) Current ZK proofs require trusted setup. New ZK proofs developed by engineers at Zcash removed this[1]. So its not longer an issue for the technology (or for Zcash once it's deployed) 2) you have to scan the blockchain to get notified of payments. No, this happens to be how Zcash does it. As I said in a separate comment, it's easy to send pay

>But for normal usage-as-a-currency, I am a huge believer in XMR (monero), which masks who you're sending money to There was a talk[1] a few years ago that basically argued that this property only really holds if you look at individual transactions in isolation. It basically boils down to: if you make one transaction to a darknet market, it's impossible to know whether you were actually sending to a darknet market, or whether that was just a decoy transaction. However, if you make repeated transactions to a darknet market, the chances that all of your transactions had a darknet market decoy approaches zero, and you'll be considered suspicious. At that point the police can get a warrant to search your house, or put surveillance on you so they can catch you slipping up irl. [1] ▶ this video core argument starts at around 10 minutes.

>Monero is a [...] untraceable digital cash that preserves privacy Not exactly. A single transaction might be untraceable but over repeated transactions it's possible to deanonymize people with a high degree of confidence. See: ▶ this video the good part starts at 10 minutes.

Crypto tribalism aside, you got two technical points fundamentally wrong about the cryptography: 1) snarks are fast now. It takes 3 seconds on a pixel phone for Zcash. 2)The decoy based approaches Monero uses are subject to all kinds of passive and active attacks. Both in practice ( link ) and just fundamentally: ▶ this video . There are ways to mitigate some of these problems to a degree. This is why you hear Monero people talk about coin control and churning (both of which can make you stand out in other ways). But the fact that they have to mention that should tell you its far from a perfect solution cryptographically. There's a reason projects go with the large anonymity set approach. And if you're a cryptographer at ConsenSys, you should know that: it's what Ethereum is doing with Aztec. You also should know several projects, including Zcash, are working on trustless setup zk proofs. (Disclosure: I am involved in Zcash.)