This is inaccurate and in a hilarious way.
Treasury is not coming after Bitcoin. There's an update in an ongoing rulemaking process that got reported here[0] as banning mixing and privacy tools. It may have been blown out of proportion[1], but I am not a lawyer, and certainly banning these tools would be bad. The thing is, Bitcoin's not private—every transaction is public for everyone to download. It's Twitter for your bank account. And that comes with serious privacy, safety, and boring commercial counterparty risks that should be addressed. These kinds of tools exist to mitigate that problem. The irony is that Bitcoin has largely refused to address this obvious issue, so no, Treasury isn't coming for Bitcoin. Indeed, there been years of people arguing Bitcoin would be just fine with no privacy protections.
[0] https://www.therage.co/us-government-to-bring-patriot-act-to...
[1] https://x.com/valkenburgh/status/1966174324701778071"
This is by no means a comprehensive analysis. This analysis misses the most major limitation with Monero's decoy based approach to transaction obfuscation: Eve-Alice-Eve attacks (also known as ABA attacks). It also misses an analysis of the possible insecurity of churning and a significant history of randomness implementation errors and flooding attacks specific to Monero. The exact consequences of some of these attacks remain an open question, but worthy of mention.
A simple and surprising limitation of Monero and any other decoy-based approach is that if you repeatedly withdraw money from one exchange and then deposit it to another, those transactions are not private (edit: even if we ignore payment value). This is a form of Eve-Alice-Eve attack.
Monero uses decoy transactions to obscure the transaction history on-chain, but it does not remove the history. There's a reason every other major privacy protocol (Zcash, Tornado Cash, Railgun, Aleo, Penumbra, etc.) does not use Monero's decoy-based approach, and even the Monero developers are moving to the standard zero-knowledge proof over an accumulator (IIRC a merkle tree like everyone else) based approach that they call Full Chain Anonymity Proofs.
As a meta-comment, this is one of a genre of Monero "privacy" analysis documents that are circulated as a way to claim there are no known actively used exploits. This is little better than the classic "my scheme is secure; here's a bounty for anyone who breaks it" form of cryptographic analysis we often see with flawed encryption schemes. Breaks will not always be public.
if you just sent Mick down the left path and he came out the right, then a video would conclusively show he knew the password.
And this is why "How to explain zero-knowledge protocols to your children" is probably the worst way to explain zero-knowledge protocols to anyone. Its not explaining what a zero-knowledge proof is or how it works. It's explaining what a simulator is when proving a protocol is zero-knowledge . Oh, and the explanation only works for interactive protocols.
Paying in cash, in addition to being a minor inconvenience that non-the-less outweighs most people's desire for privacy, does not work in online payments. It also doesn't work in businesses that get robbed.
The better question is, why do you need a new currency to get privacy? Why couldn't we have a private crypto currency backed by dollars or euros? There's no technical reason, indeed several groups are building this. What remains to be seen is if there's sufficient incentives to build anything around these or for any portion of the economy to move to them. Most purchases aren't sensitive, so for private payments to work, they need to be ubiquitous for non privacy reasons and just give people who need it the option for privacy. Much like cash does. But again, cash doesn't work online or increasingly offline
Fun fact, AMMs were considered well before cryptocurrency.
" The most popular automated market maker used in Internet prediction markets is
Hanson’s logarithmic market scoring rule (LMSR), an automated market maker with
particularly desirable properties [Hanson 2003, 2007]. The LMSR is used by a number of companies including Inkling Markets, Consensus Point, Yahoo!, Microsoft, and the large-scale non-commercial Gates Hillman Prediction Market at Carnegie Mellon [Othman and Sandholm 2010a]."
From https://www.cs.cmu.edu/~sandholm/liquidity-sensitive%20autom...
Yeah, those papers are very dense. You might want try reading zerocoin[0] first, it was the starting point of all the zero-knowledge proofs for private payments on a blockchain. Then another academic paper, Pinocchio coin, had a proposal for zkSNARKs. And Zeorcash built the zksnark + merkle tree+ serial umber (later called a nullifiers ) approach.
This is pretty cool. But you might want to update the credit for the zksnark +merkle tree + nullifier idea. It's from an academic paper, Zerocash in 2014. The approach is used in Zcash and then in Tornado.cash Though Tornado.cash is actually an odd hybrid between Zerocash's merkle tree+snark approach and an older academic paper, Zerocoin, which proposed a zk mix protocol as an add on to Bitcoin.
I don't think tagging people as ex 8200 is very helpful. Israel has mandatory military service and at this point if you have aptitude or are in a high school computer club in Tel Aviv or a few other places, you probably end up in 8200 for your service. For that matter, half the people who say there were in 8200 were either 1) listening to telephone calls 2) relegated to writing memos about the data people did hack and get. Of course, there are things one could have done that would raise serious questions. See, e.g., the issues raised for the people we know who worked on DualEC_DRBG.
On the other hand, there are other sketchy things about express VPN.
This has already happened. A catholic newspaper bought commercial location and app data and used it to out a gay priest who was forced to resign. They broke the joke "privacy protections" by knowing his home, office, and a conference he went to.
https://arstechnica.com/tech-policy/2021/07/catholic-priest-...
It's an important distinction. The fact that huge numbers of people rotate through the hacking side of 8200 (like the NSA, vast majority of 8200 members don't work on that) is what drives the supply.
Intelligence services typically have less turnover. Though that is changing, particularly for NSA, where people leave to go to contractors.
Also, frankly, describing NSO as ex Mossad just makes phone malware sound much more complicated than it is and much harder to stop. At the end of the day, its software, written by people in much the same way any software is written. It just exploits mistakes other software devs made so that it can run.
NSO group is ex unit 8200, which is military signals intelligence. So in American terms, it's the NSA not the CIA. The distinction is important in a country with mandatory military service. You get a large number of people who go through, get trained, and then leave because it never was a career. A number of them take their skills to the private sector.
Mossad, on the other hand, is a civilian intelligence service and I'm told there's a strong tradition that its members don't freelance their services after leaving.
Because Bitcoin is twitter for your bank account. It exposes everything you do to anyone who can download the blockchain.
You can argue that some gov/regulator should have access, though good luck finding one country everyone trusts. More realistically, and practically, you could
require that, as many jurisdictions do with cash, we should have reporting requirements for when a merchant sells something for large amounts of cryptocurrency.
But its pretty hard to argue everyone should be financially naked and exposed to anyone who wants to look. To fix that, even if you're government surveillance friendly, you first need to make the blockchain zero-knowledge (which Monero actually isn't good at, but thats irrelevant here).
There are some Zcash forks with iffy dev support and no market traction. The problem is the kind of cryptography you need to do something like Zcash is very very very hard to get right. Zcash actually got the tech right and handled the issues they hit well. They just didn't do a good job with reputation outside of tech.
No one else as done the same tech yet themselves. A few things have launched and allegedly plan to add a privacy layer (Mina, Celo). But actually building that kind of tech is a lot harder than reputation management or standard blockchains.
I think the reddit user someone else linked to pretty clearly explained the Monero side. Zcash has a bad reputation with darknet markets and the like that use Monero. Some of it deserved. ( I say this as someone who wrote original Zerocash protocol) https://www.reddit.com/r/Monero/comments/oui6zj/zcash_vs_mon...
Partially, but it's also: you will pay for a phone number, you won't pay for icloud, etc. So, as a result a phone number is costs something like 10 cents for an attacker.
What happens if someone tries to coerce Apple into writing backdoor code? Engineers at Apple could resist, resign, slow roll the design and engineering process. They could leak it and it would get killed.
Things would have to get very very bad for that kind of pressure to work.
On the other hand, once Apple has written a backdoor enthusiastically themselves, it's a lot easier to force someone to change how it can be used. The changes are small and compliance can be immediately verified and refusal punished. To take it to its logical extreme: you cannot really fire or execute people who delay something (especially if you lake the expertise to tell how long it should take). But you can fire or execute people who refuse to flip a switch.
This technology deeply erodes Apple and its engineers' ability to resist future pressure. And the important bit here is there adversary isn't all powerful. It can coerce you to do things in secret, but its power isn't unlimited. See what happened with yahoo.[0]
> Our system involves both an on-device component where the voucher is created, but nothing is learned, and a server-side component, which is where that voucher is sent along with data coming to Apple service and processed across the account to learn if there are collections of illegal CSAM. That means that it is a service feature.
Neuenschwander seems to, maybe deliberately, be conflating : "Apple's servers have to be in the loop" and "the code can only look at photos on iCloud".
You are right, the problem is a "slippery slope," but Apple just built roller skates and there are governments trying to push us down it. Apple is in a far better position to resist those efforts if they say " we don't have this code, we will not build it, and there's no way for it to be safe for our users."
I'd say that's a little different than the slippery slope. Something more like (in)defense in depth.
yes, you can turn AV into the same thing. But no one has been advocating for that or passing laws that would make AV both mandatory and have to report you to the police.
This has been going on for CSAM scanning for a while now. The latest version was called the EARN IT act [0]
The argument is not this is a slippery slope where you might miss step. IF that was the case, yes AV would be analogous. Instead, its that people are actively trying to push you into the spikes at the bottom of the pit, don't build things at the edge of the pit where the handrail is a pinky promise not to let others push you.
>The only thing stopping your phone from keylogging your password to a server in the NSA somewhere if it recognizes a specific trigger pattern is Apple's willingness and ability to resist pressure from the US, etc.
Think of what would happen if you tried to make your average Silicon Valley dev team design, implement, and test a surveillance system they didn't want to build and that was immoral. They'd resit in an infinite number of ways that would delay the project virtually for ever. Short of summary executions, I bet you could not get a nice, efficient, effective system.
On the other hand, once the dev team has enthusiastically built the system that scans for any image, it's entirely easy to say "Now, make it look for these images." They have no avenue for resistance other and a up front no. And a government that wants to do totalitarian things knows many ways to force a yes.
Yes, and even more ironically, thats precisely the problem. Because it makes mass sweeping of client side content viable --- both technically and morally--- in a way never possible before. The only thing stoping scanning of the entire phone for anything, now that Apple built the technical capability, is Apple's willingness and ability to resit pressure from the US, UK, China, and others to use it.