really the point of this talk is how do
you evaluate privacy in cryptocurrencies
the point is not the shells e-cash I am
one of the cofounders of Z cash I am on
the board of directors of the foundation
but that's not why I'm here today the
point is that we as a community have
done a very poor job evaluating privacy
approaches for cryptocurrencies and the
problem is that we need to get better at
it and we need to get better at it now
because at least one of these aetherium
bitcoins e-cash something that all of us
have ever heard of maybe dogecoin I
don't know is going to be the future of
payments and it's gonna take a while but
at some point when this happens we're
gonna realize that this is a major
privacy problem we wait until then to
actually address it it will be far too
late so I've been working on privacy and
cryptocurrencies since 2011 for
precisely that reason it wasn't clear to
me that Bitcoin was gonna succeed but it
was clear to me that if it did it was
gonna have a pretty big privacy problem
and at the time everyone basically
believed it was private this was sort of
the best logic that everybody had and of
course we know now how laughable that is
not only are there a bunch of academic
research that identifies privacy flaws
in Bitcoin and other cryptocurrencies
there are actually commercial companies
in the business of doing analytics and
figuring out what's going on so this is
laughable right don't believe it
in fact far from being you know
anonymous it is in fact
Twitter for your bank account right
cryptocurrencies expose all of your
spending habits to everybody right and
by everybody I mean everybody your
creepy ex girlfriend or boyfriend your
business competitors right if you're
trying to compete with someone they can
figure out what your supply chain is how
much you're paying your employees use
that to poach them etc right everybody
right if your government right and you
think you want you don't want privacy
for crypto currencies think again
because there are other governments out
there that don't like your government I
don't care if you the Chinese the
Russians or the Americans somewhere in
that triangle there's someone out to get
you and they also would love to have
economic information about how to
you so nobody wants this
information to be public to everybody
and it really is today that's the nature
of a blockchain and so as we thought of
this there have been a lot of proposals
on how to
add some amount of privacy to
cryptocurrencies and these range from
very mundane systems that have no chance
of actually working all the way up to
very sophisticated ones zero cash on
there was actually my doctoral thesis
route took me about five years to finish
all the details of it the question is
how old are these things work because no
matter who you are if you're designing a
cryptocurrency at some point you're
gonna need to add privacy to it and you
really need to use one of these
techniques or something else that's come
along I need to know if it's actually
private and this is hard evaluating
privacy for cryptocurrencies is not easy
right to do it empirically would be akin
to trying to evaluate privacy for the
internet in 1992 when everything was
just started when the first things that
were running were only at CERN right we
can't measure it empirically right we
don't have really real-world usage that
isn't too speculative right we don't
have day-to-day usage we don't have this
rich tapestry of data where I buy a
coffee I go to the subway I could check
into the metro then I buy stuff at lunch
which has some structure none of that
exists so there was no way to do this
empirically and more of our I as a
researcher even what little data there
is out there I don't have access to
you're right I have budgetary
limitations I have ethics limitations I
can't buy these third-party data sets
that Chan alysus and other people use so
we really have no way to do this
empirically and as a result what we have
to do is we have to result the thought
experiments and this is somewhat
unsatisfactory because it's not
empirical evidence it's very easy to
accuse people of being biased at some
point Twitter will probably start going
on about that you know as people start
tweeting slides right now about me but
it's the only thing we have right and to
do that you need to understand what
attacks really look like and we need to
look to other things where you've had
privacy problems as inspiration because
we're looking 10 20 years down the line
for this since we can't look at
cryptocurrency today to find out what
the problems are going to be in 10 years
and so what are real-world threats well
the easiest thing to look at is what
advertisers do with payment data so
where you've seen advertisers such as
Google collecting all kinds of data
about payments you make not just online
but these are actually trying to get
real-world payments you make when you
walk into Walmart
all two-year something and try to make a
purchase and Google's gotten a lot of
headlines about this because hey Google
is evil it's a very good one but reality
the matter is everybody's doing this and
in fact Google is probably one of the
more scrupulous people at the moment
that they're doing it you can be assured
that there are people doing far sketch
you of things with this data right and
what can you do with that well one thing
that actually is a pretty old story you
can use payment shopping data to figure
out for example when someone is pregnant
in this case you can target was building
up profiles based on customer loyalty
cards of who bought what and then they
were identified for example pregnant
women and send them ads for baby
products and in this particular case
they did this to a teenager sent the ads
drawer house her father saw them and
from there well father found out that
her daughter whose daughter was having
sex and was pregnant kind of a problem
and so this is the kind of thing we're
looking at and in fact we've seen stuff
closer to home with payment systems
where venmo which for those of you who
don't know there know is a way that you
can pay your friends for example for
dinner in common in the states when we
don't have very effective payment
systems like European banking but anyway
VIN Moe US start-up had a social feed
because everything is social these days
of payments you made of who from who to
who and why and this was by default
public and so people found out about
this and started writing things like
here he was a nice guide to how to stack
the stock your ex-boyfriend and of
course this is you know kind of cute
it's got a fun laughy picture but if I
flip the genders on this or you know
really gave it any kind of appropriate
treatment you draw this it's completely
creepy right and this is really someone
actually doing this not tongue-in-cheek
and so no later if we keep doing this
you end up with the same thing but how
to stock your ex using aetherium or
Bitcoin or whatever and this is the
problem right so what I said
cryptocurrency was Twitter for your bank
account it's an accurate statement but
it doesn't entirely tell you how things
go wrong and I think one of the things
you should think of is that it's a
tracking cookie in real life right so
we're used to these notions of we are
tracked on the internet everything we do
on a day to day basis is catalogued by
Google by double-click by Facebook well
cryptocurrency takes that and
it's like web 3.0 but in reality and
this is clearly incredibly problematic
so we really need to get this to work to
stop this and so how do we do that what
are the defenses well the first thing if
you take nothing else from this talk is
that in a world of AI social credit
systems you've probably seen that video
going around on Twitter from the train
in China and targeted advertising
plausible deniability is not a plausible
defense right so the original model for
privacy and Bitcoin in particular was
this idea of if someone shows up and
says hey did you buy weed at you know a
corner store or whatever you can point
to and go oh well you can't prove that
transaction was mine and this is sort of
the kind of mentality that someone who
lives in their parents basement and been
mining cryptocurrency and what they used
to use to play counter-strike would come
up with but it doesn't work right it
doesn't work in reality now and it
didn't work in reality then right
because look if the police are gonna
show up at your door and ask you what
you were doing
plausible deniability isn't gonna get
you out of a search warrant isn't gonna
get you out of what they find and they
start to think this is not a good way to
do OPSEC in any way shape or form but it
was what people were trying to do so
don't do that do something at least
slightly better and the problem with
what is better is that blockchain
privacy is in fact not intuitive right
cryptocurrencies broadcast all of your
transactions to everybody and this is
the thing that people sort of revolt on
like you had a gag in your mouth ago
what we got to fix that and it actually
turns out to be easy enough to obscure
the data on a blockchain from passive
observers who have nothing to do with
you and know nothing about you it's not
easy to do perfectly but you can do it
but that's not who you need privacy from
you need privacy from people who send
you payments and people you send
payments to right merchants you don't
want to be able to track you you don't
want people to identify you based on
putting payment information up online
and once you get to that hiding
transaction values confidential
transactions or whatever or hiding your
IP address isn't enough you need to hide
the transaction graph and this turns out
to be really what a lot of the more
promising things in here focus on but
even then they don't do that good a job
right so there's sort of three sets of
approaches to privacy you can think of
there's Bitcoin
atheria etc where you just explicitly
identify the origin of your payment
either of you TXO or the account and
this leaks the transaction graph
completely there is no privacy right
then there are the so-called decoy
transaction based systems which try to
obscure the transaction graph these look
like something will you pick five
possible decoy sources and say look this
is the real origin for my payment but
here are five other things which it
could have been and no one knows which
ones which it's just sort of a mess and
this looks like coin join nimble Wimble
etc or crypto runo ring CT Manero and so
that's one set of approaches and then
finally though the approaches of zero
coin in zero cash are deployed in a
couple of different Kippur currencies
where you don't identify the origin at
all and you have no transaction graph to
recover at least if you use the
privacy-preserving transactions right so
what does this look like visually well
in Bitcoin you have to if you're paying
a merchant you have to identify the
exact origin in decoyroid system such as
Manero same thing you have to identify
the origin but it hides amongst a couple
of different locations right and then
that's sort of this is what you're doing
you're adding noise right it's chaff
right the real transaction is somewhere
in there but hopefully if you don't have
very good vision you can't figure out
where it is and then there are things
like zero cash z cash where this data
just is not there right and so we know
that Bitcoin isn't private we there's
been a lot of analysis on zero cash grow
academically and empirically we know
that the privacy holds up if you use the
shielded features and use them well the
question is do these decoy based
approaches work and spoilers the answer
is no but are they private and the
reason they aren't is because there's
some interesting structure you can get
out of this right when you make a
payment to a merchant what they see is
not these three decoys they see those
decoys and their possible origins as
well right there's you know each payment
is a possible source each one of those
has three possible sources of five or 11
or whatever it is and sort of fans out
backwards and this sort of tree of
possible things that you weren't
interacted with you can call it I could
think of it as a taint tree and you can
also use this going forwards right if I
pay emergent right I see where the money
goes and then I see everyone who tries
to spend that
and some of those people are gonna be
spending it as a decoy right it won't be
legitimately theirs but one of those
will be the merchants and again this
fans out right there are three possible
things that were spent in each one of
those as three possible things that were
spent and we just keep going forward so
it's cone going back cone going forwards
and so this has a couple of immediate
problems that should make it clear that
you know things are not what you think
things are not completely private right
and so the most obvious one is what I'm
going to call an overseer attack which
is suppose your merchants say your
Starbucks and you have someone coming in
and buying coffee every day and they're
buying it with the cryptocurrency that's
private should Starbucks be able to
build a profile of how much caffeine
you're drinking on a week maybe sell it
to your health insurance company or
something ideally no right privacy
should mean that's not possible they
learned nothing should be as private as
cash except that's not true right
because if you make one payment to
Starbucks and then you make another and
you make a third they're gonna see these
different taint trees for each one of
these transactions and there's no
immediate linkage between them so you
might think it's private but of course
if you look through this entire graph
you're gonna see intersections in it
because the payments are going to have
common origins right you're gonna have
loaded all the funds off of some
transaction on coinbase or shape-shift
or whatever at one point or you change
transactions every use so this is a
basic intersection right so there's that
here's another one let's suppose you
were dissident right in Saudi Arabia you
have a website on the dark web that you
use to take donations right poor right
taking anonymous put another to dress up
your anonymous you should be completely
safe
they're never gonna figure out who you
are and so because you think it's
private you take that money and you
immediately deposit it in a
cryptocurrency exchange in the Mideast
that actually has all your kyc data they
know who you are because of things
private no one should be able to blink
the address online that's receiving
payments with your deposits that would
be another thing you'd expect from a
private cryptocurrency yeah
and well you don't get it here a reason
for this is that say Bob is this
dissident and he's taking funds and he's
going to deposit all of them right again
when you if you pay Bob two or three or
four times and you deposit these things
and you look at 13
right if you are the Saudis and you
compromise this exchange you subpoena it
you hack into it whatever it is you're
gonna get for every customer
these taint trees of every possible
payment they got and if you see someone
who got one of these like tracking
payments you made say the green one
they're gonna be a couple of people who
got those right because everyone picks
decoys at random someone might have just
picked that by accident right and at
least right now things aren't bad enough
you're willing to just go shoot anyone
based on me like five percent chance
that they were actually your target
however you didn't send one payment you
sent a bunch and so what are the odds
that some person has all of those
payments in their taint trees right that
all of these things are deposited in
their account no approximately zero and
so now you have with high probability
identified the person and so this is
really bad this is going to get you
arrested or worse again you thought it
was private that's not right and so it
turns out they repeated interactions
with a cinder or a recipient are
dangerous alright and this is where most
privacy coins break right and this is
just because no one is thinking about
these things in the context they're
really gonna be used but that's not even
the worst thing you can do right so
remember I said there's at Aintree
you're looking backwards you can see
what where the coins have gone well I'm
also looking forward when you pay
someone as I mentioned you can see where
payments may have gone and this is again
it's uncertain it's some kind of sort of
weird quantum foam but there's a little
bit of information in there and what can
happen is let's suppose you want to find
out if a friend of yours is making
repeated payments to our particular
merchant so you send the merchant one
transaction and you send your friend one
transaction and these can be dust right
little tiny amounts and you're gonna see
these two sort of things fan out over
time of where the money goes and then
you don't learn anything until maybe
some of the money you paid your friend
ends up in the same address as somewhat
something you paid the merchants and
this doesn't tell you much it could be
that did someone just pick the decoy
that happened to overlap it could be
that the merchant that your friend paid
the merchant and was moving their money
into off of their hot wall into a cold
store or something you don't know
there's not enough information here to
really count but you suggest something
might be going on okay but what happens
if this again happens multiple times now
you know that something is wrong now you
actually have information these
the odds of this happening by
happenstance because it's repeated
interactions are approximately zero
right and then you can watch this happen
3 4 5 10 20 times and now you really
know for sure and so for example you
could use this to you know if the
merchant was pornhub you would use this
to confirm that your friend was in fact
subscribing to pornhub and that would be
somewhat embarrassing right hey he's
looking at porn be he's paying for porn
and I guess worse actually
he's probably paying for porn with Verge
which really like you have get better
taste taste and friends so again this is
again I think fundamentally violates
what you'd expect from a privacy coin
right it shouldn't be the case that
random people by sending you know
tainted dust to a bunch of different
addresses can recover how things are
being spent but in fact you can do that
right and so our decoy based systems
private the answer is no right with a
little bit of thought and I emphasize
this is a little bit of thought right
we've come up with three plausible
attacks that can break these things
right and I'm not saying you can execute
these in practice in every case again we
don't have enough empirical data to
evaluate any of these things but at
least as hypotheticals these things
don't pass the smell test and so we
shouldn't be using them and so why is it
that these things are used why is it
that these are regarded by credible
people as viable approaches to privacy
right like I basically disturbed you
like Satoshi really has no clothes so oh
god that's a horrible overlap or phrase
with that slide but why are we still
using them and the answer is in part
because privacy is hard it's hard to
understand the people who are building
these things are trying really hard
they're doing very impressive things
right it's building up impressive
communities but if you don't understand
privacy it's a little tricky to get
right so that's just you know to err is
human but part of it is the way that you
know self-promotion works and
cryptocurrencies right that we have this
like you've got to be better than the
other one kind of thing and this ends up
with sort of privacy fear right one of
the typical things that happens when you
interact with someone who's an advocate
for a privacy coin particularly on
Twitter which I guess is not a good way
to get normal behavior but whatever is
that they'll give you these lists of
features at the coin
that's right it has stealth addresses it
has rings signatures it has cut throughs
it has ZK snarks it uses VPN sort or
right and this whole list of features
right doesn't tell you anything about
what actual privacy you get but it
sounds really impressive and this is the
thing that we just need to stop doing
right and this applies you know to some
of these techniques really don't work at
all to other ones like ZK snarks are
quite promising but the technique isn't
the solution right this is a technique
the whole protocol is what you actually
have to build and when you build a whole
protocol you need to actually evaluate
it not based on the features it has but
based on you know what it actually does
what does it use and so you should
really ask yourself like here's all
these features what are they hiding and
do they actually accomplish it and the
answer was typically they don't hide
much and they don't actually hide it
very well
does it hide everything else and the
answer there is almost certainly not
and then like really how is this thing
being used and the answer there is going
to be in a way that probably isn't safe
right and what this comes down to is
cryptocurrency is Twitter for your bank
account it's a total privacy void it's a
vacuum the thing everything is broadcast
to everybody right this is the akin to
me telling you you were standing naked
in Times Square right and what most of
these privacy coins want to do is hand
you a band-aid right and like given the
magnitude of exposure right that you
know that's not really gonna cover
everything that doesn't really work
right and it's you know it's like trying
to build a space shoot without a duct
tape and overalls right that's not how
you go about protecting yourself from a
very hostile and very exposed
environment you need to actually do this
from the ground up and we do actually
have strong approaches to do that I said
the point wasn't to shell Zee cash but I
am going to for just a second because
you can use these two techniques - and
your cryptocurrency right we've gotten
no strong privacy that's actually quick
less than two seconds to create a
transaction less than 40 megabytes of
memory this went live sometime in the
last two days I haven't gotten much
sleep so not sure what day it is and we
also have strong privacy techniques for
other things these aren't deployed yet
but you know zero cache for layer one
again use this and whatever
cryptocurrency you want we have vault
blind off chain lightweight transactions
this is strongly private layer two and
thing called bolte labs that were in the
process of setting up and then lastly
this is actually academic work serafall
I think
called Z Exe which enables decentralized
private communication both of these are
papers those QR codes go to them and the
point is there really isn't an excuse
these days for using weak privacy
techniques we have strong ones we have
strong ones that uck snarks you could do
these with bullet proof so you could use
these other crypto and you should do
them you shouldn't be using
half-measures and you shouldn't be
telling people your things are private
when they're not I'd like to briefly
touch on a different problem because I
said I wasn't gonna cryptocurrencies I'm
not gonna call anyone out by name but
usability is particular as a problem and
it's actually one that we d'caché have
had issues with ourselves right turns
out if you have strong privacy that
isn't enough you actually need good UX
you need also to discourage people from
doing meaningless behavior like say
shape-shifting in five 3.52 cents into
shape-shift and to say Manero zeke ash
to ash whatever and then immediately
shifting it shape-shifting it back out
because that gets you no privacy right
you sit there and you look and anyone
can see what happened and yet people do
this right we've seen this happening
across the number of crypto currencies
and that isn't their fault but you need
to educate users right you need to have
full privacy on mobile right that's a
protocol issue and you can't require
people syncing the whole database just
to get privacy private payments and this
is really important this is probably
actually the hardest thing that we have
left for building privacy is getting
good usability and getting good answers
on mobile the core protocols in my
admittedly somewhat biased opinion are
mostly done you can do tweaks to make
them more performant you can develop
novel new cryptographic underpinnings to
make them faster or have better trust
assumptions but we know basically how to
build these things we know the basic
parts you want to assemble right
so in conclusion um we need to
critically evaluate privacy
vulnerabilities and cryptocurrencies
right most privacy preserving
cryptocurrencies have terrible privacy
right like merchants can't race you when
you make payments governments can
identify who you are if you put a single
address up online I mean that would
really surprise a bunch of people for
how these things are getting used right
your friends can find out if you're
making repeated payments to pornhub
that's kind of embarrassing
these decoy based approaches just don't
work right and in general we need to get
better at evaluating these things we
need
like avoid having people do privacy
theater right a lot of these
cryptocurrencies are effectively like
the TSA right they have a lot of things
that look really shiny
they make you maybe feel a little safer
but at the end of the day they don't
actually fix the problem they don't
actually give you protections and that's
just bad
and lastly usability is important and
that really is probably the the thing
that we need a lot of work on the space
more than anything else
and so with that I'll take questions
comments Rotten Tomatoes whatever I'm
curious about grin specifically and as
as far as I know with like the decoy
based approach that uses like different
different blinding factors for each
transaction right I'm curious if that
changes at all like an improvement over
if not even talking about the coin joint
aspect of the transactions just with the
planning factors does that change at all
the privacy symptoms not really so the
problem with member raynbow and grins so
far it's really promising techniques for
compression is that a member Wimble
transaction is you identify the you TXO
your spending and you generate a new
output you hide the values or hide the
addresses but the transaction graph is
still there the way they get privacy is
in theory you can not interactively
aggregate all those transactions
together and get a bigger mix the
problem is that those transactions are
broadcast to our open peer to peer
network and anyone who connects can just
download and see every individual
transaction and cover the transaction
graph if you're a researcher this is
easy if you're an intelligent service
this is really easy it just that's not a
privacy answer yet they need an answer
for that and they don't have one so far
you