Can't we just open a mtgox account, deposit and then withdraw?
Zerocoin: making Bitcoin anonymous
31–40 of 86 posts
Re: Zerocoin: making Bitcoin anonymous
#32I think that politically this is a awful time for that. Bitcoin is still largely unregulated, and this allow for all sorts of innovation, yet the media is already scaremongering around because it is "anonymous" and used for laundering and drug dealing. If Zerocoin attracts true media attention, then you will get a political firestorm of people claiming that someone is making Bitcoin even worse for nefarious purposes.…
"the paper mention of drug deal does not help with that".
I agree, a youporn transaction will be a good marketing example: legal but ashaming. A donation to an opposition party in a dictatorship country is also a good example.
Re: Zerocoin: making Bitcoin anonymous
#33Technically, this is very cool work. But one thing the paper overlooks is divisibility. How does one make change with zerocoin? It appears that the trapdoors allow only a whole coin to be spent, with no recourse for spending a partial coin. Needless to say, non-divisibility will make a practical deployment difficult.
Re: Zerocoin: making Bitcoin anonymous
#34Earlier quoted context omitted.
>Edit: The helpful explanation linked in a comment on the question you linked is defective because it applies to all continuous probability distributions. No, why do you think so?
It contains the sentence "For any distribution, the sum of probabilities always equals 1" without the caveat that the sum is of a countable number of probabilities. It applies to every continuous distribution using the same argument, but with "the sum across all naturals" replaced with "the sum across the appropriate universe."
"the sum across the appropriate universe" for Reals is an integral. An integral can go from -Infinite to Infinite and still equal 1. This is the reason, for instance, why Zeno's Paradox of movement doesn't really forbid all movement.
Re: Zerocoin: making Bitcoin anonymous
#35Can't we just open a mtgox account, deposit and then withdraw?
MtGox knows who you are, and is not a secret underground operation thumbing its nose at The Man. Over the long run, you should consider them as transparent as any major, bailed-out bank.
Re: Zerocoin: making Bitcoin anonymous
#36Can't we just open a mtgox account, deposit and then withdraw?
[deleted]
Re: Zerocoin: making Bitcoin anonymous
#37Technically, this is very cool work. But one thing the paper overlooks is divisibility. How does one make change with zerocoin? It appears that the trapdoors allow only a whole coin to be spent, with no recourse for spending a partial coin. Needless to say, non-divisibility will make a practical deployment difficult.
Why? Why not simply set a minimum quantum for transactions in Zerocoin, like the penny or the satoshi? Or why not redeem the Zerocoin for a Bitcoin, which is divisible and which would be free of (traceable) history.
Re: Zerocoin: making Bitcoin anonymous
#38Can't we just open a mtgox account, deposit and then withdraw?
MtGox knows who you are, and is not a secret underground operation thumbing its nose at The Man. Over the long run, you should consider them as transparent as any major, bailed-out bank.
Correct. Zerocoin is a way to make it mathematically difficult (read: likely infeasible in practice) to de-anonymize instead of trusting a central party. Cool stuff!
Re: Zerocoin: making Bitcoin anonymous
#39Here is a puzzle for HNers. Suppose that I am a user who wants to anonymize some Bitcoins, and I am willing to wait expected time N before redeeming my Zerocoins. What is the correct probability distribution for me to pick my wait time from?
As far as I understand the posting, this depends on the total minted Zerocoins. Since you can not tell with any certainty that a specific Zerocoin is already redeemed ( except if all are redeemed, more on that later), the probability that a specific Zerocoin belongs to you is 1/n, where n is the number of addresses which have ever generated Zerocoins.
However, there are some assumptions in the argument, most importantly that the number of Zerocoins is always rising. Dropping this assumption ( and mentioning that I did not double check my argument), the probability that the last redeemed Zerocoin is also the last minted is 1/min( n(t) + m(t)), where n(t) denotes the number of addresses which generated Zerocoins since some time t and m(t) is the number of not redeemed Zerocoins at t. At least from the perspective of an outside observer who does not hold any Zerocoins. In the case of an attacker with f Zerocoins the probability would be P=1/min(n(t)+m(t)-f).
The worst case is then, that your adversary holds all Zerocoins just before you mint your Zerocoin. And a attacker with large resources can continue to mint Zerocoins until he runs out of funds, simulating a working anonymising ecosystem. Therefore you should wait until a plausible attacker runs out of funds, that is for a attacker with total funds f0 (using the above formula at the time of your minting of a coin t=0 with m(0)=f) P0 > 1/(n(t) - (f0-m(0)). where PO is a parameter describing your desired anonymity level. And therefore you should wait for the minting of n(t)> 1/P0 + (f0 - m0) Zerocoins before you redeem your originally minted one. Simple corollary, you should mint when there are many coins in existence and you should pick poor enemies.
Re: Zerocoin: making Bitcoin anonymous
#40Technically, this is very cool work. But one thing the paper overlooks is divisibility. How does one make change with zerocoin? It appears that the trapdoors allow only a whole coin to be spent, with no recourse for spending a partial coin. Needless to say, non-divisibility will make a practical deployment difficult.
Why? Why not simply set a minimum quantum for transactions in Zerocoin, like the penny or the satoshi? Or why not redeem the Zerocoin for a Bitcoin, which is divisible and which would be free of (traceable) history.
Because each coin transaction entails a 40KB zero knowledge proof. So a Satoshi will require 40*10^8 KB transferred for a 1BTC transaction.