Satoshi Has No Clothes: Failures in On-Chain Privacy by Ian Miers (Devcon4)

really the point of this talk is how do you evaluate privacy in cryptocurrencies the point is not the shells e-cash I am one of the cofounders of Z cash I am on the board of directors of the foundation but that's not why I'm here today the point is that we as a community have done a very poor job evaluating privacy approaches for cryptocurrencies and the problem is that we need to get better at it and we need to get better at it now because at least one of these aetherium bitcoins e-cash something that all of us have ever heard of maybe dogecoin I don't know is going to be the future of payments and it's gonna take a while but at some point when this happens we're gonna realize that this is a major privacy problem we wait until then to actually address it it will be far too late so I've been working on privacy and cryptocurrencies since 2011 for precisely that reason it wasn't clear to me that Bitcoin was gonna succeed but it was clear to me that if it did it was gonna have a pretty big privacy problem and at the time everyone basically believed it was private this was sort of the best logic that everybody had and of course we know now how laughable that is not only are there a bunch of academic research that identifies privacy flaws in Bitcoin and other cryptocurrencies there are actually commercial companies in the business of doing analytics and figuring out what's going on so this is laughable right don't believe it in fact far from being you know anonymous it is in fact Twitter for your bank account right cryptocurrencies expose all of your spending habits to everybody right and by everybody I mean everybody your creepy ex girlfriend or boyfriend your business competitors right if you're trying to compete with someone they can figure out what your supply chain is how much you're paying your employees use that to poach them etc right everybody right if your government right and you think you want you don't want privacy for crypto currencies think again because there are other governments out there that don't like your government I don't care if you the Chinese the Russians or the Americans somewhere in that triangle there's someone out to get you and they also would love to have economic information about how to you so nobody wants this information to be public to everybody and it really is today that's the nature of a blockchain and so as we thought of this there have been a lot of proposals on how to add some amount of privacy to cryptocurrencies and these range from very mundane systems that have no chance of actually working all the way up to very sophisticated ones zero cash on there was actually my doctoral thesis route took me about five years to finish all the details of it the question is how old are these things work because no matter who you are if you're designing a cryptocurrency at some point you're gonna need to add privacy to it and you really need to use one of these techniques or something else that's come along I need to know if it's actually private and this is hard evaluating privacy for cryptocurrencies is not easy right to do it empirically would be akin to trying to evaluate privacy for the internet in 1992 when everything was just started when the first things that were running were only at CERN right we can't measure it empirically right we don't have really real-world usage that isn't too speculative right we don't have day-to-day usage we don't have this rich tapestry of data where I buy a coffee I go to the subway I could check into the metro then I buy stuff at lunch which has some structure none of that exists so there was no way to do this empirically and more of our I as a researcher even what little data there is out there I don't have access to you're right I have budgetary limitations I have ethics limitations I can't buy these third-party data sets that Chan alysus and other people use so we really have no way to do this empirically and as a result what we have to do is we have to result the thought experiments and this is somewhat unsatisfactory because it's not empirical evidence it's very easy to accuse people of being biased at some point Twitter will probably start going on about that you know as people start tweeting slides right now about me but it's the only thing we have right and to do that you need to understand what attacks really look like and we need to look to other things where you've had privacy problems as inspiration because we're looking 10 20 years down the line for this since we can't look at cryptocurrency today to find out what the problems are going to be in 10 years and so what are real-world threats well the easiest thing to look at is what advertisers do with payment data so where you've seen advertisers such as Google collecting all kinds of data about payments you make not just online but these are actually trying to get real-world payments you make when you walk into Walmart all two-year something and try to make a purchase and Google's gotten a lot of headlines about this because hey Google is evil it's a very good one but reality the matter is everybody's doing this and in fact Google is probably one of the more scrupulous people at the moment that they're doing it you can be assured that there are people doing far sketch you of things with this data right and what can you do with that well one thing that actually is a pretty old story you can use payment shopping data to figure out for example when someone is pregnant in this case you can target was building up profiles based on customer loyalty cards of who bought what and then they were identified for example pregnant women and send them ads for baby products and in this particular case they did this to a teenager sent the ads drawer house her father saw them and from there well father found out that her daughter whose daughter was having sex and was pregnant kind of a problem and so this is the kind of thing we're looking at and in fact we've seen stuff closer to home with payment systems where venmo which for those of you who don't know there know is a way that you can pay your friends for example for dinner in common in the states when we don't have very effective payment systems like European banking but anyway VIN Moe US start-up had a social feed because everything is social these days of payments you made of who from who to who and why and this was by default public and so people found out about this and started writing things like here he was a nice guide to how to stack the stock your ex-boyfriend and of course this is you know kind of cute it's got a fun laughy picture but if I flip the genders on this or you know really gave it any kind of appropriate treatment you draw this it's completely creepy right and this is really someone actually doing this not tongue-in-cheek and so no later if we keep doing this you end up with the same thing but how to stock your ex using aetherium or Bitcoin or whatever and this is the problem right so what I said cryptocurrency was Twitter for your bank account it's an accurate statement but it doesn't entirely tell you how things go wrong and I think one of the things you should think of is that it's a tracking cookie in real life right so we're used to these notions of we are tracked on the internet everything we do on a day to day basis is catalogued by Google by double-click by Facebook well cryptocurrency takes that and it's like web 3.0 but in reality and this is clearly incredibly problematic so we really need to get this to work to stop this and so how do we do that what are the defenses well the first thing if you take nothing else from this talk is that in a world of AI social credit systems you've probably seen that video going around on Twitter from the train in China and targeted advertising plausible deniability is not a plausible defense right so the original model for privacy and Bitcoin in particular was this idea of if someone shows up and says hey did you buy weed at you know a corner store or whatever you can point to and go oh well you can't prove that transaction was mine and this is sort of the kind of mentality that someone who lives in their parents basement and been mining cryptocurrency and what they used to use to play counter-strike would come up with but it doesn't work right it doesn't work in reality now and it didn't work in reality then right because look if the police are gonna show up at your door and ask you what you were doing plausible deniability isn't gonna get you out of a search warrant isn't gonna get you out of what they find and they start to think this is not a good way to do OPSEC in any way shape or form but it was what people were trying to do so don't do that do something at least slightly better and the problem with what is better is that blockchain privacy is in fact not intuitive right cryptocurrencies broadcast all of your transactions to everybody and this is the thing that people sort of revolt on like you had a gag in your mouth ago what we got to fix that and it actually turns out to be easy enough to obscure the data on a blockchain from passive observers who have nothing to do with you and know nothing about you it's not easy to do perfectly but you can do it but that's not who you need privacy from you need privacy from people who send you payments and people you send payments to right merchants you don't want to be able to track you you don't want people to identify you based on putting payment information up online and once you get to that hiding transaction values confidential transactions or whatever or hiding your IP address isn't enough you need to hide the transaction graph and this turns out to be really what a lot of the more promising things in here focus on but even then they don't do that good a job right so there's sort of three sets of approaches to privacy you can think of there's Bitcoin atheria etc where you just explicitly identify the origin of your payment either of you TXO or the account and this leaks the transaction graph completely there is no privacy right then there are the so-called decoy transaction based systems which try to obscure the transaction graph these look like something will you pick five possible decoy sources and say look this is the real origin for my payment but here are five other things which it could have been and no one knows which ones which it's just sort of a mess and this looks like coin join nimble Wimble etc or crypto runo ring CT Manero and so that's one set of approaches and then finally though the approaches of zero coin in zero cash are deployed in a couple of different Kippur currencies where you don't identify the origin at all and you have no transaction graph to recover at least if you use the privacy-preserving transactions right so what does this look like visually well in Bitcoin you have to if you're paying a merchant you have to identify the exact origin in decoyroid system such as Manero same thing you have to identify the origin but it hides amongst a couple of different locations right and then that's sort of this is what you're doing you're adding noise right it's chaff right the real transaction is somewhere in there but hopefully if you don't have very good vision you can't figure out where it is and then there are things like zero cash z cash where this data just is not there right and so we know that Bitcoin isn't private we there's been a lot of analysis on zero cash grow academically and empirically we know that the privacy holds up if you use the shielded features and use them well the question is do these decoy based approaches work and spoilers the answer is no but are they private and the reason they aren't is because there's some interesting structure you can get out of this right when you make a payment to a merchant what they see is not these three decoys they see those decoys and their possible origins as well right there's you know each payment is a possible source each one of those has three possible sources of five or 11 or whatever it is and sort of fans out backwards and this sort of tree of possible things that you weren't interacted with you can call it I could think of it as a taint tree and you can also use this going forwards right if I pay emergent right I see where the money goes and then I see everyone who tries to spend that and some of those people are gonna be spending it as a decoy right it won't be legitimately theirs but one of those will be the merchants and again this fans out right there are three possible things that were spent in each one of those as three possible things that were spent and we just keep going forward so it's cone going back cone going forwards and so this has a couple of immediate problems that should make it clear that you know things are not what you think things are not completely private right and so the most obvious one is what I'm going to call an overseer attack which is suppose your merchants say your Starbucks and you have someone coming in and buying coffee every day and they're buying it with the cryptocurrency that's private should Starbucks be able to build a profile of how much caffeine you're drinking on a week maybe sell it to your health insurance company or something ideally no right privacy should mean that's not possible they learned nothing should be as private as cash except that's not true right because if you make one payment to Starbucks and then you make another and you make a third they're gonna see these different taint trees for each one of these transactions and there's no immediate linkage between them so you might think it's private but of course if you look through this entire graph you're gonna see intersections in it because the payments are going to have common origins right you're gonna have loaded all the funds off of some transaction on coinbase or shape-shift or whatever at one point or you change transactions every use so this is a basic intersection right so there's that here's another one let's suppose you were dissident right in Saudi Arabia you have a website on the dark web that you use to take donations right poor right taking anonymous put another to dress up your anonymous you should be completely safe they're never gonna figure out who you are and so because you think it's private you take that money and you immediately deposit it in a cryptocurrency exchange in the Mideast that actually has all your kyc data they know who you are because of things private no one should be able to blink the address online that's receiving payments with your deposits that would be another thing you'd expect from a private cryptocurrency yeah and well you don't get it here a reason for this is that say Bob is this dissident and he's taking funds and he's going to deposit all of them right again when you if you pay Bob two or three or four times and you deposit these things and you look at 13 right if you are the Saudis and you compromise this exchange you subpoena it you hack into it whatever it is you're gonna get for every customer these taint trees of every possible payment they got and if you see someone who got one of these like tracking payments you made say the green one they're gonna be a couple of people who got those right because everyone picks decoys at random someone might have just picked that by accident right and at least right now things aren't bad enough you're willing to just go shoot anyone based on me like five percent chance that they were actually your target however you didn't send one payment you sent a bunch and so what are the odds that some person has all of those payments in their taint trees right that all of these things are deposited in their account no approximately zero and so now you have with high probability identified the person and so this is really bad this is going to get you arrested or worse again you thought it was private that's not right and so it turns out they repeated interactions with a cinder or a recipient are dangerous alright and this is where most privacy coins break right and this is just because no one is thinking about these things in the context they're really gonna be used but that's not even the worst thing you can do right so remember I said there's at Aintree you're looking backwards you can see what where the coins have gone well I'm also looking forward when you pay someone as I mentioned you can see where payments may have gone and this is again it's uncertain it's some kind of sort of weird quantum foam but there's a little bit of information in there and what can happen is let's suppose you want to find out if a friend of yours is making repeated payments to our particular merchant so you send the merchant one transaction and you send your friend one transaction and these can be dust right little tiny amounts and you're gonna see these two sort of things fan out over time of where the money goes and then you don't learn anything until maybe some of the money you paid your friend ends up in the same address as somewhat something you paid the merchants and this doesn't tell you much it could be that did someone just pick the decoy that happened to overlap it could be that the merchant that your friend paid the merchant and was moving their money into off of their hot wall into a cold store or something you don't know there's not enough information here to really count but you suggest something might be going on okay but what happens if this again happens multiple times now you know that something is wrong now you actually have information these the odds of this happening by happenstance because it's repeated interactions are approximately zero right and then you can watch this happen 3 4 5 10 20 times and now you really know for sure and so for example you could use this to you know if the merchant was pornhub you would use this to confirm that your friend was in fact subscribing to pornhub and that would be somewhat embarrassing right hey he's looking at porn be he's paying for porn and I guess worse actually he's probably paying for porn with Verge which really like you have get better taste taste and friends so again this is again I think fundamentally violates what you'd expect from a privacy coin right it shouldn't be the case that random people by sending you know tainted dust to a bunch of different addresses can recover how things are being spent but in fact you can do that right and so our decoy based systems private the answer is no right with a little bit of thought and I emphasize this is a little bit of thought right we've come up with three plausible attacks that can break these things right and I'm not saying you can execute these in practice in every case again we don't have enough empirical data to evaluate any of these things but at least as hypotheticals these things don't pass the smell test and so we shouldn't be using them and so why is it that these things are used why is it that these are regarded by credible people as viable approaches to privacy right like I basically disturbed you like Satoshi really has no clothes so oh god that's a horrible overlap or phrase with that slide but why are we still using them and the answer is in part because privacy is hard it's hard to understand the people who are building these things are trying really hard they're doing very impressive things right it's building up impressive communities but if you don't understand privacy it's a little tricky to get right so that's just you know to err is human but part of it is the way that you know self-promotion works and cryptocurrencies right that we have this like you've got to be better than the other one kind of thing and this ends up with sort of privacy fear right one of the typical things that happens when you interact with someone who's an advocate for a privacy coin particularly on Twitter which I guess is not a good way to get normal behavior but whatever is that they'll give you these lists of features at the coin that's right it has stealth addresses it has rings signatures it has cut throughs it has ZK snarks it uses VPN sort or right and this whole list of features right doesn't tell you anything about what actual privacy you get but it sounds really impressive and this is the thing that we just need to stop doing right and this applies you know to some of these techniques really don't work at all to other ones like ZK snarks are quite promising but the technique isn't the solution right this is a technique the whole protocol is what you actually have to build and when you build a whole protocol you need to actually evaluate it not based on the features it has but based on you know what it actually does what does it use and so you should really ask yourself like here's all these features what are they hiding and do they actually accomplish it and the answer was typically they don't hide much and they don't actually hide it very well does it hide everything else and the answer there is almost certainly not and then like really how is this thing being used and the answer there is going to be in a way that probably isn't safe right and what this comes down to is cryptocurrency is Twitter for your bank account it's a total privacy void it's a vacuum the thing everything is broadcast to everybody right this is the akin to me telling you you were standing naked in Times Square right and what most of these privacy coins want to do is hand you a band-aid right and like given the magnitude of exposure right that you know that's not really gonna cover everything that doesn't really work right and it's you know it's like trying to build a space shoot without a duct tape and overalls right that's not how you go about protecting yourself from a very hostile and very exposed environment you need to actually do this from the ground up and we do actually have strong approaches to do that I said the point wasn't to shell Zee cash but I am going to for just a second because you can use these two techniques - and your cryptocurrency right we've gotten no strong privacy that's actually quick less than two seconds to create a transaction less than 40 megabytes of memory this went live sometime in the last two days I haven't gotten much sleep so not sure what day it is and we also have strong privacy techniques for other things these aren't deployed yet but you know zero cache for layer one again use this and whatever cryptocurrency you want we have vault blind off chain lightweight transactions this is strongly private layer two and thing called bolte labs that were in the process of setting up and then lastly this is actually academic work serafall I think called Z Exe which enables decentralized private communication both of these are papers those QR codes go to them and the point is there really isn't an excuse these days for using weak privacy techniques we have strong ones we have strong ones that uck snarks you could do these with bullet proof so you could use these other crypto and you should do them you shouldn't be using half-measures and you shouldn't be telling people your things are private when they're not I'd like to briefly touch on a different problem because I said I wasn't gonna cryptocurrencies I'm not gonna call anyone out by name but usability is particular as a problem and it's actually one that we d'caché have had issues with ourselves right turns out if you have strong privacy that isn't enough you actually need good UX you need also to discourage people from doing meaningless behavior like say shape-shifting in five 3.52 cents into shape-shift and to say Manero zeke ash to ash whatever and then immediately shifting it shape-shifting it back out because that gets you no privacy right you sit there and you look and anyone can see what happened and yet people do this right we've seen this happening across the number of crypto currencies and that isn't their fault but you need to educate users right you need to have full privacy on mobile right that's a protocol issue and you can't require people syncing the whole database just to get privacy private payments and this is really important this is probably actually the hardest thing that we have left for building privacy is getting good usability and getting good answers on mobile the core protocols in my admittedly somewhat biased opinion are mostly done you can do tweaks to make them more performant you can develop novel new cryptographic underpinnings to make them faster or have better trust assumptions but we know basically how to build these things we know the basic parts you want to assemble right so in conclusion um we need to critically evaluate privacy vulnerabilities and cryptocurrencies right most privacy preserving cryptocurrencies have terrible privacy right like merchants can't race you when you make payments governments can identify who you are if you put a single address up online I mean that would really surprise a bunch of people for how these things are getting used right your friends can find out if you're making repeated payments to pornhub that's kind of embarrassing these decoy based approaches just don't work right and in general we need to get better at evaluating these things we need like avoid having people do privacy theater right a lot of these cryptocurrencies are effectively like the TSA right they have a lot of things that look really shiny they make you maybe feel a little safer but at the end of the day they don't actually fix the problem they don't actually give you protections and that's just bad and lastly usability is important and that really is probably the the thing that we need a lot of work on the space more than anything else and so with that I'll take questions comments Rotten Tomatoes whatever I'm curious about grin specifically and as as far as I know with like the decoy based approach that uses like different different blinding factors for each transaction right I'm curious if that changes at all like an improvement over if not even talking about the coin joint aspect of the transactions just with the planning factors does that change at all the privacy symptoms not really so the problem with member raynbow and grins so far it's really promising techniques for compression is that a member Wimble transaction is you identify the you TXO your spending and you generate a new output you hide the values or hide the addresses but the transaction graph is still there the way they get privacy is in theory you can not interactively aggregate all those transactions together and get a bigger mix the problem is that those transactions are broadcast to our open peer to peer network and anyone who connects can just download and see every individual transaction and cover the transaction graph if you're a researcher this is easy if you're an intelligent service this is really easy it just that's not a privacy answer yet they need an answer for that and they don't have one so far you