| I read through this entire gist, and I was not able to find a single section categorically proving that Monero is unsafe. It makes big claims such as "Monero has been broken." and "Monero is substantially unsafe and incapable of providing anonymity [...]", but then at the end the very same paper says the following: "Monero is the best-in-class anonymous cryptocurrency in production today." What the hell is it trying to say then? From what I've been able to gather from this gist, its argument that Monero is "unsafe" hinges on the extra sentence: "under the formal threat model proposed and analyzed in this paper". Curiously, section 8, "Analysis Under Full Threat Model", is completely blank. And it also curiously never properly defines the "full threat model" From what I gather however, its main argument is that 10 decoys (in RingCT) is too few and there could be probabilistic attacks and the some of the decoys could be malicious actors. The Monero developers already know this however, and are working on Triptych and Arcturus [1] to fix this. Note that this doesn't mean that Monero is 0% safe (as the gist likes to pretend by writing stuff like "Monero has been broken"), but it rather means that Monero is 80-90% safe rather than 100% safe. And if you're that worried, the Monero wallet offers the option for churning [2] Lastly, the gist is more than 3 years old now, without a single update to it. Does the author not know that in 3 years there could be lots of upgrades and fixes to Monero? The fact that the largest Dark Net Market is now using Monero only surely should be an indication that Monero is doing something right? [1]: https://www.monerooutreach.org/stories/monero-triptych.html [2]: https://monero.stackexchange.com/questions/4565/what-is-chur... |
It's trying to say everything else is broken too. I think Zcash is now best is class though.
> Note that this doesn't mean that Monero is 0% safe (as the gist likes to pretend by writing stuff like "Monero has been broken"), but it rather means that Monero is 80-90% safe rather than 100% safe.
No, the main point of the gist is that the analytic attacks are able to entirely break any user whose wallet functions as a stream wallet, which in practice is nearly everyone. To fall outside of the "stream wallet" definition provided in the gist, you have to run a custom wallet (not the main Monero code), and the implementation of that wallet has to be highly user hostile.
The attack doesn't target weaknesses in the monero implementation, it targets weaknesses in the monero architecture. Any decoy system has the exact same issues. If Monero is still on a 10 decoy system (even if it were on a 100,000 decoy system), all the attacks in the gist apply.