"Is Zcash really private?" -- Rebuttal

"Is Zcash really private?" -- Rebuttal

A few days ago I saw this post on r/zec, which was meant to address some criticisms of Zcash. I saw some things which I'd like to respond to.

Claim: "Most ZEC is transparent, so Zcash isn’t private". At present, most ZEC is indeed in the transparent pool ... this no more proves that Zcash isn’t private than the existence of other non-privacy coins like Bitcoin proves that ZEC isn’t private. It’s irrelevant. Zcash can be as private as you please.

The issue is not with what Zcash can do. Indeed, z2z transactions are very private. The actual problem is how the shielded and transparent pools interact with each other, in ways which severely damages the privacy of shielded transactions. Since the overwhelmingly vast majority of transactions and volume on Zcash are transparent, right off the bat the crowd to hide in is extremely tiny compared to, say, Monero. Or even a tiny jokecoin like Wownero, ranked ~#1800 by market cap.

Even then, most of the very few "private" transactions are deanonymizable, due to interactions with the transparent pool causing privacy leaks. There is research to support this. According to one article, "relatively simple heuristics ... reduce the size of the overall anonymity set by 69.1 percent." Granted, this article and the paper it references are quite old at this point. But nothing has fundamentally changed in the situation, considering it's still the case that only a very small minority of transactions are shielded. Later research directly confirms that the methods of the previous paper are still effective, also adding, "on top of the already minuscule set of users even utilizing shielded transactions at all, Zcash is effectively traceable as of this study ... As we expected, Zcash’s privacy guarantees are questionable. As the volume of public transactions increase at a much faster rate than that of shielded and private transactions, the overall anonymity of ZEC users, even if they are fully utilizing the features of the shielded pools, is decreased."

Zcash provides a false sense of security. Many people will hear that it is a "privacy coin", and assume that their transactions are private. Yet, almost all users will be dealing with the transparent pool, even if they don't realize it. Even if someone knows that they need to use shielded addresses, they are often only used as a "mixer" of sorts, and the funds are soon sent back into the transparent pool. This type of behavior is common and usually traceable, as shown by the previous research. Even users who are knowledgeable on Zcash, and prefer shielded addresses, can be easily defeated by this weakness. Adding to this, most of the largest data collectors such as exchanges completely refuse to deal with shielded addresses, which forces users to deanonymize themselves. So in practice, Zcash's privacy is non-existent unless someone knows exactly what they're doing and goes out of their way to carefully avoid any situation which might degrade their privacy. But then, the same can be done on Bitcoin, so what's the point when at least on Bitcoin your reward is a sizable anonymity set? And at least most Bitcoiners know they're operating in the clear -- since Zcash masquerades as a privacy coin, users can often be made more careless.

So yes, Zcash's unwillingness to enforce privacy does indeed make it, more or less, no better than Bitcoin in terms of privacy.

Claim: "When privacy is an option and you use it, you immediately look suspicious": The presupposition here is that honest people won’t choose to keep their own business private. This is both a ludicrous belief and would cut their own coin to pieces. If using the privacy option in Zcash is cause for suspicion, what of folks who buy into cryptocurrencies that are nothing but private? Wouldn’t that be suspicious? The fact is all currencies (fiat and crypto) are (or can be) used for illicit activities as well as legit ones. And at least in nations where privacy is a human right, claiming that right does not or should not lead to suspicion, whether it’s “always on” or an option.

Here is a brief moment of sanity in this mostly nonsensical post. Yes, correct, privacy is a simple human right which should not be viewed with suspicion ... which is why that should be the unwavering standard, not something you borderline falsely advertise to your users with buzzwords, when in reality you are 99.9% a surveillance chain who refuses to acknowledge that this lack of private usage is a problem. In practice, people who opt-in to privacy are always flagged as suspicious. An almost identical example is exchanges flagging Coinjoin on Bitcoin. Zcash, like Bitcoin, will never be private nor fungible so long as shielding is optional.

This will also be important in the next section.

Zcash’s duality is a strength — not a weakness, "Broader availability": Most privacy coins are available from only a small subset of exchanges, whereas transparent coins are far more broadly available. By having a transparent side, Zcash is available at most exchanges. Once you have transparent Zcash, you can immediately shield it just by forwarding it from your transparent address to a shielded one.

Has the author not considered why this is the case? A major exchange whose objective is to scrape as much data as they can, for one reason or another, is not going to look kindly on privacy. Does the fact that they refuse to support actual privacy coins but do support Zcash, not raise any red flags? And wait a minute, the author was just talking about how privacy shouldn't be viewed as suspicious, so why are they now claiming that this is somehow a good thing?

"Broader applicability": Some organizations may be more suited to transacting with transparent funds. Consider a charity or a government, which may have public transparency or auditing requirements. They may want to use T addresses to receive and hold donations. Yet a donor can send shielded funds to that T address to protect their own anonymity and keep their financial situation private. A cryptocurrency without a transparent option would require you to sell some privacy coins at an exchange to acquire transparent coins to donate to that charity. This makes usability of Zcash across different applications superior to the alternatives.

Apparently, the author doesn't know much about privacy coins or even Zcash itself. Almost all privacy coins, as well as Zcash, have so-called "view keys" which allow users to provide transparency when they explicitly and voluntarily agree to. This seems to be just an excuse to justify Zcash being a surveillance chain.

to one in a high-risk profile, e.g. government intelligence, spy, or illicit activity (which I do not condone), these subtleties may be of interest ... If you want absolute, full privacy, you can have it with Zcash, and you can have the best in class.

I am curious to hear if the author has a theory on why, then, almost no one in high-risk situations use Zcash. Users on Tor-and-I2P's free markets unanimously prefer Monero. These people, whose lives are on the line, do not trust Zcash. Zooko even claims (another example, and another, and another) this is a "good" thing... yeah, it's definitely a good sign that people whose lives literally depend on having good privacy, prefer your competitor. Either you have privacy, or you don't; People engaging in illicit activities don't care if it hurts your feelings that they use your coin, they choose based on what actually works to provide privacy.

This "best in class" privacy is also extremely complex and unproven. There are very few people in the world who fully understand the inner workings, and aside from potentially fatal bugs being found (and luckily patched) on mainnet, the most recent Halo proving system was also delayed multiple times due to multiple professional audits failing to catch a bug. The entire system could come crashing down tomorrow whether due to a flaw in the implementation or in the fundamental mathematical assumptions. Some even suggest that there may be backdoors within the transaction protocol, and it's very possible that there are, but since there's no direct evidence of that I won't make a claim on it.

So, to answer the question. Is Zcash really private? No.