Quote from: fluffypony on March 25, 2015, 05:07:12 PM

Quote from: majamina on March 25, 2015, 04:51:30 PM

so you are saying that if someone is stupid enough to send more coins than they need to a dark market, spend some of them on something illegal, then send unmixed change from the dark market back to their own wallet they compromise their privacy.

fair point I suppose, but I don't see a huge 'opsec' challenge to avoid this

No, you're misunderstanding how cryptocurrency works. Let me use a simplified example.

Your wallet balance doesn't actually exist. It's instead a representation of all of the unspent transaction outputs (utxos) in your wallet. Let's say you have the following UTXOs:

Amount	\|	Address
100 DRK	\|	AAAA
100 DRK	\|	BBBB
100 DRK	\|	CCCC

Now you send those off for pre-mixing. Your wallet's UTXOs now look like this:

Amount	\|	Address
50 DRK	\|	ABAB
25 DRK	\|	CDCD
25 DRK	\|	EFEF
180 DRK	\|	GHGH
20 DRK	\|	IJIJ

You now buy something on SuperDodgyMarket for 10 DRK, the address you've got to send it to is XXZZ. As you can see, you don't have a 10 DRK output in your utxoset. So you HAVE to use an output > 10 DRK. Thus the resulting transaction looks like this:

Inputs:

Amount	\|	From Address
50 DRK	\|	ABAB

Outputs:

Amount	\|	From Address
10 DRK	\|	XXZZ
40 DRK	\|	KLKL

As a result, your wallet's utxoset now looks like this:

Amount	\|	Address
25 DRK	\|	CDCD
25 DRK	\|	EFEF
180 DRK	\|	GHGH
20 DRK	\|	IJIJ
40 DRK	\|	KLKL

This is not anything "stupid" you've done, this is through the normal course of things. It doesn't matter what you do next, your entire set of "anonymised" outputs is now at risk because of the 40 DRK in KLKL that you will use in the normal course of things (eg. if you need to send 200 DRK to an exchange your wallet may pick the 180 DRK output and the tainted 40 DRK output, and now you're screwed).

This has nothing to do with MasterNode opsec, that's a different matter. This has to do with Darksend's anonymity not being "good enough" (remember I was replying to Macno, so different conversation to the MN threat model) because users can and will be deanonymised after the fact. Thus for users to actually take advantage of Darkcoin's privacy they are required to practice strict opsec of their own, remixing their entire wallet after every transaction. The slightest mistake or relaxation on their part can mean they are instantly compromised (from a privacy perspective). And if you've got to exercise such strict opsec as a user, why not just use Bitcoin?

thanks for that, but my understanding is when you tick the 'darksend' box you will only send from your mixed UTXOS, so the situation you describe doesn't arise. ...this of course requires you to send denominated amounts....