Final Exam: The Privacy Gauntlet

This is the part where the safety nets come down. No pretests, no warm-up analogies, no “guess before reading” — just the course, asking whether any of it stuck. Everything you need, the previous six lessons already taught you. Read each option twice; the trap is usually the one that’s 90% right.

How this exam works

This is a graded exam. Questions come one at a time. Once you submit an answer it is final — there is no going back, no second try, and a wrong answer simply fails that question. Your score stays hidden until the end, where you need 70% to pass. Read every option twice before you commit.

Question 1 of 30

A friend says 'Bitcoin is anonymous — my address isn't my legal name.' What's the precise correction?

It's private because the amounts are encrypted even when the addresses are publicIt's anonymous as long as you never withdraw from a KYC exchangeIt's pseudonymous: an address is a pen name, and one identity link exposes its whole permanent historyIt's anonymous until you reuse an address, after which it turns pseudonymous

Select an answer to continue.

Course Recap

Big picture

The complete Zcash mental model

Zcash, end to end
- The problem (Bitcoin)
  - Transparent, append-only ledger
  - Pseudonymous, not anonymous
  - CIOH, change detection, KYC kill shot
- Four privacy axes
  - Sender anonymity
  - Receiver anonymity
  - Amount confidentiality
  - Unlinkability
- Three roads
  - CoinJoin — obfuscation, toxic change
  - Monero — rings, stealth, RingCT, always-on
  - Zcash — zk-SNARK, whole pool, opt-in
- Zero-knowledge proof
  - Completeness, soundness, zero-knowledge
  - Ali Baba cave — one over two to the n
  - zk-SNARK — succinct, non-interactive
- Inside the machine
  - Note replaces UTXO
  - Commitment hides and binds
  - Nullifier stops double-spend, unlinkable
  - Value commitments sum to zero
  - Orchard / Halo 2 — no trusted setup
- Staying anonymous
  - z to z, stay in the shielded pool
  - Boundary crossings leak amount + address
  - Viewing keys — read-only, opt-in
  - Old transparent history stays public

Seven lessons, one structure: the Bitcoin problem, the four privacy axes, the three roads, the proof that powers it, the machine inside, and the discipline to stay hidden.

Key Takeaways

What to remember

Bitcoin is pseudonymous, not anonymous — a public, permanent ledger plus on-chain clustering (CIOH, change detection) and an off-chain KYC anchor turn an address into a name.
Private money needs all four axes — sender, receiver, amount, and unlinkability. Miss one — especially unlinkability — and the others can be reconstructed.
The three roads differ sharply — CoinJoin obfuscates on a glass chain, Monero hides everything by default among decoys, shielded Zcash proves validity with a zk-SNARK against the whole pool (but opt-in).
A zero-knowledge proof is certainty without disclosure — completeness, soundness, zero-knowledge — and a zk-SNARK makes that proof small, non-interactive, and blockchain-ready.
Keep the commitment and the nullifier straight — a hiding-and-binding birth fingerprint vs. a one-time spent-marker that stops double-spends without revealing its note; value commitments sum to zero to prove balance; Orchard/Halo 2 needs no trusted setup.
The cryptography is a vault; living in it is on you — receive shielded, hold shielded, spend z to z, and avoid the self-doxxes (amount and timing correlation, KYC deshields, address reuse). Yesterday’s transparent history stays public forever.