I still don't get how a dozen people sending to a single address of mine is protecting their privacy better than if I provide one address per transaction.
Well, suppose you are collecting donations from co-workers for your boss's birthday present. If you give them all the same address, you see the incoming transactions and the total balance, but you won't know who paid what, so they have some anonymity. If you give a different address to each co-worker, and remember who got which address, then you can tie the amount of each donation to the person who sent it. Then you can inform your boss about who didn't pay for her present. Clearly, your co-workers' anonymity has been compromised in a way that affects (some of) them adversely.
By providing a single address, everyone can see the average amount donated per person, and know how many people didn't donate. Using additional information, it might become possible to make educated guesses about who gave how much. Now, not only you and the boss, but EVERYONE has information about the donations.
Better would be to print out enough donation addresses so there is one for each employee. Then cut up the paper so that there is only one address per piece. Turn then face down so nobody knows what address anybody else gets, and let everyone choose randomly.
Now nobody other than the recipient knows exactly how much each person donated.
I already said this on this thread but I'll say it again: Stealth addresses. A lot simpler than cutting up pieces of paper, and achieves the same result
Of course, privacy comes at a cost of security. It is now possible for the person making the collection to lie about the amount that they received, skimming a bit off for themselves. The group can decide if they want the list of donation addresses to be public or not.
There may be a way around this problem, using Gregory Maxwell's Merkle tree-based auditing technique:
1. After receiving the donations to various addresses, the donation collector creates a Merkle tree: every leaf contains hash(address to which coins were donated, sum donated); every node contains hash(child 1, child 2) and the total sum of the donations contained in the children.
2. The donation collector creates a separate file for every donator, which includes the branch of the tree relevant to that donator (the path from the donation address to the root).
3. Since even the collector doesn't know who donated to which address (and therefore who should get each file), she encrypts each of these files with the public key of the address from which the donation came, and publishes all the encrypted files.
4. Each donator decrypts the relevant file and verifies her inclusion in the root.
5. The donation collector publishes a receipt, proving that she bought the boss a gift which cost at least as much as the sum of the root.
This way, nobody knows who donated what, everybody knows the total sum donated, only the donation collector knows how many people donated and the distribution of the donation sums, and everybody knows that the collector didn't steal.
It's a bit complicated for such an obscure use case, but I just love how smart cryptography can solve everything
EDIT: Now that I think about it, maybe it's not such an obscure use case. We already discussed on this thread the advantages of stealth addresses for charities. Think about a charity that wants to initiate a limited-time fundraiser for a specific cause. It publishes a stealth address for donations. Every donation ends up in a different address, thus distancing donators from each other as well as from the charity. This increases privacy for the charity and for its donators, but lowers transparency.
To regain transparency, the charity uses the above auditing technique as soon as the fundraiser is over. It then produces evidence that it spent a sum of money at least as large as the root sum towards advancing the cause.
This could also be useful for things like crowdfunding campaigns on the bitcoin-only version of Kickstarter (does that exist yet?).
