What are the advantages provided by using Monero compared with other popular cryptocurrencies such as Bitcoin?
Specifically, what unique features does Monero have relating to privacy, PoW security and scalability that is not provided by other leading cryptocurrencies?
It is the only private cryptocurrency in use today which is truly fungible as all transactions are private and created equal.
It satisfies the 3 important properties of electronic cash: decentralized, private, digital.
These are the major features that distinguish it from all the rest, on a protocol level:
Nobody inspecting the blockchain can tell from where the funds came (untraceability). This even includes the recipient (you). Just by opening your wallet, even you don't know from where your funds came, unless you provided the sender with a paymentID unique to the transaction, or you kept track yourself by some other means (ie if you send from an exchange you can match a transaction just from the timestamp, unless you receive a lot of transactions regularly). This is achieved by utilizing one-time ring signatures. While commonly referred to as "mixing outputs", it works a bit different than what the name suggest. When spending, the sender can pick any random output to use as decoys which hide the real one getting spent. This takes care of the sender's privacy.
Nobody inspecting the blockchain can tell to where the funds went (unlinkability). This even includes the sender (you). Just by opening your wallet, even you don't know to where you sent some funds in the past, unless you (or your wallet) kept track locally. This is achieved by utilizing stealth addresses, where the sender generates a one-time destination from the recipient's address. As opposed to Bitcoin, no monero are actually sent to the address itself, but are sent to something derived from it (the one-time destination). All one-time destinations look the same and this takes care of the recipient's privacy. The owner of an address is the only one able to know which one-time destinations "belong" to him, by means of a private view key.
Since introducion of ring confidential transactions (RCT), amounts involved in transactions are hidden. Nobody inspecting the blockchain, except the sender and the recipient, is able to tell the amounts involved in RCT transactions. Amounts of mined monero are still seen so the total supply can be verified, but they are hidden once a first RCT transaction uses them as input. It is still possible to use old pre-RCT transactions, and starting September 2017 RCT transactions will become the only kind possible.
Dynamic blocksize and tail emission. I'm putting the 2 together because the latter is needed for the former to work. Miners are free to increase the blocksize, but: if they will increase it for too much too fast, they will lose the coinbase reward (but they will get more transaction fees). The tail emission (of a fixed 0.6 Monero per 2-minute block) is there to ensure there is always something you can take away as a penalty. This will result in some residual inflation of <0.87% which will reduce each block towards 0% as time goes on. This has the added benefit of compensating for "lost" coins forever (someone dies, loses the wallet etc.) and providing a minimum incentive to maintain security of the network by mining. Also note that it has a smooth emission curve, avoiding shocks like "The Halving".
It's auditable. By giving your private view key to an auditor, he would be able to see all the your incoming transactions. However, to know the correct balance he would also need to know if you spent any of those (which he can't just with the view key). For this, you'd have to compute a key image for your every incoming transaction, and send those to the auditor. With this, the auditor could establish your current balance. Nice part is, that if you receive something new, the auditor can't know if you spent this new output without kindly asking for the matching key image. This gives the user certain control over how he's being audited and who can know what.
Dynamic fees. The fees are dynamically adjusted to scale with the network. As the network grows and block sizes expand to take in more transactions, the fees are designed to decrease. Combined with dynamic block sizes, the objective is to create a situation where both miners and users are rewarded for increasing capacity of the network: miners get more total fees and users get cheaper fees.
Other things that are worth highlighting are:
Monero transactions are untraceable and un-linkable by default. Meaning that there is ambiguity of where the monero came from and the destination address (or account in Monero lingo) is unknown.
There is the option of providing the viewkey, which allows someone to check for incoming transactions to the related address.
The amounts are somewhat obfuscated because there is no discernible distinction between the destination of the sent amount and the change it created.
Cryptonight algo is designed to reduce the performance gap between CPU and GPU mining. It is not expected a cryptonight ASIC to have a significant performance advantage.
(Aeon uses a smaller cache variant named Cryptonight-Lite. Boolberry and forks use Wild-Keccak, if I am not mistaken)
Monero client has the ability to export the key images for each of the received outputs, which allows, in conjunction with the view key, to determine if those outputs were ever spent.
RingCT (Confidential Transactions with Ring Signatures) transactions are planned to be allowed in January's protocol update (aka hard fork) and made mandatory in a later update.
This will make the transactions amounts completely opaque.
