Recovering a secret that has been blinded several times I'm analyzing a protocol that, during one of the steps, sends a blinded secret. Let's denote the secret $x \in \mathbb Z_p^*$ (for $p$ prime) and the blinded secret $y$, so that $y = r\cdot x \bmod p$, where $r$ is a blinding factor randomly sampled from $\mathbb Z_p^*$. We can assume that the blinding factors won't repeat.

Several runs of the protocol would produce several $y_i$ values, with the same fixed secret $x$:

$$y_1 = r_1 \cdot x  \bmod p$$
$$y_2 = r_2 \cdot x  \bmod p$$
$$...$$
$$y_n = r_n \cdot x  \bmod p$$

Knowing only the $y_i$ values, what would be the best algorithm to retrieve $x$?
If all we know are the blinded values $y_i$ (and the modulus $p$), and if the blinding factors $r_i$ are indeed sampled randomly from the multiplicative group modulo $p$, I don't see any way to recover the secret $x$.

This is because, for any list of blinded values $y_i$ and any candidate $x$ value, we can compute a unique list of blinding values $r_i \equiv y_i \cdot x^{-1} \pmod p$ that, when multiplied by $x$ modulo $p$, will yield exactly those blinded values.  Given that the $r_i$ values are chosen randomly, this particular list of blinding values is exactly as likely as any other.  Thus, this blinding scheme appears to be unconditionally secure.

(Also, the knowledge that the $r_i$ values cannot repeat won't help, since all it implies is that the $y_i$ values won't repeat either.  If we did observe repeated $y_i$ values for the same secret $x$, we would know that the corresponding $r_i$ values must be the same, but would still gain no further knowledge about $x$.)