Bitcoin Forum

Got any good suggestions for trustless and low-fee mixers?  I think all the P2P mixer projects are not yet fully ready, as far as I know.

While it is not the best solution in terms of obfuscation, coinjoin is a pretty good system that IMO everybody should use. It's not perfect, but IMO it gives enough protection against the casual "let's see how much money this guy has" situation. A prepared and determined opponent will probably end up finding up your total balance, but it will take him more resources and time, which normally is something the casual criminal wants to avoid when looking for targets.

Summing up: By using coinjoin you avoid being the low hanging fruit, which is usually enough protection against a potential dangerous situation similar to what happened with the leak of the Gox database. The criminals won't be able to easily check your current BTC balance, so you will probably be discarded as a target.

Tumblers like bitcoinfog provide better obfuscation, but the (huge) trade-off is that you should trust an unknown third party. I'd never risk more than 1% of my holdings to such services, but I think the service they provide is necessary and should be used, albeit with care and with just a very minor portion of ones funds at a time.

Yes, I think CoinJoin should be a very good start.  But do any really decentralised and fully working implementations of CoinJoin exist already?  I don't think so and would be interested to know if they are.

mix coins because why?

Morale of the story: Everybody should ALWAYS mix their coins and use Tor for BTC related activities. Information is power. Never give it away.

After the Gox dabatase leak the names and home addresses of pretty much everybody involved in BTC are now public, at least among the criminal community.

Those singing the song that goes "I don't mix my coins because I have nothing to hide" are either:

a) totally brainwashed/incredibly naive
b) just stupid.

Even if you mined the vast majority of your coins and used an exchange just to cash out a minor part of your holdings, your total BTC balance can be discovered by trivial blockchain analysis, following the links with just one deposit/withdrawal address.

Morale of the story: Everybody should ALWAYS mix their coins and use Tor for BTC related activities. Information is power. Never give it away.

Now, if the zerocoin concept would be implemented in bitcoin, it would be cool.

Never recommend noobs to use Tor, it's a honeypot where they are worse off than not using Tor at all.
Noobs should use a trustworthy VPN instead.
The optimal solution is VPN + Tor.

Never recommend noobs to use Tor, it's a honeypot where they are worse off than not using Tor at all.

...

Tumblers like bitcoinfog provide better obfuscation, but the (huge) trade-off is that you should trust an unknown third party. I'd never risk more than 1% of my holdings to such services, but I think the service they provide is necessary and should be used, albeit with care and with just a very minor portion of ones funds at a time.

I'm not aware of any either but don't let that deter you from using one of the already existing solutions even if they aren't perfect.

A sharedcoin transaction will look something like this: https://blockchain.info/tx/e4abb15310348edc606e597effc81697bfce4b6de7598347f17c2befd4febf3b (picked at random). As you can see multiple inputs and outputs make the determining the actual sender and receiver more difficult.

The server does not need to keep any logs and transactions are only kept in memory for a short time. However If the server was compromised or under subpoena it could be force...

Now, if the zerocoin concept would be implemented in bitcoin, it would be cool.

Not if you stay in-network. Unfortunately, my services (bitcoin node) are not tor-enabled yet. Namecoin has the potential to facilitate this with human-readable addresses as well.

Anonymint: we are not discussing being safe against a global adversary such as the NSA, we all know that mixers + Tor is probably not enough to defeat them because of honeypots, timing attacks, deep packet inspection, etc...

We are discussing using basic security procedures in order not to be "the low hanging fruit" and thus being reasonably safe against the casual hacker/criminal doing trivial blockchain and network analysis to easily link identities to BTC balances. For that purpose running your wallet through Tor and using a decentralized and trustless mixer such as coinjoin should be enough.

Keep your ad hominem attacks out of it please. I asked kindly for technical comments.


And my post to which you are replying is in fact explaining the DOS (denial-of-service) is insoluble if you can't identify the participants in order to rate-limit them.


And again in that post you admit there is a DOS problem. You didn't solve it. And you can't solve it in a decentralized setting unless you have non-ephemeral identification of the participants. Which is precisely the point of my prior post to which you are replying


Incorrect. What I wrote is functionally equivalent to what you described. The point is the transaction can be jammed in the final round.

Since you didn't see the equivalence let me explain it. I thought you were smart enough to deduce such things. I chose to let the signatures of inputs go in the second and final round and point to a transaction because I envisioned using ring signatures. And the transaction won't be valid (blockchain will reject it) if the inputs are less than the outputs, so my version is just as safe as yours. And the DOS problem is equivalent. Come on you are a math guy, you can surely see that without me needing to explain it you.

And if you think about it a while you will realize, by inverting the operations and using a ring signature, mine has advantages suchas that not all have to sign in the first round before proceeding to the second round (they get excluded from second round too). Yet the DOS issue remains in the final.


Well now you see your error. You can reread my post again, and admit I was correct.

From your upthread post:


And exactly how do you propose to identify that adversary in a decentralized setting?  ;) My point is you can't, at least not without breaking anonymity, and anonymity was the entire point of mixing.

After the Gox dabatase leak the names and home addresses of pretty much everybody involved in BTC are now public, at least among the criminal community.

Those singing the song that goes "I don't mix my coins because I have nothing to hide" are either:

a) totally brainwashed/incredibly naive
b) just stupid.

Even if you mined the vast majority of your coins and used an exchange just to cash out a minor part of your holdings, your total BTC balance can be discovered by trivial blockchain analysis, following the links with just one deposit/withdrawal address.

Morale of the story: Everybody should ALWAYS mix their coins and use Tor for BTC related activities. Information is power. Never give it away.

LOL, yeah but, didn't those same users just lose their ass and are now broke?

LOL, yeah but, didn't those same users just lose their ass and are now broke?

...
Also using the centralized (VPN, mixer, tumbler, laundry) identifies you as someone that deserves extra monitoring by the authorities.
...

NSA views encryption as evidence of suspicion and will target those who use it:

https://bitcointalk.org/index.php?topic=511198.0

NSA views encryption as evidence of suspicion and will target those who use it:

https://bitcointalk.org/index.php?topic=511198.0

I don't see how mixing coins is supposed to protect my identity.

What is the argument?

Information is power. Never give it away.

The internet & cryptocurrency are the beginnings of a world where this paradigm no longer holds sway. That is the world I want to live in.

"As the Americans learned so painfully in Earth's final century, free flow of information is the only safeguard against tyranny. The once-chained people whose leaders at last lose their grip on information flow will soon burst with freedom and vitality, but the free nation gradually constricting its grip on public discourse has begun its rapid slide into despotism. Beware of he who would deny you access to information, for in his heart he dreams himself your master."

Free flow of information. Wikipedia. Torrents. Cryptocurrency. Our technology is taking us in a direction away from centralization of power. Away from dictators and sociopaths running our world.

Mankind's age of empires is over. The future is about decentralization, cooperation, openness, transparency, and truth.

Well said sir.  I too want to live in that world.

And here is our friendly Bitcoin csore developer...

...

I see those (other than gmaxwell who is not very ad hominem in his response, other than the slight "over and over" which is irrelevant to the technical response) who posted while I was sleeping have relished in their boastful snobbery.

Now let's deal with the humbling facts.


And precisely how do you identify which input is the adversary when the correlation of the inputs and the outputs is necessarily cryptographically blinded?

As far as I can see, you can't.

I am confident that now you see the functionally w.r.t. to anti-DOS of what I described and what you described are equivalent, i.e. any one who is the least bit mathematical can see that the salient mathematical foundation of CoinJoin is that the correlation between the inputs and outputs must be cryptographically blinded, thus it makes no difference mathematically for anti-DOS whether the inputs or outputs are specified in the first round of the protocol.

As for whether my proposed protocol of putting the outputs in the first round is implementable on the Bitcoin blockchain, it is irrelevant since we are talking about a general protocol here and an altcoin could be designed to allow a transaction where outputs and inputs can be signed to point to the transaction nonce (a hash of any number) plus the addresses of the inputs OR outputs. I didn't bother to check how Bitcoin signs the transactions, because it is conceptually irrelevant to our discussion. Perhaps in Bitcoin the signature of the transaction must include all the inputs AND outputs. The reason I presented my formulation (in fact I mentioned the ring signatures idea from Adam Back in the Zerocoin thread months ago in this thread) is because it is more powerful conceptually than one gmaxell described. I thought gmaxell would appreciate that since I think he is a math guy.


I will quote from your more detailed description upthread.


Zerocoin (ZC) requires a trusted party to generate the parameters, thus it is the antithesis of decentralized, so you have a logical error above.

https://github.com/Zerocoin/libzerocoin/wiki/Generating-Zerocoin-parameters


And so how can you correlate which input is the one who didn't blind sign all?

As far as I can see, you can't.

I've dug very deep (into cryptography research papers) lately into trying to find a way to delink inputs from outputs without a trusted party, and I have realized that mathematically it can't be done. It is a fundamental conceptualization.

The only way to delink without anti-DOS is to use an accumulator commitment scheme with common NP-hard parameters that can be presented in an NIZKP (non-interactive zero knowledge proof) which will always require a trusted party to generate the common parameters for the trapdoor math.


That isn't anti-DOS.

Each spender commits a hash of his intended output. Then everyone does the blinded protocol. If the blinded protocol fails, everyone including the adversary reveals the link between inputs and outputs, because by definition the output key must be an abundant resource so that it is not costly to reveal it and generate a new one to try again.


A ZKP + accumulator isn't decentralized as I explained above.

Tada!  :P

Eat humble pie. See my reply in the CoinJoin thread.

You are an ego maniac.