I know.  Rather like theymos “admitting defeat” when moving behind Cloudflare.  He must keep the site running against the earnest ill-wishes of Internet arsonists; and in case it was not sufficiently clear, I do fully understand the difficulty of his position here.

Yet current lack of a better solution does not change the cold, hard fact that this is locking out legitimate users—and worse, causing some to fire the footgun of mixed Tor/non-Tor use.  That needs to be faced, and somehow handled.  If I were to write a succinct n00b-level warning on the Tor/non-Tor problem, would mods sticky it?  At least, that would be a start.

For suggesting an altogether better solution, it would be helpful to know whether the principal purpose of the login CAPTCHA is 1. preventing bruteforce of luser passwords, or 2. locking out spambots which make automated posts.  I suspect (1), and that’s less difficult to address:  It does not actually require distinguishing bots from squishy wetware.  More secure alternative means of login would suffice—no, I’m not thinking 2FA (which I hate), but rather, public keys.  (2) does require distinguishing bots, which definitionally requires a Turing test.  Ouch.

Thank you.  As a Tor user, I admire this forum’s high-level culture of respect for privacy.

Google is locking Tor users out of Bitcointalk.org!  On my current login, I was forced to try seventeen (17) different circuits before Google deigned to grant me a CAPTCHA; see below.  I didn’t precisely time the whole process, because I didn’t expect this from the beginning; but it took me well over ten minutes.  In practical substance, that’s a lockout.  How many people would (or should!) spend over ten minutes trying to log into a web forum?

I’m obstinate.  I also have sufficient knowledge that I would never give up in desperation and log in without Tor, thus committing a privacy cardinal sin.  How many inexpert users are deanonymizing themselves because of this?

Satoshi was a Tor user.  Satoshi would be effectually locked out right now; do you think he would spend over ten minutes trying to log in, with no guarantee of when or if he would succeed?

I post this to bring the issue to administrative attention.  I know that theymos is caught between the proverbial rock and hard place, with damaging abuse on one side and a principled respect for privacy on the other.  I appreciate this forum’s general friendliness toward Tor users; and I may have a constructive suggestion to make, suitable for a different thread.  Meanwhile, I urge admins to keep a close eye on this situation—and realize that Tor users may be disappearing, or worse, shooting themselves in the foot.

---

An unavoidable question rises:  Is Google doing this specifically to Tor users on Bitcointalk?  That would make a most excellent means of discouraging Bitcoin+Tor use, and also of deaononymizing many people who will give up and log in with their “real” IPs.  That last threat is now worse, since Cloudflare can trivially link IPs to usernames.  An anti-Tor deterrent on Bitcointalk.org is bound to compromise many people.

By comparison, is Google also refusing to serve CAPTCHAs to Tor users on other sites generally?  I wouldn’t know.  I always use Tor, but I usually boycott sites which try to CAPTCHA me.

---

For the record, this is what happened on my current login.

On circuit { 0 /* initial load */, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 15 }, Google made the familiar allegation of “automated queries”:


On circuit 2, Google spat at me a bizarre message I had not theretofore seen:


On circuit 14, I probably hit a BadExit:


On circuit 16—the seventeenth circuit, as C programmers will understand—Google finally granted me the high privilege of driving a self-driving car via multiple long “challenges”, one after another.  Is Google psyching Tor users to be grateful to get CAPTCHAed?


N.b. that this could in no way be targeted at me, even if Google could somehow XSS out the login form info.  I habitually complete the CAPTCHA first, before filling in my username and password.

A fee to log in!?  Are you serious?

N.b. that (a) the move behind Cloudflare at the end of November is absolutely irrelevant to login issues, discussed separately since October; (b) everybody’s connections go through Cloudflare, for every connection to the site; and (c) Tor users (among others) are already charged a fee to create an account.

Why is this posted in Bitcoin Development & Technical Discussion?  [Edit:  This was originally there; it got moved to a more appropriate venue.]  The only way it could possibly belong here is if we want to discuss yet another object lesson on why Bitcoin should never, ever have a Turing-complete script.  For that reason, Bitcoin has something better in the pipeline.  It will have properties which can be proved against DAO-style “oopsies” and mass-loss “hacker deleted the library” bugs; and it will never let the network be DOSed by prolifically fecund, evilly cute kittens.  It will be pure, powerful Simplicity (PDF).

Well, either that—or if we want to make fun of Ethereum and its latest woes.  Hahaha!  That is on-topic anywhere, in my engineering opinion.

(Noting penultimate thought up top before posting:  Do you remember any part of the seed, or any hints about it?  If yes, see below.  Not to get your hopes up:  An Electrum seed is quite secure, and you would need to narrow it down very substantially to make it feasible to bruteforce the rest.)

I will defer to bob123 on the forensics.  I do know enough about this subject to reliably sniff out when somebody else’s knowledge exceeds mine.  The advice thus far given by him is sound.

But I had another disturbing thought:  Have you any way to verify that your coins have not moved?  Do you have any other record of your Bitcoin addresses with balances?  If at all possible, I would suggest you check them on the blockchain before you spend more effort and potentially much more money on data recovery.

If you did not have full disk encryption, and the seed was in a “sticky note” on your desktop, then you are gambling that either the thieves didn’t look at your files—or they were too abjectly stupid to realize what they had found.  I sincerely hope that they were idiots who just want to grab a computer, install a fresh OS, and flip it for a few fast rupees.  That seems likely, but uncertain.  Nowadays, would even the dumbest thief grab a computer and not even pause to snoop for info on Paypal, credit cards, banks, etc.?

(Ask yourself, What other interesting data was unencrypted there?  As a presumptive worst-case scenario, you should treat your own privacy compromise as if the thieves made and retained images of your drives using such methods as here discussed.  It’s fast, it’s easy, and it would let the thieves examine your files at leisure.  Going forward, I suggest full disk encryption.)

How many thieves know how to install an OS, but have never even heard of Bitcoin?  I don’t know.  I do know that thieves who know about Bitcoin, are hot to steal it.  If Electrum was listed in your Start Menu (or whatever Microsoft now calls it), then that is a big hint—both to look for Bitcoin, and to interpret the random words in the sticky note.  If you have no other record of your public addresses, then wiping the disks would conveniently cover their tracks.

Thinking one step further—and not to ask you questions, but to suggest what you ought think about:  Who knew that you had Bitcoin, or how much you had?  For a targeted theft of a computer to get Bitcoin, it would make sense to fake it as simple theft of a computer—perhaps even to hire ordinary street thieves to grab it from you.  Then after the Bitcoin is taken, the hard drives are wiped and the useless computer can be dumped/fenced/sold anywhere.  Or perhaps then the computer could even be given to an associate, for their kid to watch movies—so they can get a report on whether you track down the computer, and what your reactions are.  (I am not trying to indict that family as such; they probably did buy it off the street.  But as you understand, a detective should be reasonably suspicious of everybody involved, and objectively scrutinize each party.)

I don’t know (and I don’t ask) what evidence you have, or anything whatsoever about your circumstance.  It is for you to think about the likelihood.

Another thought, and I’m surprised it didn’t occur to me before:  Criminals who know how to install an OS, probably also knew enough to helpfully infect it with malware.  Neither is an elite hacker job; there exist point-and-click malware kits, you know.  If that family’s “light browsing” included any bank logins, etc., then I think they should change their passwords (and be more careful about where they buy computers).  As for you—have the drives made any contact with a clean computer, via USB-SATA adapters or otherwise?  If so, it may no longer be so clean.  Better be safe than sorry.

If I absolutely must access a questionable drive, the following is a deliberately rough sketch of my procedure:

0. Temporarily disable my kernel’s drive-“tasting” functions, so that the kernel will not try to read partition information and filesystems.  (The forensics wonk will probably tell me to use a “live CD” system, too.)  Of course, my system does not have Autoplay; but even if it did, Autoplay would never start because the system would not reach the userland part of peeking at the drive.

1. Take an image of the drive with dd, a dead simple block copier with no imaginable attack surface via data passed blindly from the input file (drive) to the output file.

2. Try to interpret the image with carefully contained userland tools:  ntfsprogs for NTFS, mtools for msdosfs/FAT filesystem... or in your case, just something which searches a huge file for binary patterns which look like an Electrum wallet file, regular expressions for a seed phrase, etc.  The Forensics Wiki probably lists a good tool for that.  Any which way, the point here is that tools which try to interpret data stay trapped in ring3.  I would not mount the drive image.  No, not even through FUSE.

Then my only concern would be trojaned firmware, a sophisticated attack which will not be planted by street thieves.  Well, give it a few years; easy exploit kits will eventually get that, too.

That’s roughly what I would do (have done before).  I am not a forensics expert, far from it—just a bit of a Unix curmudgeon with a taste for security.

As for the seed phrase:  Could you narrow it down, even by remembering the first letter of certain words, remembering words out of order, etc.?  It may be useful if you could remember about 7–8 words, or remember enough hints to give equivalent information for someone who understands these things.

Yes, I think you would need to narrow it by significantly more than half unless you could pay for cloud compute tantamount to a supercomputer.  Beyond that, how much you’d need to narrow it depends on how much Bitcoin is at stake.  The amount of raw cracking power worthwhile to throw at it depends whether you had 1000 BTC, 100 BTC, 10 BTC, 1 BTC, etc.  I’m only explaining; please wisely continue to give no indication of the amount publicly.

If you could give enough hints about the seed, I may be able to help you with this for a fee on terms discussed privately; though to be honest, I would be competing with people who do that as a business and have dedicated cracking rigs.  Some post on this forum.  I can’t recommend anybody in particular.  I do think that cracking an Electrum seed phrase based on a grab-bag of hints might be an interesting and rewarding little project.

---

The foregoing represents the simplified view of a thought process.  If you have crypto-money on a disk, and the disk disappears, and you get the disk back—well, then it’s easy to become too focused on one only objective, and only one means of achieving that objective.  I suggest instead a top-down approach for identifying objectives and risks, followed by seeking all feasible avenues for achieving each objective.  Should you wish to discuss that further, feel free to contact me privately.

Any which way, good luck recovering your private keys.

Yet another destructive aspect of the BCH fork.  Yet more damage to users.  Yet another reason to avoid it.  Honest altcoins have their own names, and their own address prefixes (or even entirely different address formats).

Is anybody collecting these?  There are an awful lot of them.  Impossible though it may be to really know, it seems important to attempt quantifying in some fashion just how much money has been lost to how many people by BCH’s decision to use an identical address format.

dmadd, others have given you the only possible advice.  There is nothing else you can do.  The private key controls all.

A partial preimage attack on (double) SHA-256, done by brute force.


It is not a matter of solving the nonce value.  The nonce is meaningless, in and of itself; that is why it’s called a nonce.  Or perhaps it may be said, the nonce is meaningfully meaningless.  The only means of bruteforcing a hash (partial) preimage is to repeatedly change the input until you get the desired output.  The nonce is the part which gets changed; it is really a sort of a throwaway value, only there to provide arbitrarily changeable input bits.

SHA-256 is assumed (or pretended, depending on whom you ask) to have the properties of a random oracle.  Simply for the sake of understanding, pretend that for each increment of the nonce, you are generating a random number.  If target difficulty requires an unbroken string of x zeroes in the highest digit positions, then imagine how many times you’d need to generate a 256-bit random number before you have the luck to draw one which starts with x zeroes.  Alternatively, think of it as a 256-bit string of coin flips with H=0 T=1.  How long will it take you by random chance to get a string starting with x heads in a row?

(Question for anybody:  Would the probability equal that of simply flipping x heads in a row, or would you need to repeatedly flip whole 256-bit strings of flips until you get one which starts with x heads in a row?  I seem to have temporarily confused myself here.  Checked in in alpha state.  May be patched.)

Another interesting way to look at it:  If SHA-256 has good avalanche (as we suppose), then for a single-bit flip in its input, each bit of output has a 50% probability of flipping.  Implications for bruteforcing a partial preimage are left as an exercise to the reader.

(I used several basic/intermediate level cryptography terms of art here.  I tried to pinpoint those in boldface so you can look them up if you’re unfamiliar with them.)

I want to frame this and hang it on my wall.  Tell me, have you ever considered designing a motor which drives an electrical generator to power the motor?  Or a train locomotive which holds a giant magnet in front, to pull the whole train forward?  Or a water wheel which powers a pump which moves the water back to the top of the water wheel?  Fascinating ideas.

I will grant that your Bitcoin scaling idea is superior to the scaling ideas behind BCH, BU, 2X, and their ilk.

Now, you go read Section 9 of the comp.compression FAQ.  Please don’t come back unless you’ve read that, else the forum may never forgive me.


The overcrowded pigeons were a hint.  I did not waste my time reading your equations.  What you are trying to do is proved mathematically impossible.

By the way, JPEG is a lossy compression format.  It throws away information.  Your example of a compressed file was a JPEG.  Learn the difference before you try designing a compression algorithm.

What an excellent idea!!  May I ask a humble question, maybe to improve your genius.  Why not feed the output of the compression program back into the compression program recursively?  You could compress the whole blockchain to be printed in a QR code for backup!  Or even the whole Internet!

Possible prior art:  WEB compressor, U.S. Patent 5,533,051, U.S. Patent 5,488,364, etc.  Tell me, is your method patented??

(Forum, please forgive me.  I never had the pleasure of suffering these in comp.compression.)

Apropos:  Bitcoin mining is NP-hard (or rather, transaction selection is).  The upshot is that it doesn’t get solved optimally, at least from a theoretical perspective.  In practice, “good enough” is good enough:  Fill your knapsack mostly full of mostly the best stuff, and start hashing.  The race is on, and time is critical!

There are all sorts of prickly points around the subtle art of selecting transactions for inclusion in a block.  When making changes to Bitcoin, careful engineering work can be required to at least not make it harder.


Unless they want to attack Bitcoin by deliberately mining empty blocks.  (Here, “empty” means with only the coinbase transaction.)  There is suspicion that this has happened.  Empty blocks are also sometimes produced for other reasons as DannyHamilton explained.

Good call on the write-blocker.  However, even that would not stop some flash drive firmwares which do wear-levelling re-arrangements over cells the firmware has marked free (such as with TRIM).  Even when not writing—even when idle—any time when powered.  I’ve heard that certain police forensics labs have had trouble with that; I don’t know what they do about it.  The problem with flash is that it’s very difficult to intentionally destroy when you want it gone, but also difficult to prevent from destroying data you actually want.


Yes.  That.  Or more likely than a forensic specialist, a commercial data recovery service which has competency in dealing with SSDs.  That may perhaps be easier, as a practical matter.

They will charge a pretty penny satoshi.  But above a certain value threshold, it does make sense to not fool around.

Happy to help.  I wish I had a better and easier answer at the ready.

What you say reminds me of thoughts I’ve had over who has recordings of my telephone calls, or copies of long-past (unencrypted) e-mails.  My own communications, as of which I myself have no record outside scattered memories—with those, it’s impossible to be certain of who has or doesn’t have what.  My calls to my fondly remembered old ex-girlfriend in $YEAR; who may have archival recordings of those?  I think it’s probable that some database has it all.  The situation with the blockchain is worse, since it is public and permanent; although other data which could be cross-correlated with it may be another “who recorded what when?” situation, depending on what you did and how in terms of buying, spending, etc.  At least, you also have a copy of the blockchain.

Looking a few steps further:

Do you surf the Web without Tor or similar measures?  Do you remember every website you’ve ever visited?  Do you remember every search term you have ever typed into Google?  (People tell Google secrets which they would never tell their spouses, best friends, clergy, or psychiatrists.  When they have trouble sleeping, people openly tell Google their midnight fears and fantasies.  The Google search is the closest thing to mind-reading technology yet invented.  “I’m feeling lucky.”)

Somewhere, there is definitely a record of these things; or somewheres plural, not only in government agencies.  Inasmuch as this data may oft be in the hands of private companies such as Google or your ISP, it is used for “marketing” purposes.  You are eyeballs and a piece of meat.

In a similar vein, do you carry a mobile phone?  (I ask this rhetorically; I would not suggest that you answer such questions on a public forum!)  If you do, then somewhere, there is a database which knows precisely where you were physically located on, say, the date of 2010-03-09 at 10:04 in the morning.  Do you know exactly where you were on 2010-03-09 at 10:04 in the morning?  Somebody does—well, a computer somewhere does.  If you were to ever become interesting (in the sense of a “person of interest”), then a wetware analyst could look back at that years or decades later, and correlate it with other available information.  That includes, but is not limited to, the calls and texts you made with that phone (metadata and/or content).  It also includes the locations and communications of persons carrying phones around you.  Do you remember who was near you and whom you associated with on 2010-03-09 at 10:04 in the morning?  Somewhere, there is a database which remembers that.

Such is the meaning of dragnet mass surveillance.  It is the total destruction of even the most basic dignity.  It respects nothing sacred, leaves no part of you untouched and inviolate, admits no freedom.  It fears no gods, but deifies itself with omniscience and omnipotence.  It is an invisible collar around your neck, from your cradle to your grave.  “If you’re not doing anything wrong, you have nothing to hide.”  No!  Because I do nothing wrong, I have nothing to show.  I am a man, not a worm; therefore, my life is none of your business.

My location on 2010-03-09 at 10:04 in the morning, and my activities, communications, relationships, “social graph”, finances, reading habits, and innermost thoughts, are all none of your business.

Let these thoughts sink into your gut, and you will begin to understand why I care about privacy.  Most people don’t get it.  Encrypted e-mail, anonymized Internet, cash at the store, and antipathy for GoogFaceTwit?  People will look at you funny, at best (and thus the first rule of privacy: be discreet about privacy).  But once you start to think the full history of your blockchain transactions, your credit cards, your bank accounts, your phone calls, your locational information, your e-mails, your web surfing, your web searches, etc., etc.—well, then privacy begins to make sense.  It even makes sense to expend effort and endure inconvenience, to obtain privacy.  Actually, when you begin to understand these matters, you realize that the lack of privacy is outright insane.

Thanks for thinking about these issues.  Everybody who cares about privacy can make the world a tiny bit of a better place.  And good luck with securing your Bitcoin privacy.  Bitcoin has great promise as a force for freedom, which necessarily encompasses privacy; but thus far, its tools are as yet imperfect, and the privacy part is very difficult to get right.  At least, you certainly have more control of your own destiny with Bitcoin than you do with banks and credit cards.  Consider how your ownership of your private keys means nobody can help you if you lose them.  Here likewise, Bitcoin gives you the power over yourself, and thus the responsibility for yourself—two sides of the same coin!

Oh, stick a fork in it.  Five minutes of searching found that you’ve embraced “Bitcoin Unlimited”, “Bitcoin ABC”, “Bitcoin Cash”, “Segwit2X”—seemingly every attempt to divide-and-conquer Bitcoin in the past few years!—and you hate Core.

“Btcpop’s Preparation for Potential Hard Forks” involves your declaration “Btcpop holds an opinion on the debate (pro-emergent consensus)” (note BU link!).  “...Therefore, Btcpop will support all competing forms of Bitcoin and grant each option to our users.”  (Bold and underline in the original.)  “Btcpop’s Perspective on Segwit2x” is that “Bitcoin Core has become a anti-free market cult like bully in the Bitcoin space.”  Thanks so much for elucidating your opinion; but Core is sweet and kind, whereas I am a cult-like bully.  At least toward people who try to wreck Bitcoin.  Why, I might become downright nasty if I were to ever find out that Btcpop is “Leading the way with Bitcoin Cash” because “Btcpop’s owner Casimir1904, a Bitcoin user since 2011 and technical wizard, clearly understood the [‘Bitcoin Cash’ fork] event and knew exactly how to prepare.”  (Blah, blah, blah.  Genius, you are.)

What else did I find in five minutes?  People on Reddit discussing something which looks an awful lot like you tried to Sibyl attack with “Bitcoin Unlimited” nodes; I suppose that must be your means of achieving “emergent consensus”.  But if you did, the attempt must have gone over like a wet firecracker:  Bitcointalk user cellard found that “All BU nodes are… fake VMs from Roger Ver except a couple idiots that run it too” with a link showing nodes running, hmmm, “/https://btcpop.co - Free People - Free Market - Free Money - BitcoinUnlimited:1.0.1.1/”.

Interesting allegations there.  In five minutes; I wonder what an hour’s search would find.  Well, if you so enjoy (futilely) playing such network monkey games, it is no wonder you now say this:


Thank you, Core, for those aforementioned “Network safety enhancements”.

Such a prolific little forker you are.  Tell me, Casimir1904, are you trying to convert me for “Bitcoin Jesus”?  Or are you ready to sell me some Bitcoin Cash Doubleplus Diamond Unlimited Super2X Plutonium ABCXYZQQQ?  That, I will buy—in exchange for my instant gale of contemptuous laughter.  I’m cracking up right now.  Literally-not-figuratively LOLling.  I needed that; it’s been a long day.

---

Edit:  I was writing this when Casimir1904 posted again; saw that afterwards.  I think I inadvertently answered it already.

You may want to find a more appropriate forum for this.  That being said:


The first question which comes to mind is, did the drives have TRIM run over them?  (Sometimes when this is done to the whole drive at once, it is called “Secure Erase”.)  Or were they only formatted?  Some OS may do this on install.  I know nothing about Microsoft’s recent offerings.

Of course, you don’t yet know the answer to these questions.  I suggest they are questions for which you need an answer.

Before anything else, if I were you, I would image the drives; then, work off the image.  I don’t have many immediate recommendations, other than that.  But if there was a sufficient amount of money involved that you may potentially send this to a data recovery lab, see the caveat below about wear-levelling.

If the drives were TRIMmed, I do not think there is any way you can recover anything with any tools you likely have available to you.  (Perhaps a real hardware hacker would know better.)  If it comes to the point of bypassing the drives’ firmware, or bypassing their electronics altogether, then it may be important to consider the effect of wear-levelling.  SSDs can move blocks around anytime when powered on, even when idle; that means potentially overwriting a block with your wallet data which got TRIMmed, but which may perhaps otherwise still be pulled off the flash chip.  I do not know if or how much that could be important to you; but right now, you really want to keep the drives as close as possible to the state they were in when you got them back.  That is another reason to not work directly off the drives.


Do you mean some kind of software “sticky note”?  Oh, I see.  At first I thought, “No problem, he has the seed mnemonic written on a (physical) sticky note on his (physical) desk!”

Good to see an early adopter for the technology we awaited so long.  I concur that the lack of Segwit change address support is quite irritating.  That should have been done at least a few months ago.  But I will not so badly blame Core, given the sorts of time sinks which have sucked away developer effort since long before Segwit activated—and reached a time-sucking nadir in the past few months.  For but one of the more recent examples:



Reading in the recent release notes a list of “Network fork safety enhancements”, I can well imagine the internal monologue which must have gone through some dev’s head.  “I need to finally finish this patch for Segwit change address support (plus tests, tests, tests).  No wait, first I need to find some ingenious hack to ban fork nodes who lie about their identities so that they can waste node resources and try to subvert the whole network.  Network safety first.  Sigh.”

It requires prodigious engineering effort to produce mission-critical financial software which handles hundreds of billions of dollars’ worth of value, operates in a hostile network environment, and is never, ever allowed to make the sort of mistake which could drop huge amounts of money on the floor because somebody rushed the change address patch.  I’m so glad that Core gives this to you, me, and everybody else for free so we can run our businesses, whether or not we pitch in what we can for what is an open-source project.

WRONG.  For but one of a hundred other ways your identities could be linked, even if you mix with CoinJoin, check out this pretty picture from a research paper I referenced in my earlier post on this thread:


Stop giving dangerously bad advice!


You ask some reasonable questions.  More reasonable still would be the question of how to actually protect your privacy.  That last is a difficult question.  Strong anonymity (or more properly, the transaction unlinkability required for strong privacy) requires considerable expertise; there does not currently exist any point-and-click solution which will make that happen for you.

I’ve been trying to write up a little post on the basics; but it takes time, since unlike some people here, I don’t simply toss out substance-free gab to hear myself talk.  It is a complicated topic; and I know that if I give the wrong advice, people could get hurt.  I may or may not finish what I was writing.  Meanwhile, here are some notes:

I observe in brief that I have never used a Bitcoin mixer site.  I am a privacy activist.  I have exclusively connected to the Internet through Tor for some years now—just on principle.  I’ve been intrigued by the potential of private digital currency since Chaumian Digicash was still a thing; that was a few decades ago.  And I have never used a Bitcoin mixer site.  That might suggest to you something about those Bitcoin mixers.

Some people here need to read this paragraph thrice, from the newbie-level introduction at https://bitcoin.org/en/you-need-to-know#anonymous (italics added):


The same people should also read that “read more” link very carefully.

Observe some discussion by smart people who know what they are talking about.  (N.b. that I can’t recommend CoinJoin or Joinmarket at this time unless you know its limitations, and you really know what you are doing.  Look back to the above graphic.  The little crossover icons in the left half represent CoinJoins.)

Finally, I must quote this for the right spirit.  Privacy is not for criminals; it is to protect you from criminals:


There exist corrupt and oppressive governments.  There also exist robbers, stalkers, identity thieves, and kidnappers who are increasingly sophisticated in their exploitation of digital information sources.  I think it is only a matter of time before organized crime catches on in a big way to the goldmine of useful information which can be linked through blockchain tracing; perhaps they have already, and I just don’t yet know it.  All these threats can work retroactively, too.  Every transaction you commit to the blockchain is there forever.

Don’t be paranoid, but take precautions.  I use Bitcoin for whatever I want to, nobody knows how much I have, and I sleep quietly at night.  Of course, I don’t engage in criminal activity—that’s outside my threat model.  I just want—no, I demand privacy; and I have it, at the expense of some large effort.  It’s worthwhile!

I look forward to that!  Cheers.

Agreed.  Coinbase has been shooting themselves (and their customers) in the foot financially; that economic pressure had to kick in sometime!

As for the long tail of ordinary users, do you have any good ideas for getting the word out that people can save big on fees right now with Segwit addresses?  I mean, people who keep their own private keys but probably don’t run a full node.

Software support is key, and I don’t know too much about different implementations.  It would be helpful if Electrum 3.0 did P2WKH-in-P2SH out of the box; it doesn’t (Bech32 only), but it will successfully restore a BIP39 seed on derivation path m/49'/0'/0' (tested).  I am blissfully ignorant of mobile wallets.  Educating users of Electrum plus popular mobile wallets would probably have a quite considerable “long tail” effect.

Of course I would not yet recommend that people start handing out Bech32 addresses.  Not just yet.  Now, it would be asking for support headaches of the “why can’t people send me money!?” kind.

Thoughts?  I think Segwit will be the most popular technology in the universe, once users see how they can cut their own fees.

(Also, it would be helpful if Core didn’t need to waste dev time on creative defense to protect the network against maliciously coded fork nodes.  Those who need the GUI, will sadly need to wait; and those who don’t need the GUI, also don’t need any hand-holding.)