[ANN] ChipMixer.com - Bitcoin mixer / Bitcoin tumbler - mixing reinvented

[Lucius]

Or we can use it to announce we have moved into Tor permanent. Either way there will be changes and we do not like them.

I agree with the suggestion that the service should start using only TOR, because if privacy is important to us, then we should not make any compromises in that regard. I believe that most users who use CM are very familiar with what TOR provides, and that they will have no problem using it as the only way to access the service.

Can someone give me an article, or explain, why the Tor's website can't be DDoS-ed same like clearnet's is?

Distributed denial of service (DDoS) attacks typically rely on having a group of thousands of computers all sending floods of traffic to a victim. Since the goal is to overpower the bandwidth of the victim, they typically send UDP packets since those don't require handshakes or coordination.

But because Tor only transports correctly formed TCP streams, not all IP packets, you cannot send UDP packets over Tor. (You can't do specialized forms of this attack like SYN flooding either.) So ordinary DDoS attacks are not possible over Tor. Tor also doesn't allow bandwidth amplification attacks against external sites: you need to send in a byte for every byte that the Tor network will send to your destination. So in general, attackers who control enough bandwidth to launch an effective DDoS attack can do it just fine without Tor.

[1714250897]

1714250897

[1714250897]

1714250897

[1714250897]

1714250897

[LoyceV]

I personally think that putting chipmixer behind cloudflare wouldn't be good for chipmixer's reputation... However, putting a landing page behind cloudflare might actually work...

How about this:

• Put chipmixer.com behind Cloudflare, with only a landing page.
• The landing page shows a link to Tor browser, .onion URL and a link to a (newly created) clearnet URL without Cloudflare.
• The URL without Cloudflare can be for instance nocloudflare.chipmixer.com. If there's no DDOS, it's available. During DDOS, the landing page is still available to point towards the .onion site.
• This way, Cloudflare only knows you visited the clearnet landing page.

[jackg]

I personally think that putting chipmixer behind cloudflare wouldn't be good for chipmixer's reputation... However, putting a landing page behind cloudflare might actually work...

How about this:

• Put chipmixer.com behind Cloudflare, with only a landing page.
• The landing page shows a link to Tor browser, .onion URL and a link to a (newly created) clearnet URL without Cloudflare.
• The URL without Cloudflare can be for instance nocloudflare.chipmixer.com. If there's no DDOS, it's available. During DDOS, the landing page is still available to point towards the .onion site.
• This way, Cloudflare only knows you visited the clearnet landing page.

How fast do you think we'd spot them changing the onion link on the cf landing page (they could also generate user profiles and do it on a by-user thing) or just taking it down due to it being reported or something though?

Especially if the main page is behind cloudflare...

We could always have chipmixer.com as the main page and iwantnoprivacy.chipmixer.com as the other. Not everyone has a vpn and a I dont think anyone has a browser that isn't paid to add fingerprintable trackers - even on incognito.

[LoyceV]

How fast do you think we'd spot them changing the onion link on the cf landing page

I don't expect Cloudflare to change the site. If they do, they can close their business.

We could always have chipmixer.com as the main page and iwantnoprivacy.chipmixer.com as the other.

I like the subdomain name

[DireWolfM14]

We are testing new v3 address. Some of you have received beta test link. Onion v3 will be public soon.

I love it!  I played with the new Tor site last night and it worked great.  I sent some coins to mix, split chips, combined chips, created a voucher, and withdrew some coins.  All features worked fine.  
And, now we have Segwit addresses!  Woot woot!

How about this:

• Put chipmixer.com behind Cloudflare, with only a landing page.
• The landing page shows a link to Tor browser, .onion URL and a link to a (newly created) clearnet URL without Cloudflare.
• The URL without Cloudflare can be for instance nocloudflare.chipmixer.com. If there's no DDOS, it's available. During DDOS, the landing page is still available to point towards the .onion site.
• This way, Cloudflare only knows you visited the clearnet landing page.

Those are great suggestions.  A simple landing page behind Cloudflare would help protect the clear net site from DDOS attacks would likely resolve a lot of the issues.  Even if all it did was prevent the main landing page from going down, that might be enough to prevent most people from clicking on the first link they see in the google search results.

[NotATether]

How about this:

• Put chipmixer.com behind Cloudflare, with only a landing page.
• The landing page shows a link to Tor browser, .onion URL and a link to a (newly created) clearnet URL without Cloudflare.
• The URL without Cloudflare can be for instance nocloudflare.chipmixer.com. If there's no DDOS, it's available. During DDOS, the landing page is still available to point towards the .onion site.
• This way, Cloudflare only knows you visited the clearnet landing page.

Chipmixer's coffers must be flowing with cash (to be clear: like any other successful service) so assuming they got an easy fiat offramp that can take hundreds of dollars per month, they can probably afford to buffer with Akamai or Fastly instead.

[Incain Titil]

Hello! Once again, there were problems with receiving chips after the transaction received 3 confirmations. I paid according to the specified details, but did not receive the chips after the funds were credited to your wallet. I sent you a ticket from AlecksManfliest8241@protonmail.com
Please process it.

[Hueristic]

I think people would prefer a ChipMixer wallet to cloudflare, actually they would prefer a root canal me thinks.

[ChipMixer]

I have no idea what percentage of users uses it already, but for whoever doesn't use it yet: it's amazingly easy! If you haven't tried it yet, I recommend to at least download and try Tor browser.

Most of them already does. New users (both to mixing and bitcoin) use .com and we want to protect them from it.

Can someone give me an article, or explain, why the Tor's website can't be DDoS-ed same like clearnet's is?

It can be DDoSed. Main advantage here is DDoSing .onion will not remove it from Google. DDoSing .com will remove it and will make phishing websites earn more.

How about this:

• Put chipmixer.com behind Cloudflare, with only a landing page.
• The landing page shows a link to Tor browser, .onion URL and a link to a (newly created) clearnet URL without Cloudflare.
• The URL without Cloudflare can be for instance nocloudflare.chipmixer.com. If there's no DDOS, it's available. During DDOS, the landing page is still available to point towards the .onion site.
• This way, Cloudflare only knows you visited the clearnet landing page.

This is very good idea.

[BTCagent87]

Hello

Made payment

There are already more than 6 confirmations,
but there are still no keys (((

https://blockchair.com/bitcoin/transaction/9a2bd3b286a01a6ab714328a5f40b87becdd7633d09ac6552fd0762c77d34715

Please check my request!

[mole0815]

Hopefully you didn't fall for a scam site BTCagent87. Which URL did you use?

@chipmixer
Thanks for the opportunity to participate in the V3 test. It worked smoothly and I couldn't find any problems!
I have tested it via Brave Browser.

[stompix]

I did play a bit with the new test site and everything went smoothly
redeemed voucher, split it for fun, withdraw, imported private keys
deposited coins, split the chips, recombined, went again to withdraw,
deposited, moved to a wm restored the session, created a voucher, nothing wrong.
Also, destroying the session seems to work alright generating a new id and address.

Nice seeing segwit, should lower costs for both sides, I don't know how long we would still be able to enjoy 1sat/b next block confirmation.

[o_e_l_e_o]

Most of them already does. New users (both to mixing and bitcoin) use .com and we want to protect them from it.

What about putting the fully functioning clearnet site behind Cloudflare, but simply displaying large warnings all over it that it is using Cloudflare along with links and recommendations to use the Tor site and explanations why, rather than just having a landing page with no mixing functions on the clearnet site? That way people who might just want to test it out, or are using some public computer without Tor, or for whom Tor is difficult to run due to ISP or government restrictions,* or just want to break the blockchain link and aren't worried about Cloudflare, etc., can still mix their coins while still being aware of the reduced privacy and increased risks they are taking?

*Yes, I know about Tor bridges, but not everyone does or knows how to set them up.


I've also tested the new v3 site and I've tried my hardest to break something, but to no avail. It all worked very smoothly, bar the brief moment when I though I'd been given an empty private key because I imported it as legacy (force of habit!) instead of segwit. Also very nice that you can split deposits up in to multiple different vouchers.

[HeRetiK]

I've also tested the new v3 site and I've tried my hardest to break something, but to no avail. It all worked very smoothly, bar the brief moment when I though I'd been given an empty private key because I imported it as legacy (force of habit!) instead of segwit. Also very nice that you can split deposits up in to multiple different vouchers.

Oooohh! That happened to me as well, except I wasn't smart enough to realize this by myself. Thanks o_e_l_e_o!

@ChipMixer: Please disregard the PM I sent you, importing the private keys worked just fine after reading o_e_l_e_o's post above. Smartass that I am I didn't click on the "Import to Electrum" button but directly copy / pasted the private key from the "Withdraw" page. Also of course I didn't read the note about Electrum requiring a special prefix. Maybe put that part in bold? Not sure. Either way I didn't realize there was new information on that page, blinded by routine I guess.

[TryNinja]

Yep, had the same issue importing the private-keys without the p2wpkh: prefix. If we all made the same mistake, imagine the other less-tech-savvy users.

An extra warning will probably save you some desperate emails (e.g "some wallets - like Electrum - require extra steps, use the button for their instructions").

[ChipMixer]

@ChipMixer: Please disregard the PM I sent you, importing the private keys worked just fine after reading o_e_l_e_o's post above. Smartass that I am I didn't click on the "Import to Electrum" button but directly copy / pasted the private key from the "Withdraw" page. Also of course I didn't read the note about Electrum requiring a special prefix. Maybe put that part in bold? Not sure. Either way I didn't realize there was new information on that page, blinded by routine I guess.

There was no note when you tried it. It was added after your (and other person) feedback.

Tor v3 version of ChipMixer is now online: http://chipmixorflykuxu56uxy7gf5o6ggig7xru7dnihc4fm4cxqsc63e6id.onion (chip mix or fly)
It supports Segwit deposit addresses and chips may also be Segwit.

[TheQuin]

What about putting the fully functioning clearnet site behind Cloudflare, but simply displaying large warnings all over it that it is using Cloudflare along with links and recommendations to use the Tor site and explanations why, rather than just having a landing page with no mixing functions on the clearnet site? That way people who might just want to test it out, or are using some public computer without Tor, or for whom Tor is difficult to run due to ISP or government restrictions,* or just want to break the blockchain link and aren't worried about Cloudflare, etc., can still mix their coins while still being aware of the reduced privacy and increased risks they are taking?

I like this suggestion. There's probably a lot of people like me that want the privacy of it not being public knowledge how much coin I have or where it came from but have nothing to hide from the NSA.

[SFR10]

Also, destroying the session seems to work alright generating a new id and address.

I had a somewhat different experience while using the Tor browser... When I tried starting a new mix ^{[immediately after destroying the session]}, I still kept seeing/getting the previous session ^{[same ID/address]} but that wasn't an issue when I relaunched my browser.
^{- Not sure if that's how the Tor browser normally reacts since I rarely use it.}

@ChipMixer
Thank you for allowing us to test v3

[stompix]

Also, destroying the session seems to work alright generating a new id and address.

I had a somewhat different experience while using the Tor browser... When I tried starting a new mix immediately after destroying the session, I still kept seeing/getting the previous session same ID/address but that wasn't an issue when I relaunched my browser.

Force of habit, I dislike even using the same id for multiple sites in a row, I always close down and restart the connection or at least get a new identity after completing something over Tor, so after finishing and destroying it gave me a new session id, I tried recovering the older session there was nothing there so the destroying part worked and I didn't look twice over it, focused on restoring so indeed I missed one part there. But yeah, it keeps your session if you go right back you start from scratch with the same.

[dkbit98]

New Chipmixer Tor v3 worked very good during my testing and I am especially happy to finally see support for bc1 segwit addresses.

I think that privacy will be improved even more when Taproot goes mainnet for Bitcoin in few months, so my question is will ChipMixer also benefit from this?