ㅤ

[bct_ail]

Multiple suggestions making the rounds on Twitter that Coinfirm is the secret blockchain analysis company which Wasabi is partnered with.

I do not know how to code.
But the name coinfirm is clearly written here:

https://github.com/zkSNACKs/WalletWasabi/blob/795496595fae2f52730e1556bb6cafd2c649bb97/WalletWasabi.Tests/UnitTests/WabiSabi/Backend/CoinVerifierTests.cs#L215

https://github.com/zkSNACKs/WalletWasabi/blob/795496595fae2f52730e1556bb6cafd2c649bb97/WalletWasabi.Tests/UnitTests/WabiSabi/Backend/CoinVerifierTests.cs#L220

[witcher_sense]

Multiple suggestions making the rounds on Twitter that Coinfirm is the secret blockchain analysis company which Wasabi is partnered with.

I do not know how to code.
But the name coinfirm is clearly written here:

https://github.com/zkSNACKs/WalletWasabi/blob/795496595fae2f52730e1556bb6cafd2c649bb97/WalletWasabi.Tests/UnitTests/WabiSabi/Backend/CoinVerifierTests.cs#L215

https://github.com/zkSNACKs/WalletWasabi/blob/795496595fae2f52730e1556bb6cafd2c649bb97/WalletWasabi.Tests/UnitTests/WabiSabi/Backend/CoinVerifierTests.cs#L220

It looks like they are using Coinfirm API to get information about a particular Bitcoin address. They make a request to a specific Coinfirm API endpoint, retrieve data from the database, parse the received data, and then make a decision to accept or decline the address in a CoinJoin transaction.

Here is an example of Coinfirm API: https://app.swaggerhub.com/apis/Coinfirm-swagger/API/3.0.9#/Transaction%20report/get_transaction_report_reports

Of course, in order to try it out, you need to create an account with Coinfirm.

[o_e_l_e_o]

It looks like they are using Coinfirm API to get information about a particular Bitcoin address.

Absolutely. And nice for the CEO to spell out in the thread I linked above just exactly what Coinfirm are doing to your UTXOs you try to mix with Wasabi. Firstly they link your UTXOs with off-chain information, entities, identities, etc. Then they cluster your UTXO with others belonging to you, examine your transactions in order to identify patterns which can be used to link to your other transactions, look for anomalies, graph analysis, throw in some machine learning and AI as well. That's exactly what I want to happen every time I try to coinjoin!

But of course, the specifics of their techniques remain completely secret and they can refuse your coins for any reason and not tell you why. Super transparent!

[n0nce]

Catching up on this a few weeks late, I realize, but an important addition to this...

...Which can happen to you in Joinmarket as well.  You can get censored by the coordinator and you can't even detect they are doing this.

No, you can't. Makers can choose not to join your coinjoin, and so you can pick different makers instantly. They absolutely cannot ban you from coinjoining altogether like Wasabi can do. (I know you are going to repeat your nonsense soundbite about "run your own coordinator" here, but as I explained above, that simply is not an option for 99.9% of users).

I think it's very important to note that it's actually impossible for everyone to run their own coordinator.

Assuming that we want everyone to be able to mix their coins without possibility of censorship, everyone should use their own (and only their own) coordinator, which would result in an anonymity set of 1 (per coordinator).
Basically your whole model depends on people finding a large number of users who are willing to not run their own coordinator and therefore put themselves at risk of censorship, for one user to be truly private and uncensorable.

Besides: is entering a custom coordinator URL even a GUI option by now? When this topic started, one of my issues was that it was basically impossible for regular users to switch to a different coordinator even if they wanted to.

If you want to really bank on this point that 'they can change coordinator / run their own', you should also let actions follow words and emphasize it in your docs, install guides, set up process and GUI.

Use absolutely no CEX, today or tomorrow.

This is obviously the best option, and it's never been easier. We have the biggest choice of DEXs we've ever had, we have the most volume on DEXs that we've ever had, and we have the most advanced DEX (Bisq) that we've ever had.

And they're only getting better. Bisq 2 is right around the corner, which apparently also includes Lightning functionality.

A very important thing that Bisq is still missing is ⚡ lightning network.

For smaller trades it is vital.

It's coming soon!

[o_e_l_e_o]

I think it's very important to note that it's actually impossible for everyone to run their own coordinator.

Certainly not with Wasabi. With JoinMarket, then effectively every taker is indeed their own coordinator, and so it becomes impossible to censor any individual user (unless you controlled every other UTXO in JoinMarket, which will obviously never be the case).

And they're only getting better. Bisq 2 is right around the corner, which apparently also includes Lightning functionality.

Now this is interesting. Last I read it was very much still in the "exploration" stages:

Lightning Network based 3-party trade protocol
    Unclear if this is feasible yet, but it's very interesting.

Can't wait to see what format it takes!

[Kryptowerk]

It looks like they are using Coinfirm API to get information about a particular Bitcoin address.

Absolutely. And nice for the CEO to spell out in the thread I linked above just exactly what Coinfirm are doing to your UTXOs you try to mix with Wasabi. Firstly they link your UTXOs with off-chain information, entities, identities, etc. Then they cluster your UTXO with others belonging to you, examine your transactions in order to identify patterns which can be used to link to your other transactions, look for anomalies, graph analysis, throw in some machine learning and AI as well. That's exactly what I want to happen every time I try to coinjoin!

But of course, the specifics of their techniques remain completely secret and they can refuse your coins for any reason and not tell you why. Super transparent!

This is truely yucky. Thanks for pointing out these deceptive practices, it's so sneaky to put it into a wallet officially centered around privacy.
Goes to show again, closed source and free, decentralized crypto does not go well together at all.

What's your current suggestion for a transparent mixer-based wallet? Is there anything new besides Samurai?

[o_e_l_e_o]

What's your current suggestion for a transparent mixer-based wallet? Is there anything new besides Samurai?

Samourai isn't perfect, but I would readily recommend it over Wasabi. If you do use Samourai, then it's important to enable Tor and link it to your own node to maintain full privacy.

For desktop, then the easiest option is to use Sparrow (also with Tor and your own node) to mix with Samourai's Whirlpool. The best, but more complex, option is to run JoinMarket.

[Kruw]

What's your current suggestion for a transparent mixer-based wallet? Is there anything new besides Samurai?

Samourai isn't perfect, but I would readily recommend it over Wasabi. If you do use Samourai, then it's important to enable Tor and link it to your own node to maintain full privacy.

For desktop, then the easiest option is to use Sparrow (also with Tor and your own node) to mix with Samourai's Whirlpool. The best, but more complex, option is to run JoinMarket.

Why are you recommending Whirlpool after seeing all these addresses it leaks?  If this user had coinjoined with WabiSabi instead, none of these transactions could have been traced together:

Post the tx ID of any Whirlpool transaction and I will show you the tx0 transaction that was created by each of the new entrants.

Ok, here's one: https://mempool.space/tx/ed3131b544fbf00a71709942e483b55e629312ecb181e6e819409f419ee0d226

Where exactly is the privacy loss for new entrants, splitting a single UTXO in to multiple UTXOs to join the pool?

Okay, here's all the payments that can be tracked from the two new participants of the Whirlpool coinjoin transaction:

Entrant 1: bc1q03c0443ausjjdxl2h6ud5m8c0dux0zyg3dqdj7 created 0.00170417 BTC in unmixed change sent to bc1q3fduld0l3r8nclyt5p3r7ak675tekurstn55tl.  Since this UTXO is not private, the sats were marked as unspendable and have not been recovered by the wallet owner  

Entrant 2: bc1qzc8zku26ej337huw5dlt390cy2r9kgnq7dhtys created 0.00191247 BTC in unmixed change sent to bc1qjlltxr443uy236wl4xhpxlr6dgsu0zltlv3m44. This UTXO was used in a second tx0 transaction, creating a huge trail of transactions that could be traced to each other  

The 2nd tx0 transaction created 0.00076348 BTC unmixed change which was sent to bc1qehd7gy8rza9mnzm9wnfjhgw82rp47wmqt7vpgy

Since this unmixed change is below the .001 pool minimum, it was consolidated in a 3rd tx0 with 3 other addresses owned by the same wallet:
31x8GPqrhzdaxiBJa9N5UisuoxbX1rAnHa
16Gw5WKjbxZmg1zhZQs19Sf61fbV2xGujx
3LZtsJfUjiV5EZkkG1fwGEpTe2QEa7CNeY

The 3rd tx0 transaction created .00200317 in unmixed change which was sent to bc1q2p7gdtyahct8rdjs2khwf0sffl64qe896ya2y5
This was spent in a 0.00190000 payment to 3B8cRYc3W5jHeS3pkepwDePUmePBoEwyp1 (a reused address)

That payment left .00008553 in change that was tracked to 3Dh7R7xoKMVfLCcAtVDyhJ66se82twyZSn and consolidated with two other inputs in a 4th tx0 transaction:
bc1qeuh6sds8exm54yscrupdk03jxphw8qwzdtxgde
3ByChGBFshzGUE5oip8YYVEZDaCP2bcBmZ

This 4th tx0 created .00533406 in unmixed change which was sent to bc1qzh699s75smwukg9jcanwnlkmkn38r79ataagd9 which was consolidated with 3 more addresses into a 5th tx0:
3F2qiWQJKQjF7XFjEo8FUYP3AU5AC6RqX8
3HAYYVKUpYbr2ARMdZJr9yVu8xi8UcxtPz
3GQtwwRK31wwCc22q6WS5sCgixUHsG5KaT

The 5th tx0 created 0.00058494 BTC in unmixed change that was sent to bc1qvh2zjcwwkj9y70xulla2semvlav3lty0p3l3w3
This was spent in a .00047290 payment to bc1qvzg8jq6wqtr5navn4e3ps4qrkk9r6n4h98gjck

That payment left .00008411 in change that was tracked to bc1qg6j0f0wfhpktt2l8uzdn48ct3um2xyur40eyzd and consolidated with another input into a 6th tx0 transaction:
31iZLXWfoywhuMZTPGxTkpzphzh2NXshpP

The 6th tx0 created .00753775 in unmixed change that was tracked to bc1qgfll2apc27yct6h2c8r8wq4kqhxjsfrudhhn5q
This was spent in a .00737000 payment to bc1q5emzer2t0sq5dez0zsrqgh6scvwn0n24xsladp (a reused address)

This payment left 0.00010896 BTC in change which has not been spent yet, but the payment only took place 11 days ago, so I assume it will eventually be spent, allowing the Whirlpool user to be tracked even further.

[o_e_l_e_o]

You really are a broken record.

I refer you to my previous replies:

Wrong. All you've actually done is follow some unmixed change - change which is deliberately segregated so as not to impact the privacy of the coinjoin. You haven't deanonymized a single Whirlpool output.

Since this post is currently being used on Twitter as some kind of "gotcha" moment, it's probably worth repeating that it is no such thing. All it shows is unmixed change being spent - the same change Whirpool deliberately segregates so as not to impact the privacy of its coinjoins. It does not show a Whirlpool coinjoin being deanonymized in any way.

The Wasabi shills repeating this example only show their own ignorance.

Also, nice of you to disappear for two months after I made the following post.

On another note, and I am deliberately not going to link to any of the tweets, but in the last 48 hours there has been a bunch of Twitter drama due to Wasabi publicly doxxing their competitors.

Says it all really. The landing page of wasabiwallet.io says in big font right at the start "Privacy is your ability to selectively reveal yourself to the world". And then the Wasabi devs completely ignore that statement and start doxxing people who disagree with them. Imagine trying to pass yourself off as pro-privacy as you fund blockchain analysis and dox people you don't like? Absolutely despicable behavior, and should show everyone just where the priorities of Wasabi lie. They don't care in the slightest about your privacy.

Can't wait for our resident shill to come and tell us how doxxing people you don't like is actually fine.

[Kruw]

You really are a broken record.

I refer you to my previous replies:

Wrong. All you've actually done is follow some unmixed change - change which is deliberately segregated so as not to impact the privacy of the coinjoin. You haven't deanonymized a single Whirlpool output.

Since this post is currently being used on Twitter as some kind of "gotcha" moment, it's probably worth repeating that it is no such thing. All it shows is unmixed change being spent - the same change Whirpool deliberately segregates so as not to impact the privacy of its coinjoins. It does not show a Whirlpool coinjoin being deanonymized in any way.

The Wasabi shills repeating this example only show their own ignorance.

That's exactly my point: I've followed the unmixable change and the merged inputs to reveal this massive history of addresses being leaked by Whirlpool tx0s.  If this user had used WabiSabi instead, none of these addresses would have ever been linked together because inputs are consolidated privately and all outputs are mixed.

Why would you think Whirlpool would be better than WabiSabi since Wabisabi wouldn't have linked all of these addresses together on chain?

Also, nice of you to disappear for two months after I made the following post.

On another note, and I am deliberately not going to link to any of the tweets, but in the last 48 hours there has been a bunch of Twitter drama due to Wasabi publicly doxxing their competitors.

Says it all really. The landing page of wasabiwallet.io says in big font right at the start "Privacy is your ability to selectively reveal yourself to the world". And then the Wasabi devs completely ignore that statement and start doxxing people who disagree with them. Imagine trying to pass yourself off as pro-privacy as you fund blockchain analysis and dox people you don't like? Absolutely despicable behavior, and should show everyone just where the priorities of Wasabi lie. They don't care in the slightest about your privacy.

Can't wait for our resident shill to come and tell us how doxxing people you don't like is actually fine.

I couldn't care less about your drama, I'm simply explaining how WabiSabi protects your privacy.

[o_e_l_e_o]

If this user had used WabiSabi instead, none of these addresses would have ever been linked together because inputs are consolidated privately and all outputs are mixed.

There is nothing stopping users combining UTXOs outside of a Wasabi coinjoin which compromises their privacy, just as there is nothing stopping them doing that with a Samourai coinjoin as has happened here, or a JoinMarket coinjoin, or any other privacy tool available. In every case, such behavior is not a flaw in the coinjoin protocol. This is a very simple concept you are failing to grasp (or deliberately ignoring to shill your pro-surveillance and pro-censorship software). This has been explained to you by multiple other users on Twitter as well.

What is a flaw in the coinjoin protocol is when the coinjoin protocol itself actively reuses addresses, as I've linked to Wasabi doing multiple times.

I couldn't care less about your drama, I'm simply explaining how WabiSabi protects your privacy.

Lmao. "My drama". It is very much Wasabi's drama, and deeply unethical behavior.

[Kruw]

There is nothing stopping users combining UTXOs outside of a Wasabi coinjoin which compromises their privacy,

What do you mean "combining UTXOs outside of a Wasabi coinjoin", lol?  There is no such thing because WabiSabi allows you to combine your UTXOs INSIDE COINJOINS, which prevents revealing common input ownership.

just as there is nothing stopping them doing that with a Samourai coinjoin as has happened here

You are wrong:  tx0 is stopping them.  Since tx0 is a self spend instead of a coinjoin, that means it reveals all inputs are owned by one person, and reveals toxic change that belongs to that person.

In every case, such behavior is not a flaw in the coinjoin protocol.

It is a flaw in the Whirlpool coinjoin protocol because tx0 reveals multiple addresses belong to the same user by creating unmixed change, and reveals common input ownership because it is a self-spend transaction instead of a coinjoin.  WabiSabi coinjoins make it so no two addresses are ever linked to each other (for anyone except the largest whale in the round).

What is a flaw in the coinjoin protocol is when the coinjoin protocol itself actively reuses addresses, as I've linked to Wasabi doing multiple times.

So why are you telling people to use Samourai's Whirlpool which reuses addresses?  I already provided you proof of their address reuse happening in multiple cases:

https://medium.com/@thepiratewhocantbenamed/samourai-wallet-address-reuse-bug-1d64d311983d
https://twitter.com/SamouraiWallet/status/1283145015124996098
https://twitter.com/brian_trollz/status/1559018534675644418

I couldn't care less about your drama, I'm simply explaining how WabiSabi protects your privacy.

Lmao. "My drama". It is very much Wasabi's drama, and deeply unethical behavior.

The deeply unethical behavior (sock puppeting) you are referring to was done by Samourai's developer, not Wasabi - https://nopara73.medium.com/samouraileaks-samouraidevs-sockpuppet-exposed-7ce654b92c0b

[o_e_l_e_o]

What do you mean "combining UTXOs outside of a Wasabi coinjoin", lol?

If a user funds their Samourai wallet, then Samourai creates a Tx0 to segregated unmixed change. If the user chooses to then combine a coinjoin output with that unmixed change, then there is nothing the coinjoin protocol can do to stop them.

If a user funds their Wasabi wallet, the transaction which funds that wallet will create unmixed change. If the user chooses to then combine a (surveilled and permissioned) coinjoin output with that unmixed change, then there is nothing the coinjoin protocol can do to stop them.

If a user swaps some coins to monero, the transaction which funded that swap will create unmixed change. If the user then swaps some monero back to bitcoin and combines that new bitcoin with the unmixed change, then there is nothing monero can do to stop them.

Every privacy service or protocol in existence has the same weakness of a user combining unmixed changed with mixed outputs. That is not the fault of the privacy service or protocol, but the fault of the user.

On the other hand, the flaws in Wasabi such as constant address reuse, the largest party in the coinjoin receiving zero privacy, colluding with governments, supporting mass surveillance, attacking bitcoin's fungibility, directly funding the enemies of bitcoin, etc., are absolutely the fault of Wasabi.

The deeply unethical behavior (sock puppeting) you are referring to was done by Samourai's developer, not Wasabi

Nope, I wasn't referring to sock puppeting at all. I was referring to Wasabi actively doxxing people who disagree with them. That's the behavior of real privacy loving cypherpunks.

[Kruw]

What do you mean "combining UTXOs outside of a Wasabi coinjoin", lol?

If a user funds their Samourai wallet, then Samourai creates a Tx0 to segregated unmixed change. If the user chooses to then combine a coinjoin output with that unmixed change, then there is nothing the coinjoin protocol can do to stop them.

If a user funds their Wasabi wallet, the transaction which funds that wallet will create unmixed change. If the user chooses to then combine a (surveilled and permissioned) coinjoin output with that unmixed change, then there is nothing the coinjoin protocol can do to stop them.

There is no unmixed change in WabiSabi coinjoins unless you are the whale, look at this transaction and see for yourself - ALL outputs gained privacy since they cannot be matched to any input, and any two inputs can't be identified as being owned by the same person: https://mempool.space/tx/633128233af9c571e8fb99a28b10c195a102da7081a027e0cf657cdce9573909

If a user swaps some coins to monero, the transaction which funded that swap will create unmixed change. If the user then swaps some monero back to bitcoin and combines that new bitcoin with the unmixed change, then there is nothing monero can do to stop them.

Every privacy service or protocol in existence has the same weakness of a user combining unmixed changed with mixed outputs. That is not the fault of the privacy service or protocol, but the fault of the user.

It was a fault of every privacy protocol until the WabiSabi protocol fixed it.  Only whales can receive unmixed change, and that unmixed change just gets automatically remixed until it's entirely mixed.

On the other hand, the flaws in Wasabi such as constant address reuse

Can you explain to me why you aren't warning these people you are recommending Samourai's Whirlpool to about their constant address reuse?

Nope, I wasn't referring to sock puppeting at all. I was referring to Wasabi actively doxxing people who disagree with them. That's the behavior of real privacy loving cypherpunks.

Exposing someone for using sock puppets isn't "doxxing".

[o_e_l_e_o]

There is no unmixed change in WabiSabi coinjoins

I really don't know how to make this any simpler for you to grasp. I'll try.

I have a UTXO of 0.5 BTC.

I make a transaction sending 0.2 BTC to Wasabi, and 0.3 BTC to a change address.

After Wasabi have thoroughly spied on the 0.2 BTC I sent and received permission from their blockchain analysis buddies and their government sanctioned blacklists, I am hopefully granted permission to coinjoin it. Ignoring Wasabi fees and transaction fees for the sake of simplicity, I now have a coinjoined output of 0.2 BTC.

I then combine this 0.2 BTC output with my original 0.3 BTC in the change address.

There is nothing Wasabi, or Samourai, or JoinMarket, or anyone else for that matter, can do to stop me from doing this. Samourai give the transaction a specific name and segregate the change in to a different account to help prevent the user from making this error, but there is nothing they can do to stop it entirely. Wasabi also cannot stop it, but apparently Wasabi contributors choose just to ignore it and pretend it cannot happen instead since they don't actually care about their users' privacy in the first place.

[Kruw]

There is no unmixed change in WabiSabi coinjoins

I really don't know how to make this any simpler for you to grasp. I'll try.

I have a UTXO of 0.5 BTC.

I make a transaction sending 0.2 BTC to Wasabi, and 0.3 BTC to a change address.

After Wasabi have thoroughly spied on the 0.2 BTC I sent and received permission from their blockchain analysis buddies and their government sanctioned blacklists, I am hopefully granted permission to coinjoin it. Ignoring Wasabi fees and transaction fees for the sake of simplicity, I now have a coinjoined output of 0.2 BTC.

I then combine this 0.2 BTC output with my original 0.3 BTC in the change address.

There is nothing Wasabi, or Samourai, or JoinMarket, or anyone else for that matter, can do to stop me from doing this. Samourai give the transaction a specific name and segregate the change in to a different account to help prevent the user from making this error, but there is nothing they can do to stop it entirely. Wasabi also cannot stop it, but apparently Wasabi contributors choose just to ignore it and pretend it cannot happen instead since they don't actually care about their users' privacy in the first place.

That's not how it works.  You have a UTXO of .5 BTC.  It gets coinjoined and produces no unmixed change.  There is no "sending .2 to Wasabi" required.

Now, please answer my question:  Why aren't you warning users about the address reuse in Samourai's Whirlpool when recommending it to them?

[o_e_l_e_o]

That's not how it works.  You have a UTXO of .5 BTC.  It gets coinjoined and produces no unmixed change.  There is no "sending .2 to Wasabi" required.

Lmfao. So everyone in the world is storing all their coins on Wasabi all the time? No one ever sends a transaction to their Wasabi wallet which has a change output?

Now I'm certain you are just trolling.

Now, please answer my question:  Why aren't you warning users about the address reuse in Samourai's Whirlpool when recommending it to them?

You yourself linked to Samourai's disclosure and fixes, which were implemented years ago. Meanwhile Wasabi just deny their address reuse and dox anyone who talks about it.

[Kruw]

Lmfao. So everyone in the world is storing all their coins on Wasabi all the time? No one ever sends a transaction to their Wasabi wallet which has a change output?

Now I'm certain you are just trolling.

Your scenario involves someone sending coins to themselves, how am I trolling?  Why would I send .2 to myself in order to create .3 change?  What possible reason could anyone have for splitting their UTXOs to themselves?

If someone has .5 BTC they simply gain privacy on their .5 BTC without revealing any other addresses.  That's how WabiSabi coinjoins work, there's no splitting required.

Now, please answer my question:  Why aren't you warning users about the address reuse in Samourai's Whirlpool when recommending it to them?

You yourself linked to Samourai's disclosure and fixes, which were implemented years ago. Meanwhile Wasabi just deny their address reuse and dox anyone who talks about it.

So why don't you warn people about the repeated instances of Samourai's address reuse when recommending Whirlpool to people?  You called it a flaw:

What is a flaw in the coinjoin protocol is when the coinjoin protocol itself actively reuses addresses

But you only mention this flaw happening in Wasabi and never in Samourai.  Why aren't you capable of being honest when comparing?

[BlackHatCoiner]

Your scenario involves someone sending coins to themselves, how am I trolling?  Why would I send .2 to myself in order to create .3 change?

Here are some possible scenarios:

- I want to test Wasabi Wallet, and I'm required to send a small amount which can come back to my main wallet software.
- I want to mix less than 0.5 BTC, and I only possess an 0.5 BTC UTXO.
- I may don't like Wasabi Wallet as wallet software, and I only want to use it to coinjoin, which means I have to occasionally move coins from Wasabi to my main wallet software.

It's quite possible, and it is the user's fault. What the user does outside the wallet software isn't the wallet software's fault.

[Kruw]

Your scenario involves someone sending coins to themselves, how am I trolling?  Why would I send .2 to myself in order to create .3 change?

Here are some possible scenarios:

- I want to test Wasabi Wallet, and I'm required to send a small amount which can come back to my main wallet software.
- I want to mix less than 0.5 BTC, and I only possess an 0.5 BTC UTXO.
- I may don't like Wasabi Wallet as wallet software, and I only want to use it to coinjoin, which means I have to occasionally move coins from Wasabi to my main wallet software.

It's quite possible, and it is the user's fault. What the user does outside the wallet software isn't the wallet software's fault.

Yep, if your "main wallet" doesn't support WabiSabi coinjoins, then you should switch your main wallet to one that does:  Wasabi, BTCPay Server, or Trezor.