Trezor AOPP Integration

[ChiBitCTy]

Does anyone know if this is for all countries ? Thoughts ?



https://twitter.com/trezor/status/1486747863912796171?s=21

Article about it (showing only Switzerland here )-  https://cvj.ch/en/focus/legal-and-compliance/trezor-integrates-aopp-to-simplify-withdrawals-to-non-custodial-wallets/

[1713865882]

1713865882

[bitmover]

i found this
https://aopp.group/

Address Ownership Proof Protocol (AOPP)

In Switzerland and the Netherlands, a Virtual Asset Service Provider (VASP)—any financial intermediary dealing with crypto assets such as Bitcoin—is legally obliged to require proof of ownership of a customer's wallet address before withdrawals and deposits can be made. AOPP is a simple and automated solution for providing proof of ownership of an external wallet's address.

As far as I understand,  this is only about Switzerland and Netherlands for now. Maybe LoyceV knows more about it? He is from Netherlands.

I believe in future we will see a lot of those initiatives. They are trying to control and to give a name for each address with balance. But they can't. At least for now, we still have significant privacy

Governments will try to obligate exchanges to do so. About trezor, my advice is: buy a ledger pr just ignore their software and use electrum

[LoyceV]

any financial intermediary dealing with crypto assets such as Bitcoin—is legally obliged to require proof of ownership of a customer's wallet address before withdrawals and deposits can be made.

Maybe LoyceV knows more about it? He is from Netherlands.

I don't know anything about "AOPP". What I do know, is that the Dutch implementation of EU regulations was too strict, and Bitcoin companies no longer have to ask for proof of ownership of Bitcoin addresses.
See:
Bitonic destroys wallet-screenshots that were unduly required by its supervisor
DNB formally acknowledges complaints Bitonic and revokes wallet-verification requirement
Preliminary relief judge upholds Bitonic's objections and calls on DNB to review its requirement
Lawsuit Bitonic vs Dutch Central Bank < kuddos to those guys for fighting for our privacy!
(more on Bitonic News archive)

[SFR10]

Does anyone know if this is for all countries ?

In regards to the implementation of the FATF's Travel Rule, so far, that's not the case with most countries:
^{- I can confirm that we [PH] already have such a thing in place, in one of our local wallets/exchanges: How does the Travel Rule affect external transfers?}

• Of 128 jurisdictions contacted by FATF only 58 – fewer than half – reported they had the necessary rules and regulations in place to allow crypto companies to comply with FATF’s requirements in the first place. In total, more than 200 jurisdictions around the world aim for compliance with FATF guidance, meaning the vast majority of countries have yet to provide VASPs doing business within their borders meaningful direction on how to comply with the travel rule.

Thoughts ?

If the "AOPP integration" part it's just going to be an "optional feature" from Trezor's side, I don't see it as a bad thing...

[Pmalek]

If the "AOPP integration" part it's just going to be an "optional feature" from Trezor's side, I don't see it as a bad thing...

I guess there is no other way than it being an optional feature because only Switzerland uses it for now. It's a successful way to deanonymize bitcoin users. But if you are using a centralized exchange in which you have already undergone KYC verification, your privacy is already screwed. Doing an additional address verification won't change much. Most of the coins getting withdrawn from exchanges are done so by the customers who transfer said coins to their own private wallets. So the exchange already knows where the money went. This is just a way to put a sticker on those addresses to be sure. 

[o_e_l_e_o]

Thoughts ?

As Loyce has pointed out above, the Netherlands tried to implement such address verification nonsense. Instead of just rolling over and saying "Sure, let's sell out our users' privacy" as Trezor are doing here, the biggest exchange in the Netherlands - Bitonic - funded a lawsuits against the central bank and had the law overturned. This is what responsible companies which care about their users would do, and not just immediately implement this privacy invading nonsense, especially not in to a product which is designed specifically to give you control over your money and not play in to the hands of centralized exchanges or governments.

It won't affect me in the slightest since I have never and will never use a centralized exchange, (especially not one which requires such address verification nonsense), but I am disappointed Trezor aren't fighting this instead of implementing it.

This is just a way to put a sticker on those addresses to be sure.

If I ever traded on a centralized exchange, any coins I withdrew to a KYC-linked address would be forwarded to a mixer within the same block.

It is absolutely crazy that the community as a whole is OK with this kind of insane privacy invasion.

[bitmover]

It is absolutely crazy that the community as a whole is OK with this kind of insane privacy invasion.

I found a very interesting article about it in Bitcoin Magazine (probably the best news website about bitcoin)

A similar dynamic is in play when it comes to the AOPP. The protocol isn’t inherently bad as it simply seeks to facilitate the enforcement of wallet verifications measures in Switzerland by making an interoperable standard available to wallet developers to implement. But even though AOPP isn’t in and of itself negative, it legitimizes the practice of checking for address ownership, and implementing it opens up a precedent for having the government influence developments in the open source Bitcoin wallet space. Surveillance and control mechanisms always start small, and there is hardly a way to see ahead of one’s time and discover the true direction such requests could take.

Therefore, not implementing this standard is an act of sovereignty and responsibility as it protects users from future — and possibly worse — surveillance mechanisms being implemented as per the request of regulatory bodies.

This reminds me of the Cyberpunk Manifesto, where he clearly takes a stand against regulations on cryptography, which is what AOPP is all about.

Cypherpunks deplore regulations on cryptography, for encryption is fundamentally a private act. The act of encryption, in fact, removes information from the public realm.  Even laws against cryptography reach only so far as a nation's border and the arm of its violence.
Cryptography will ineluctably spread over the whole globe, and with it the anonymous transactions systems that it makes possible.

https://nakamotoinstitute.org/static/docs/cypherpunk-manifesto.txt

[LoyceV]

As Loyce has pointed out above, the Netherlands tried to implement such address verification nonsense.

In a way I'm surprised taxes don't ask for this information yet. They want to know your total balance of everything, and specifics for each bank account, but they're not asking about Bitcoin addresses yet. That's probably because their system can't handle it, but at some point they'll no doubt be that intrusive. It's already a security risk having to disclose what you own, especially considering how many tax employees would be able to access this data.

I am disappointed Trezor aren't fighting this instead of implementing it.

Hense the kuddos to Bitonic, they fought this in court and won. Unlike many other companies, they don't like having to violate their customers' privacy.

It is absolutely crazy that the community as a whole is OK with this kind of insane privacy invasion.

Not only the Bitcoin community, it's the same everywhere: barely anyone cares about privacy.

[o_e_l_e_o]

In a way I'm surprised taxes don't ask for this information yet. They want to know your total balance of everything, and specifics for each bank account, but they're not asking about Bitcoin addresses yet. That's probably because their system can't handle it, but at some point they'll no doubt be that intrusive. It's already a security risk having to disclose what you own, especially considering how many tax employees would be able to access this data.

What a shame that you accidentally lost a bunch of your paper wallets Loyce! You'll need to be more careful in future. Here's hoping you find them again in 10 or 20 years' time.

[bitmover]

In a way I'm surprised taxes don't ask for this information yet. They want to know your total balance of everything, and specifics for each bank account, but they're not asking about Bitcoin addresses yet. That's probably because their system can't handle it, but at some point they'll no doubt be that intrusive. It's already a security risk having to disclose what you own, especially considering how many tax employees would be able to access this data.

What a shame that you accidentally lost a bunch of your paper wallets Loyce! You'll need to be more careful in future. Here's hoping you find them again in 10 or 20 years' time.

I think they are not in a hurry because at any time they can link our addresses to us, as blockchain is immutable. A small privacy slip when making a transaction is forever in the blockchain and you cannot fix it.

For example, if you sent Binance some bitcoin 4 years ago, Binance can share this address with tax employees at anytime. And if you spend that balance with another address, that another one is linked as well.

[Pmalek]

If I ever traded on a centralized exchange, any coins I withdrew to a KYC-linked address would be forwarded to a mixer within the same block.

That address is still linked to you. More precisely, to the person who withdrew the coins. And the same person then sent the coins to a mixer.
You could mix your coins even if your address is verified using AOPP standards. I don't see it being anymore privacy-invasive than a centralized exchange who already knows the name of the person who is making a withdrawal.

It is absolutely crazy that the community as a whole is OK with this kind of insane privacy invasion.

I agree. Unfortunately, it will only get worse. If one country has started using this, more countries will do so in the future. The same goes for centralized exchanges. Whether we like it or not, that's where most of the crypto trading is done. The decentralized alternatives are unfortunately still not on par with centralized ones. Most people don't mind sharing their data for a better exchange rate, a bit of cashback or some similar offers and advantages. Since that's the way it is, that will be the direction this ecosystem will move towards.   

[LoyceV]

What a shame that you accidentally lost a bunch of your paper wallets Loyce! You'll need to be more careful in future. Here's hoping you find them again in 10 or 20 years' time.

I don't think that's going to do much good. For the wealth tax for instance they can go back 5 years, and if funds are abroad they'll go back 12 years. With Bitcoin, I assume they'll argue funds aren't in the country. The tax fine can be up to 300% of the normal tax, plus of course interest.
The best way to avoid taxes is moving to a more tax friendly place, but I'm no where near rich enough for that.

[ChiBitCTy]

https://blog.trezor.io/a-decision-on-aopp-789540c2930b

[bitmover]

https://blog.trezor.io/a-decision-on-aopp-789540c2930b

They changed their mind. But they are contracting themselves.

First they say that they are against regulations such as AOPP.

We underestimated how this feature would be received, and we are against the regulations that concern AOPP. Adopting AOPP was a small step toward improving usability for a portion of our customers with restricted access to bitcoin. It was not a step taken due to any external pressure, regulatory or otherwise, and no similar implementations are planned.

But a few lines later, they say that they discussed that subject for almost a year with no opposition, and they did not expected any 

The question of whether we should support AOPP had been discussed publicly for almost a year with no opposition.
...
Our company operates with maximum transparency and we did not expect this feature to be controversial.

How come you didn't expect any opposition if you are against this kind of regulation in the first place? The opposition should have come from inside.

[Pmalek]

If the "AOPP integration" part it's just going to be an "optional feature" from Trezor's side, I don't see it as a bad thing...

I think this quote from their recent blog post answers your question:

Although this protocol was useful for some of our customers and has no effect on anyone else, it is also in no way essential since it was built on top of an existing tool.

https://blog.trezor.io/a-decision-on-aopp-789540c2930b

They changed their mind. But they are contracting themselves.

Contradicting?

First they say that they are against regulations such as AOPP.
...
But a few lines later, they say that they discussed that subject for almost a year with no opposition, and they did not expected any  
...
How come you didn't expect any opposition if you are against this kind of regulation in the first place? The opposition should have come from inside

I see it as give the people what they want. More precisely, give them what they need if they are from Switzerland. This might be just a PR stunt from Trezor saying we are good guys, and we did it for your benefit. Or it might be true that they introduced it because they thought some people could find it useful, and the rest (those who aren't affected) wouldn't care. Seeing the negative comments that came with the AOPP Integration, they changed their mind.

At the end of their blog post, they state that even after they remove AOPP, everything it does can still be achieved with the Sign & Verify feature.   

[o_e_l_e_o]

I don't think that's going to do much good. For the wealth tax for instance they can go back 5 years, and if funds are abroad they'll go back 12 years.

And they'll tax you on funds you don't longer own, such as bitcoin held by lost wallets or lost private keys? That seems ridiculous.

Or it might be true that they introduced it because they thought some people could find it useful, and the rest (those who aren't affected) wouldn't care.

I'm sure some people would find it useful if they could upload their KYC documents to their Trezor and then just connect up their Trezor every time a new exchange asks for KYC and it sends it all off for them. And some people will find it useful that Ledger are letting them complete KYC to link a crypto debit card directly to their hardware wallet. Doesn't mean these things are good ideas or that they should be introduced simply because some people might benefit. Hardware wallets should not be implementing features (and therefore indicating support for such features) which help to reduce privacy or security.

It's good that they are removing this, but it does reveal some questionable thought processes and direction of the Trezor team.

[funsponge]

I don't think that's going to do much good. For the wealth tax for instance they can go back 5 years, and if funds are abroad they'll go back 12 years.

And they'll tax you on funds you don't longer own, such as bitcoin held by lost wallets or lost private keys? That seems ridiculous.

It would be ridiculous how can they require INCOME tax or CAPITAL GAIN tax on something that you have not earned? It would be theft and not tax. For what reason are hardware wallets which are suppose to the best interest  for peoples security allowing this to happen without any resistance? If they are suppose to be the most secure then privacy is part of security.

I don't think that's going to do much good. For the wealth tax for instance they can go back 5 years, and if funds are abroad they'll go back 12 years.

And they'll tax you on funds you don't longer own, such as bitcoin held by lost wallets or lost private keys? That seems ridiculous.

Or it might be true that they introduced it because they thought some people could find it useful, and the rest (those who aren't affected) wouldn't care.

I'm sure some people would find it useful if they could upload their KYC documents to their Trezor and then just connect up their Trezor every time a new exchange asks for KYC and it sends it all off for them. And some people will find it useful that Ledger are letting them complete KYC to link a crypto debit card directly to their hardware wallet. Doesn't mean these things are good ideas or that they should be introduced simply because some people might benefit. Hardware wallets should not be implementing features (and therefore indicating support for such features) which help to reduce privacy or security.

It's good that they are removing this, but it does reveal some questionable thought processes and direction of the Trezor team.

This always is what happens they convince you that you need these things make them streamlined and then people do not resist! Im tired  of our privacy getting destroyed because without any compensation I think if the companies want to violate my privacy they should be dropping their fees because of it but no they still charge the same amount and and require more intrusive information from me

It's good that they are removing this, but it does reveal some questionable thought processes and direction of the Trezor team.

I lost my faith in them. Are there any others which care about users?

[LoyceV]

And they'll tax you on funds you don't longer own, such as bitcoin held by lost wallets or lost private keys? That seems ridiculous.

No, they'll tax you (retroactively) when you find back your keys after 20 years.

it does reveal some questionable thought processes and direction of the Trezor team.

Isn't it simply about money? They thought they could get more users by adding AOPP, so they did it. Then they realized existing users won't like it, so they removed it again.
Wait until they realize how much they can earn selling IP and address data to chain spying companies!

[PawGo]

it does reveal some questionable thought processes and direction of the Trezor team.

Isn't it simply about money? They thought they could get more users by adding AOPP, so they did it. Then they realized existing users won't like it, so they removed it again.
Wait until they realize how much they can earn selling IP and address data to chain spying companies!

I have a strange feeling that something has changed recently. Maybe some forces has started pushing, maybe some companies decided to change their profile.

And then you see that Proton is not as anonymous as you expected and quietly changes it's privacy policy:
https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/

And then the same story with NordVPN which for years stated that they are zero logs company:
First VPNlab.net is closed (https://www.europol.europa.eu/media-press/newsroom/news/unhappy-new-year-for-cybercriminals-vpnlabnet-goes-offline) and then:
https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests
As

NordVPN operates under the jurisdiction of Panama and will not comply with requests from foreign governments and law enforcement agencies. We are 100% committed to our zero-logs policy – we never log the activities of our users to ensure their ultimate privacy and security.

becames:

NordVPN operates under the jurisdiction of Panama and will only comply with requests from foreign governments and law enforcement agencies if these requests are delivered according to laws and regulations. We are 100% committed to our zero-logs policy – to ensure users’ ultimate privacy and security, we never log their activity unless ordered by a court in an appropriate, legal way.

In other words - you build your brand and then you suddenly change your rules, do 180 turn.

[LoyceV]

And then you see that Proton is not as anonymous as you expected and quietly changes it's privacy policy:
https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/

I've read about that case, and as far as I know Protonmail did exactly as they said in their Terms: they have to follow the law of their country. Being an activist, it's dumb and unnecessary to let your email provider know your IP address. There's a reason Protonmail is available on protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion.

In other words - you build your brand and then you suddenly change your rules, do 180 turn.

What other option than complying with national laws do they have? They're not above the law in their country. All they can do is choose a jurisdiction that matches the level of privacy they want to offer as closely as possible.