BTCPayServer adds CoinJoin plugin, but there's a catch

[witcher_sense]

Great news for those who value their rights to transact privately and protect their financial affairs from prying eyes of undesirable actors. BTCPayServer, free open source software that allows merchants as well as individuals accept bitcoin payments without additional fees or intermediaries, adds a CoinJoin plugin for obfuscation of history of transactions.

What I can say about this news is that it is fascinating to witness how such well-known and widely used services adopt privacy-enhancing technologies  thereby contributing to their development and dissemination among ordinary people. Such additions make people more interested in protecting their privacy, and if it is available out-of-the-box, it is more likely to be used by default. Thus, more people will be making confidential transactions without fuss or muss with the help of convenient tools like that.

Here is the rub, however: they will use Wasabi coordinator as their default coordinator.

According to https://www.nobsbitcoin.com/coinjoin-plugin-btcpay-server/

The main coordinator run by ZKSnacks submits inputs to a chain surveillance firm.

If this is true then we won't achieve nothing with this plugin; if it is used with default coordinator, we just exchange one type of surveillance for another.

I'd like to see the adoption of privacy-protecting techniques but without Wasabi coordinator who only do the opposite and attacks yhe privacy of users instead.

[DaveF]

From the docs it looks like a simple switch to a different coordinator.

From my PoV the other thing is that even though the Wasabi coordinator has gone full monitoring, they do have support.

In theory, it's a it's works or it does not thing.

In reality, we know that there can be dozens of little things that may not work that need to be dealt with now and then deepening on the way someone tweaked their BTCPay server or some other changes they made. Having a 'default' implementation can help troubleshooting.

Beyond that, use a different coordinator.

-Dave

[Yamane_Keto]

Here is the rub, however: they will use Wasabi coordinator as their default coordinator.

When you say default coordinator, it means that there is an option for the user to choose other coordinators, or at least there will be.

The main coordinator run by ZKSnacks submits inputs to a chain surveillance firm.

Are these claims true? How can a privacy-enhancing service provide data to parties trying to reveal identity?

[o_e_l_e_o]

The problem with the statement "choose a different coordinator" is that there are to date, as far as I am aware, no other coordinators to choose from. And sure, you can spin up your own, but if it is only you and one or two other people using it, then the anonymity it provides is easily broken. People who are using Wasabi aren't generally going to bother changing coordinator, because anyone who actually cares about privacy and not having their details fed directly to a blockchain analysis firm isn't using Wasabi in the first place.

Are these claims true? How can a privacy-enhancing service provide data to parties trying to reveal identity?

Because they care about their lining their own pockets more than they care about the privacy of their users.

[Kruw]

The main coordinator run by ZKSnacks submits inputs to a chain surveillance firm.

Are these claims true? How can a privacy-enhancing service provide data to parties trying to reveal identity?

Anyone who actually cares about privacy and not having their details fed directly to a blockchain analysis firm isn't using Wasabi in the first place.

Are these claims true? How can a privacy-enhancing service provide data to parties trying to reveal identity?

Because they care about their lining their own pockets more than they care about the privacy of their users.

Coordinators cannot provide any data to surveillance parties, registration for each input happens over a separate Tor identity.  A coordinator can only refuse to include an input, not identify it.

[o_e_l_e_o]

Coordinators cannot provide any data to surveillance parties, registration for each input happens over a separate Tor identity.  A coordinator can only refuse to include an input, not identify it.

Except zkSNACKs are paying one or more blockchain analysis companies to investigate each input as much as possible and link that input to as much third party data as possible to then tell them whether or not they should censor it.

Your argument can't honestly be "Well, yes we are censoring you, and yes we are working with blockchain analysis to spy on you, but we aren't spying on you too much!"

By paying blockchain analysis firms zkSNACKs, and by extension Wasabi, are directly supporting the notion that some coins are tainted and that bitcoin is non-fungible. This is a direct attack on bitcoin itself.

[o_e_l_e_o]

IIRC Chaincase wallet has it's own coordinator.

I was under the impression that Chaincase never got out of beta and has now been shut down entirely: https://chaincase.app/words/sunset-ios-testflight-beta-export-guide

Additionally that means those company also know owner of that input have plan to use CoinJoin or have interest to protect their privacy.

And that's without even touching on Wasabi's mixing of toxic change with coinjoined outputs, defeating the entire purpose in the first place.

[NotATether]

IIRC Chaincase wallet has it's own coordinator.

I was under the impression that Chaincase never got out of beta and has now been shut down entirely: https://chaincase.app/words/sunset-ios-testflight-beta-export-guide

Thanks for the information. I don't really check Chaincase development since i don't use any iOS device. I guess there aren't any alive alternative coordinator which is based on WabiSabi CJ protocol.

I don't think Chaincase should be focusing on making yet another wallet. They should put all their efforts on their coordinator and then encourage users to connect with existing wallets (for example Sparrow Wallet and Samourai. Possibly even Wasabi minus zksnacks).

The main coordinator run by ZKSnacks submits inputs to a chain surveillance firm.

Are these claims true? How can a privacy-enhancing service provide data to parties trying to reveal identity?

They announced that they would do that. It's yet to be seen whether they'll follow through at the end. But I still would not risk using it.

[o_e_l_e_o]

They announced that they would do that. It's yet to be seen whether they'll follow through at the end. But I still would not risk using it.

They are pretty vocal about the fact they are doing it. One example: https://nitter.net/HillebrandMax/status/1596785852478533632#m

And of course their Terms of Use explain quite clearly what you are signing up for by using Wasabi:

COIN FILTERING

    zkSNACKs Ltd. may execute illicit activity checking and control via a contracted third party solely in its CoinJoin coordination services. zkSNACKs Ltd. may suspend your UTXOs’ access to the CoinJoin services, with immediate effect for any reason - including but not limited to illicit or prohibited activities, applicable sanctions programs, or any crime or money-laundering activity - at its sole discretion and is under no obligation to disclose the details of its decision to take such action with you. In this case you are not permitted to use the relevant/high-risk bitcoin UTXO to reach the CoinJoin services.
    You acknowledge that zkSNACKs Ltd.'s decision to take certain actions, including suspending for any reason at our sole discretion, may be based on confidential criteria that are essential to zkSNACKs Ltd.'s risk management and security protocols. You agree that zkSNACKs Ltd. is under no obligation to disclose the details of its risk management and security procedures to you.
    Your access with the relevant bitcoin UTXOs to the CoinJoin services will be permanently suspended.

Emphasis mine. Sounds just like the terms of a centralized exchange. "We give your data to third parties, and we can do what we want with your coins without telling you why and there is nothing you can do about it".

And don't forget that Wasabi coinjoins are fundamentally broken and the devs either ignore the problem or outright lie about it: https://bitcointalk.org/index.php?topic=5419000.msg61220171#msg61220171

[Kruw]

And that's without even touching on Wasabi's mixing of toxic change with coinjoined outputs, defeating the entire purpose in the first place.

Wasabi does not create toxic change (unless a single input is much bigger than all of the other inputs combined).  See for yourself:  https://mempool.space/tx/01a1a055719129397fb8344b5a09e6cfe72868c8e1d750e621d8b580c96bf77b

[o_e_l_e_o]

Great job ignoring all the other points, as well as providing a single example of a coinjoin while also ignoring the links I provided which show address reuse and toxic change.

Wasabi are pro-censorship and anti-fungibility, and therefore are anti-bitcoin. It is a mistake for BTCPay to implement this. Even if someone manages to get enough volume on a coordinator which doesn't spy on users and directly fund blockchain analysis, then they are still risking address reuse and therefore complete failure of what they are trying to achieve by coinjoining in the first place.

[Wind_FURY]

Bump, found this topic while I was reading about BTCPayServer + CoinJoin. It's probably more relevant today with mixers being banned in the forum after 2023.

The problem with the statement "choose a different coordinator" is that there are to date, as far as I am aware, no other coordinators to choose from. And sure, you can spin up your own, but if it is only you and one or two other people using it, then the anonymity it provides is easily broken.

While that's true, I believe it's not truly a real problem. Because as people become more and more aware that there's an actual need for CoinJoin to gain our privacy back, we'll need more than centralized mixers to get that done.

There should be a large group of people outside of BitcoinTalk that are passionate enough and willing to provide enough liquidity to boot-strap the pool, no?

People who are using Wasabi aren't generally going to bother changing coordinator, because anyone who actually cares about privacy and not having their details fed directly to a blockchain analysis firm isn't using Wasabi in the first place.

Perhaps, but with another coordinator, they'll have a choice between zkSNACKS coordinator, an open coordintor, and a centralized mixer. I believe all three are good depending on what a user needs.

[o_e_l_e_o]

There should be a large group of people outside of BitcoinTalk that are passionate enough and willing to provide enough liquidity to boot-strap the pool, no?

The large group of people outside of Bitcointalk who are interested in coinjoins are predominantly using Samourai/Sparrow/Whirlpool. As I've said 100 times already, even putting the whole mass surveillance thing to one side why would people abandon a better coinjoin implementation in order to bootstrap an inferior one which suffers from address reuse and deterministic links?

[Kruw]

There should be a large group of people outside of BitcoinTalk that are passionate enough and willing to provide enough liquidity to boot-strap the pool, no?

The large group of people outside of Bitcointalk who are interested in coinjoins are predominantly using Samourai/Sparrow/Whirlpool. As I've said 100 times already, even putting the whole mass surveillance thing to one side why would people abandon a better coinjoin implementation in order to bootstrap an inferior one which suffers from address reuse and deterministic links?

Whirlpool coinjoins create deterministic links while WabiSabi coinjoins do not.  WabiSabi is the superior coinjoin implementation since your ENTIRE balance is made private so no two transactions you send or receive can ever be linked together.  With Whirlpool coinjoins, toxic change is created that can be used to track your future transactions:

Post the tx ID of any Whirlpool transaction and I will show you the tx0 transaction that was created by each of the new entrants.

Ok, here's one: https://mempool.space/tx/ed3131b544fbf00a71709942e483b55e629312ecb181e6e819409f419ee0d226

Where exactly is the privacy loss for new entrants, splitting a single UTXO in to multiple UTXOs to join the pool?

Okay, here's all the payments that can be tracked from the two new participants of the Whirlpool coinjoin transaction:

Entrant 1: bc1q03c0443ausjjdxl2h6ud5m8c0dux0zyg3dqdj7 created 0.00170417 BTC in unmixed change sent to bc1q3fduld0l3r8nclyt5p3r7ak675tekurstn55tl.  Since this UTXO is not private, the sats were marked as unspendable and have not been recovered by the wallet owner  

Entrant 2: bc1qzc8zku26ej337huw5dlt390cy2r9kgnq7dhtys created 0.00191247 BTC in unmixed change sent to bc1qjlltxr443uy236wl4xhpxlr6dgsu0zltlv3m44. This UTXO was used in a second tx0 transaction, creating a huge trail of transactions that could be traced to each other  

The 2nd tx0 transaction created 0.00076348 BTC unmixed change which was sent to bc1qehd7gy8rza9mnzm9wnfjhgw82rp47wmqt7vpgy

Since this unmixed change is below the .001 pool minimum, it was consolidated in a 3rd tx0 with 3 other addresses owned by the same wallet:
31x8GPqrhzdaxiBJa9N5UisuoxbX1rAnHa
16Gw5WKjbxZmg1zhZQs19Sf61fbV2xGujx
3LZtsJfUjiV5EZkkG1fwGEpTe2QEa7CNeY

The 3rd tx0 transaction created .00200317 in unmixed change which was sent to bc1q2p7gdtyahct8rdjs2khwf0sffl64qe896ya2y5
This was spent in a 0.00190000 payment to 3B8cRYc3W5jHeS3pkepwDePUmePBoEwyp1 (a reused address)

That payment left .00008553 in change that was tracked to 3Dh7R7xoKMVfLCcAtVDyhJ66se82twyZSn and consolidated with two other inputs in a 4th tx0 transaction:
bc1qeuh6sds8exm54yscrupdk03jxphw8qwzdtxgde
3ByChGBFshzGUE5oip8YYVEZDaCP2bcBmZ

This 4th tx0 created .00533406 in unmixed change which was sent to bc1qzh699s75smwukg9jcanwnlkmkn38r79ataagd9 which was consolidated with 3 more addresses into a 5th tx0:
3F2qiWQJKQjF7XFjEo8FUYP3AU5AC6RqX8
3HAYYVKUpYbr2ARMdZJr9yVu8xi8UcxtPz
3GQtwwRK31wwCc22q6WS5sCgixUHsG5KaT

The 5th tx0 created 0.00058494 BTC in unmixed change that was sent to bc1qvh2zjcwwkj9y70xulla2semvlav3lty0p3l3w3
This was spent in a .00047290 payment to bc1qvzg8jq6wqtr5navn4e3ps4qrkk9r6n4h98gjck

That payment left .00008411 in change that was tracked to bc1qg6j0f0wfhpktt2l8uzdn48ct3um2xyur40eyzd and consolidated with another input into a 6th tx0 transaction:
31iZLXWfoywhuMZTPGxTkpzphzh2NXshpP

The 6th tx0 created .00753775 in unmixed change that was tracked to bc1qgfll2apc27yct6h2c8r8wq4kqhxjsfrudhhn5q
This was spent in a .00737000 payment to bc1q5emzer2t0sq5dez0zsrqgh6scvwn0n24xsladp (a reused address)

This payment left 0.00010896 BTC in change which has not been spent yet, but the payment only took place 11 days ago, so I assume it will eventually be spent, allowing the Whirlpool user to be tracked even further.

Serious privacy projects like Wasabi Wallet, BTCPay Server, and Trezor implemented the WabiSabi coinjoin protocol so none of this tracing is possible.  You can see how Whirlpool completely failed to protect this user's privacy, but since they coinjoined with WabiSabi after they used Whirlpool, they were able to turn themselves fully anonymous:

Instead of enrolling three post-mix inputs as usual the coordinator will now enroll additional post-mix inputs. This makes the coinjoin transactions larger and therefore even harder to break

Why don't they create rounds larger than 5-8 inputs?  zkSNACKs' coordinator creates coinjoins with 150-400 inputs, which provides much greater anonymity per transaction.

These two new inputs are created from an initial transaction called Tx0 which splits the amount of be coinjoined in to the needed denominations to join the chosen pool, along with a few extra sats in to each input to pay the fee for that first coinjoin transaction.

This is an enormous waste of block space and less private compared to skipping tx0 and creating your equal sized denominations directly from the coinjoin transaction itself (like JoinMarket's coinjoins and Wasabi 1.0's ZeroLink implementation).

btw, is there a statistic showing how many coin-join tx whirlpool is running per day? Just curious to see how popular their service has become.

The count of coinjoin transactions is not a good way to measure its popularity since some coinjoin transactions can have more or less inputs/outputs than others and more or less value mixed.  For example, users of the WabiSabi coinjoin protocol mix 3x as much new BTC and remix >10x total BTC compared to Whirlpool despite creating 1/6 of the amount of coinjoin transactions.  This is preferred since it is far more private and block space efficient to create larger sized coinjoins than smaller sized coinjoins.

Regardless of which one you choose, I would spend some time reading about that specific implementation works, how it handles things like toxic change, and the steps you need to take to not mess up and negate the privacy it provides.

Nice dashboard, bookmarked! I might be wrong, but I suppose you're an avid user of coin-join usage. What would be the best method that one could apply to run a coin-join? I suppose using Sparrow Wallet would be the best bet?

Wasabi Wallet, BTCPay Server, or Trezor are your best choices since they support the WabiSabi coinjoin protocol and are prepackaged with Tor enabled by default. Like o_e_l_e_o mentioned, you need to be aware of how toxic change works.  Whirlpool coinjoins create toxic change that can be tracked when it is spent in a future transaction.  WabiSabi coinjoins eliminate toxic change by decomposing your input value into various sized denominations.  Additionally, Whirlpool exposes common input ownership from coins you use in tx0 transactions.  WabiSabi coinjoins also prevent common input ownership association, allowing multiple inputs to be registered privately by a user into a single round.

In terms of privacy to an outside observer, then at the moment it depends on how you use them, but in the future I would say Whirlwind will provide better privacy than Whirlpool. If you coinjoin on Whirlpool, then your privacy is dependent on how many times you let the coins be mixed before you spend them. Assuming 5-input and 5-output coinjoins, then after one mix your backwards looking anonymity set is a maximum of 5. After two mixes, a maximum of 25. After three mixes, a maximum of 125. And so on. I say maximum, because if other people in the coinjoin do something stupid and deanonymize their coins, than that lowers your anonymity set. If you leave your coins in Whirlpool for months and months and end up with 10+ remixes then that's a very good anonymity set, but if you just let them be coinjoined once or twice before you spend them then that's not a very good anonymity set. This same principle applies to any coinjoin implementation. Whirlwind, on the other hand, currently has an anonymity set of 414 as long as you don't deposit huge amounts, and this is only going to grow. In the future, you will be able to get an anonymity set with Whirlwind of 10,000 or more.

Whirlwind scammed their users, what makes you think they didn't also sell their data?

Whirlwind tries to minimize the consequences of this by dividing custody into multiple trustworthy forum members, but it doesn't eliminate it completely, and it's yet to implement this shared custody.

Whirlwind scammed their users, there's no excuse to give up custody of your funds or data.

No, the coins remain under your control in either Samourai (mobile) or Sparrow (desktop), but with the obvious risk that these are hot wallets.

The WabiSabi coinjoin protocol allows you to coinjoin from a hardware wallet.  Trezor already supports this.

The first is the fee to Whirlpool itself, which is a flat fee depending on the pool you are joining.

The flat pool entry fee structure is designed to incentivize worst privacy practices.  Since fees are not collected directly based on volume, it is cheaper to participate in a smaller pool and create more outputs than participate in a larger pool and create less outputs. Additionally, it incentivizes revealing common inputs ownership of premix UTXOs since it is cheaper to consolidate them to enter the pool once than to enter the pool with each UTXO individually.  Samourai has never explained why they purposely chose a fee structure that heavily penalizes the most private usage of their protocol.

Because of this backwards design, you can easily link premix inputs to postmix outputs in many cases.  Notice how this Whirlpool tx0 premix creates 70 outputs for 0.05 BTC - https://mempool.space/tx/63679c9ec82f246811acbab0c04cc0fc77ba050e1b6c23661d78afcfc13cf8aa

Notice how every single input of this Whirlpool exit transaction is a direct descendant of rounds created by the aforementioned premix transaction: https://mempool.space/tx/ce2f84f7c5ff74fb1da103acb7b279bd34f02f5e9e3a2e1b6417ce8b9b7392db

When many inputs used in the postmix exit transaction are created directly from a round that the premix transaction entered, it makes it trivial to trace the user through Whirlpool.  Fortunately, the user abandoned Whirlpool and upgraded to using the WabiSabi coinjoin protocol instead, which made him completely untraceable: https://mempool.space/address/bc1qjjw5gaglkycu2lm5fskl7qhktk0hec4a5me3da

[NotATether]

Whirlpool coinjoins create deterministic links while WabiSabi coinjoins do not.  When you use WabiSabi, your entire balance is made private so no two transactions you send or receive can ever be linked together.  With Whirlpool, toxic change is created that can be used to track your future transactions:

I'm pretty sure the toxic change is set to be handled in some future update:

[o_e_l_e_o]

I'm pretty sure the toxic change is set to be handled in some future update:

I've still got Kruw on ignore for obvious reasons, but I've debunked his nonsense about tracking toxic change many times before: https://bitcointalk.org/index.php?topic=5457560.msg63102560#msg63102560.

[Kruw]

I'm pretty sure the toxic change is set to be handled in some future update:

I've still got Kruw on ignore for obvious reasons, but I've debunked his nonsense about tracking toxic change many times before: https://bitcointalk.org/index.php?topic=5457560.msg63102560#msg63102560.

You didn't debunk anything, YOU ADMITTED WHIRLPOOL CREATES TOXIC CHANGE IN THAT POST:

The post doesn't even demonstrate that. It only demonstrates unmixed change being consolidated with other unmixed change.

WabiSabi coinjoins do not have this flaw of "unmixed change" and doesn't have a flaw that reveals when you consolidate coins together.  You get complete privacy with no leaks.

[Wind_FURY]

There should be a large group of people outside of BitcoinTalk that are passionate enough and willing to provide enough liquidity to boot-strap the pool, no?

The large group of people outside of Bitcointalk who are interested in coinjoins are predominantly using Samourai/Sparrow/Whirlpool.

How large? Because that's actually good because it could show that there's enough user-demand for different implementations of CoinJoin apps.

Plus it's always good for different open source projects to compete against one another, it makes them better. And it also gives the users something to choose from.

As I've said 100 times already, even putting the whole mass surveillance thing to one side why would people abandon a better coinjoin implementation in order to bootstrap an inferior one which suffers from address reuse and deterministic links?

I can't truly verify what's better/worse, but from what I read and hear on the matter, I think it's debatable. Why would Peter Todd, who has a reputation to uphold, say "Scamourai" could be a CIA OP? It's a grave accusation.

[Kruw]

How large? Because that's actually good because it could show that there's enough user-demand for different implementations of CoinJoin apps.

Not nearly as large as the group that has already upgraded to WabiSabi.  ~3x-4x more new volume is coinjoined using the WabiSabi coinjoin protocol compared to the traceable Whirlpool coinjoin protocol, and Whirlpool further splits that tiny amount of liquidity remaining into 4 different pools, fracturing your anonymity set even further.

[Wind_FURY]

How large? Because that's actually good because it could show that there's enough user-demand for different implementations of CoinJoin apps.

Not nearly as large as the group that has already upgraded to WabiSabi.  ~3x-4x more new volume is coinjoined using the WabiSabi coinjoin protocol compared to the traceable Whirlpool coinjoin protocol, and Whirlpool further splits that tiny amount of liquidity remaining into 4 different pools, fracturing your anonymity set even further.

No, I meant in general. How much of the total volume of coins used in mixing went to centralized mixers/tumblers and how much of them went to CoinJoins - Wasabi's implementation, Samourai's, and include JoinMarket/other major implementations. If total volume is going up + the ratio is also going to the side of CoinJoin, then there's probably enough market growth and incentive for centralized mixers to slowly transition their business models to run CoinJoin coordinators?

¯\_(ツ)_/¯