Petition to remove Wasabi from recommendations of bitcoin.org

[Synchronice]

This whole thing is incredibly stupid though. Why should you pay blockchain analysis for the privilege of censoring your own users?

As they claim, in order to ensure the survival of the project, they had to partner with Blockchain Analysis companies, read this: https://blog.wasabiwallet.io/zksnacks-blacklisting-update/
To be honest, I understand this step of theirs but they should be frank with their customers, Wasabi is not a good choice for privacy and it's a lie to pretend it is.

The irony is that nor do their blockchain partners know. Blockchain analysis is a scam. Nearly every action they take when tainting coins is evidently based on inaccurate data. And Wasabi knows about that.

That's the BOLD truth!

How is blacklisting in any way "dishonest"?

Wasabi project started as the "only chance" for Bitcoin to achieve fungibility. The same team is currently implementing blacklisting and providing funding for a company that belongs to a group of companies that likely pose the most significant threat to Bitcoin's future as a currency.

There is no threat for bitcoin, there are only opportunities to improve and become stronger. Bitcoin is not fixed like a statue, we can change code, improve it and implement new features. If there is a support from the community, which will be if there is a threat, we will be able to fork bitcoin and make it more powerful and resistant to threats. I believe, every problem is temporary for bitcoin.

Back on topic here: It is entirely fair to warn people that zkSNACKs are directly funding the enemy.

That's another BOLD truth!

[1714233911]

1714233911

[1714233911]

1714233911

[1714233911]

1714233911

[Kruw]

I would suggest not engaging with Kruw and allowing him to derail yet another thread with his repeatedly debunked copy-and-paste nonsense. I've debunked the same post he has copy and pasted above multiple times over the last several months:

https://bitcointalk.org/index.php?topic=5286821.msg62413682#msg62413682
https://bitcointalk.org/index.php?topic=5465398.msg62800032#msg62800032

Where's this "debunking" you claim to have performed?  In the post you linked above, you admitted these Whirlpool coinjoins all produced unmixed change and input consolidation that could be tracked:

The post doesn't even demonstrate that. It only demonstrates unmixed change being consolidated with other unmixed change.

If this user had upgraded to the WabiSabi coinjoin protocol, this tracing I performed would have never been possible because there would have been no unmixed change produced or common input ownership revealed.

The fact that he continues to post it when it is blatantly false, means either he doesn't understand anything about coinjoins or he knows what he is posting is a complete lie. Either way, he is not interested in discussion and only in pushing his agenda.

I've provided the proof, you can verify it for yourself. You can't hide from deanonymization if you use Whirlpool:

Instead of enrolling three post-mix inputs as usual the coordinator will now enroll additional post-mix inputs. This makes the coinjoin transactions larger and therefore even harder to break

Why don't they create rounds larger than 5-8 inputs?  zkSNACKs' coordinator creates coinjoins with 150-400 inputs, which provides much greater anonymity per transaction.

These two new inputs are created from an initial transaction called Tx0 which splits the amount of be coinjoined in to the needed denominations to join the chosen pool, along with a few extra sats in to each input to pay the fee for that first coinjoin transaction.

This is an enormous waste of block space and less private compared to skipping tx0 and creating your equal sized denominations directly from the coinjoin transaction itself (like JoinMarket's coinjoins and Wasabi 1.0's ZeroLink implementation).

btw, is there a statistic showing how many coin-join tx whirlpool is running per day? Just curious to see how popular their service has become.

The count of coinjoin transactions is not a good way to measure its popularity since some coinjoin transactions can have more or less inputs/outputs than others and more or less value mixed.  For example, users of the WabiSabi coinjoin protocol mix 3x as much new BTC and remix >10x total BTC compared to Whirlpool despite creating 1/6 of the amount of coinjoin transactions.  This is preferred since it is far more private and block space efficient to create larger sized coinjoins than smaller sized coinjoins.

Regardless of which one you choose, I would spend some time reading about that specific implementation works, how it handles things like toxic change, and the steps you need to take to not mess up and negate the privacy it provides.

Nice dashboard, bookmarked! I might be wrong, but I suppose you're an avid user of coin-join usage. What would be the best method that one could apply to run a coin-join? I suppose using Sparrow Wallet would be the best bet?

Wasabi Wallet, BTCPay Server, or Trezor are your best choices since they support the WabiSabi coinjoin protocol and are prepackaged with Tor enabled by default. Like o_e_l_e_o mentioned, you need to be aware of how toxic change works.  Whirlpool coinjoins create toxic change that can be tracked when it is spent in a future transaction.  WabiSabi coinjoins eliminate toxic change by decomposing your input value into various sized denominations.  Additionally, Whirlpool exposes common input ownership from coins you use in tx0 transactions.  WabiSabi coinjoins also prevent common input ownership association, allowing multiple inputs to be registered privately by a user into a single round.

In terms of privacy to an outside observer, then at the moment it depends on how you use them, but in the future I would say Whirlwind will provide better privacy than Whirlpool. If you coinjoin on Whirlpool, then your privacy is dependent on how many times you let the coins be mixed before you spend them. Assuming 5-input and 5-output coinjoins, then after one mix your backwards looking anonymity set is a maximum of 5. After two mixes, a maximum of 25. After three mixes, a maximum of 125. And so on. I say maximum, because if other people in the coinjoin do something stupid and deanonymize their coins, than that lowers your anonymity set. If you leave your coins in Whirlpool for months and months and end up with 10+ remixes then that's a very good anonymity set, but if you just let them be coinjoined once or twice before you spend them then that's not a very good anonymity set. This same principle applies to any coinjoin implementation. Whirlwind, on the other hand, currently has an anonymity set of 414 as long as you don't deposit huge amounts, and this is only going to grow. In the future, you will be able to get an anonymity set with Whirlwind of 10,000 or more.

Whirlwind scammed their users, what makes you think they didn't also sell their data?

Whirlwind tries to minimize the consequences of this by dividing custody into multiple trustworthy forum members, but it doesn't eliminate it completely, and it's yet to implement this shared custody.

Whirlwind scammed their users, there's no excuse to give up custody of your funds or data.

No, the coins remain under your control in either Samourai (mobile) or Sparrow (desktop), but with the obvious risk that these are hot wallets.

The WabiSabi coinjoin protocol allows you to coinjoin from a hardware wallet.  Trezor already supports this.

The first is the fee to Whirlpool itself, which is a flat fee depending on the pool you are joining.

The flat pool entry fee structure is designed to incentivize worst privacy practices.  Since fees are not collected directly based on volume, it is cheaper to participate in a smaller pool and create more outputs than participate in a larger pool and create less outputs. Additionally, it incentivizes revealing common inputs ownership of premix UTXOs since it is cheaper to consolidate them to enter the pool once than to enter the pool with each UTXO individually.  Samourai has never explained why they purposely chose a fee structure that heavily penalizes the most private usage of their protocol.

Because of this backwards design, you can easily link premix inputs to postmix outputs in many cases.  Notice how this Whirlpool tx0 premix creates 70 outputs for 0.05 BTC - https://mempool.space/tx/63679c9ec82f246811acbab0c04cc0fc77ba050e1b6c23661d78afcfc13cf8aa

Notice how every single input of this Whirlpool exit transaction is a direct descendant of rounds created by the aforementioned premix transaction: https://mempool.space/tx/ce2f84f7c5ff74fb1da103acb7b279bd34f02f5e9e3a2e1b6417ce8b9b7392db

When many inputs used in the postmix exit transaction are created directly from a round that the premix transaction entered, it makes it trivial to trace the user through Whirlpool.  Fortunately, the user abandoned Whirlpool and upgraded to using the WabiSabi coinjoin protocol instead, which made him completely untraceable: https://mempool.space/address/bc1qjjw5gaglkycu2lm5fskl7qhktk0hec4a5me3da

Anyone who wants to see the truth about Wasabi coinjoins being demixed, Wasabi doxxing their competitors, and Wasabi funding mass surveillance, can simply read the Wasabi thread. Any time he copies and pastes the same old nonsense again, just reply with a link to this post.

The Wasabi thread proves that WHIRLPOOL coinjoins can be demixed, not WabiSabi coinjoins.  Stop confusing the traceable Whirlpool coinjoin protocol used by Samourai Wallet and Sparrow Wallet with the untraceable WabiSabi coinjoin protocol used by Wasabi Wallet, BTCPay Server, and Trezor.

Wasabi is not a good choice for privacy and it's a lie to pretend it is.

Wasabi is completely private: It protects your IP from being leaked with Tor, it prevents your xpub address from being leaked with block filters, and it protects your addresses from being linked together on chain with coinjoin.

[Pmalek]

I would suggest not engaging with Kruw and allowing him to derail yet another thread with his repeatedly debunked copy-and-paste nonsense.

He is not going to get tired of sweeping the problems under the carpet and taking the attention away from those problems to other Wasabi features or explaining how other competitors are much worse, so please don't get tired of pointing out how full of shit he is. If you do, only his views and comments will remain and be taken as the truth because no one is contradicting them.

[Kruw]

He is not going to get tired of sweeping the problems under the carpet and taking the attention away from those problems to other Wasabi features or explaining how other competitors are much worse, so please don't get tired of pointing out how full of shit he is. If you do, only his views and comments will remain and be taken as the truth because no one is contradicting them.

No one is contradicting my claims because they are true.  That's why everyone just responds with sarcasm because they can't actually prove my claims to be untrue.

[BlackHatCoiner]

I've had him on ignore for months; I suggest everyone else does the same

I rarely put someone on ignore, but my patience has its limits. We have shown him evidence of Wasabi being flawed so many times that it has become tiresome. Every single time he ignores it and blames his competitors.

He's welcomed in my ignored list, but I suggest everyone to keep a gentle warning when encountering a wasabi shill in a random thread. Newbies should be informed about both sides of this drama, and make an informed decision based on compelling arguments.

[Synchronice]

Wasabi is not a good choice for privacy and it's a lie to pretend it is.

Wasabi is completely private: It protects your IP from being leaked with Tor, it prevents your xpub address from being leaked with block filters, and it protects your addresses from being linked together on chain with coinjoin.

I would love to take your side but I just can't. A company, that focuses on privacy, funds blockchain analyses company that focuses on destroying privacy. I would still close my eyes and say that's okay if blockchain analysis companies could really filter transactions well and would only block transactions involved in illegal activities but BA companies are a complete failure, they don't work as intended and to be honest, they are bullshit. Then, I think for a minute and understand that we are here because of privacy and that is the fundamental of bitcoin, so, there is a big no again to BAs.

[Kruw]

We have shown him evidence of Wasabi being flawed so many times that it has become tiresome.

You don't have any evidence Wasabi is flawed.  You are bluffing.

[Pmalek]

You don't have any evidence Wasabi is flawed.  You are bluffing.

Synchronice, the person who posted just before you and whose post you didn't comment on, offered a good explanation of why Wasabi together with your main coordinator (which is Wasabi all over again) is flawed. You are a supposed bitcoin privacy tool that funds a blockchain analysis company whose objective is to remove privacy. It's the equivalent of fighting against illegal drug trafficking, but holding regular business meetings with Mexican drug kings. They are interested in getting rid of the drugs as much as your blockchain analysis company is interested in helping people maintain their privacy.       

[Kruw]

Synchronice, the person who posted just before you and whose post you didn't comment on, offered a good explanation of why Wasabi together with your main coordinator (which is Wasabi all over again) is flawed. You are a supposed bitcoin privacy tool that funds a blockchain analysis company whose objective is to remove privacy. It's the equivalent of fighting against illegal drug trafficking, but holding regular business meetings with Mexican drug kings. They are interested in getting rid of the drugs as much as your blockchain analysis company is interested in helping people maintain their privacy.      

Would you call Nostr "flawed" if a relay doesn't store your notes?  Would you call Lightning "flawed" if a node doesn't accept your channel? If you think there's a "flaw" in Wasabi because another coordinator won't accept your coins, then why don't you run your own coordinator?  All the code is open source, you just don't seem to care enough about privacy to run it

Are you going to go back to suggesting that we can run our own coordinators if we don't agree to what zkSNACKS is doing?

Open source solves your problem which is why I keep suggesting it.  If your notes were censored by a Nostr relay, then I would tell you the same thing:  Run your own relay.  Your obsession about the reasons why some other Nostr relay isn't storing your notes is no longer your problem and not really interesting in the first place.  I do the same thing when opening Lightning channels:  Attempt a new peer if I am rejected by my first choice.  I don't open a petition against Lightning software development companies because they don't want to accept my channel, I can use simply use their software to connect to any node.

[Pmalek]

If you think there's a "flaw" in Wasabi because another coordinator won't accept your coins, then why don't you run your own coordinator?  All the code is open source...

Ah, yes, the good old you should run your own coordinator trick. You haven't used that in a while, I almost forgot that it's on your list. I wouldn't run my own coordinator for the reasons mentioned to you every time you brought it up in this and the other discussions you are active in. Remember, you have mentioned it at least 15-20 times? To be fair, we don't hear it as often as we are open-source, mixers are a scam, or the many variants of look at how flawed these other implementations are.

To sum up. You, the prophet of Bitcoin's ultimate privacy tool, suggests not using the software together with the default coordinator, the coordinator that Wasabi runs, making Wasabi and zkSNACKS the same. And because it's such a good privacy tool, it should be avoided and people should move away from zkSNACKS, Wasabi's main coordinator. If that isn't excellent advertising for your company, I don't know what is.   

[Kruw]

Ah, yes, the good old you should run your own coordinator trick. You haven't used that in a while, I almost forgot that it's on your list. I wouldn't run my own coordinator for the reasons mentioned to you every time you brought it up in this and the other discussions you are active in. Remember, you have mentioned it at least 15-20 times? To be fair, we don't hear it as often as we are open-source, mixers are a scam, or the many variants of look at how flawed these other implementations are.

To sum up. You, the prophet of Bitcoin's ultimate privacy tool, suggests not using the software together with the default coordinator, the coordinator that Wasabi runs, making Wasabi and zkSNACKS the same. And because it's such a good privacy tool, it should be avoided and people should move away from zkSNACKS, Wasabi's main coordinator. If that isn't excellent advertising for your company, I don't know what is.  

What are "the reasons mentioned to me every time I brought it up"?  You never responded at all when I told you to run your own coordinator, remember? 

Many users, me included, don't consider Wasabi a privacy tool anymore because your default and most popular Wasabi coordinator allows a malicious entity (blockchain analysis company) to tag UTXOs and put them in different categories based on their level of naughty.

Wasabi does not stop being privacy software just because a business does not want to accept your money.  You can use any coordinator with Wasabi, including your own.  The signers of this petition can simply coordinate coinjoins among themselves since they are all united in their decision not to use the default coordinator, and no one could stop you:

Peter Todd crushing the critics:  "I can do my own Wasabi coinjoin coordinator... If someone's complaining about this, go start your own damn coordinator."

https://youtu.be/oPNFdhZUGmk?t=297

You didn't respond to me and Peter Todd with any reasons why you aren't running your own coordinator because there obviously aren't any reasons not to run your own coordinator.  Wasabi is free and open source software.

[Pmalek]

<Snip>

Stop acting stupid. You are not, so it doesn't suit you. Do a CTRL + F + "your own coordinator" or better yet, just "coordinator" and read through the responses of users when you brought it up. Not only in this thread, but all the others where you have been actively advertising Wasabi. I hope your next question won't be where else have I been writing about Wasabi?

If Wasabi with zkSNACKS was such an unbelievable privacy tool, you wouldn't have to suggest that people run their own coordinators. An excellent privacy tool wouldn't need people to make such changes to it. The reason they should is because you are asking the enemy of everything that bitcoin is if this person deserves coinjoins or not. And no, it's got nothing to do with your open-source wallet, since you won't forget to mention that either. 

[Kruw]

<Snip>

Stop acting stupid. You are not, so it doesn't suit you. Do a CTRL + F + "your own coordinator" or better yet, just "coordinator" and read through the responses of users when you brought it up. Not only in this thread, but all the others where you have been actively advertising Wasabi. I hope your next question won't be where else have I been writing about Wasabi?

I am not being rhetorical, stop dodging the question over and over and over:  WHY DON'T YOU RUN YOUR OWN COORDINATOR?  

Anyone petitioning in this thread at any point could have single-handedly circumvented all bans applied by zkSNACKs with the click of a button. Since you have the opportunity to directly solve the problem you claim exists, why don't you do it? The reason you never came up with any explanation as to why you aren't coordinating coinjoins is because you want the problem more than you want the solution. Stop virtue signalling and run the code.  It's free and open source, no one can stop you.

[o_e_l_e_o]

The reason you never came up with any explanation

Except the dozens of times I've explained this to you over the last six months:

Still, why would I go through the effort of setting up a coordinator, having zero volume, trying to entice people to my coordinator, all so I can run inferior coinjoins with suffer from address reuse and identifiable outputs, when I can just run JoinMarket instead?

Because as I've shown above, the Wasabi wallet software itself is deeply flawed and reuses addresses on both sides of coinjoin transactions. Why fork flawed software in order to launch your own coordinator to bypass the anti-fungibility and anti-privacy ethos of Wasabi/zkSNACKs, when I can just use JoinMarket or Samourai with my own node which avoid all these issues in the first place.

And why would anyone waste time launching such a coordinator on software which links mixed outputs with toxic unmixed change outputs?

And sure, you can spin up your own, but if it is only you and one or two other people using it, then the anonymity it provides is easily broken. People who are using Wasabi aren't generally going to bother changing coordinator, because anyone who actually cares about privacy and not having their details fed directly to a blockchain analysis firm isn't using Wasabi in the first place.

Because, as I've given you evidence of at least a dozen times and you have completely ignored at least a dozen times, Wasabi coinjoins are deeply flawed and result in outputs being linked to inputs due to various factors such as UTXO sizes and address reuse. Why would I want to run an inferior coinjoin coordinator when I can just use a much superior product such as JoinMarket or Whirlpool?

As I've mentioned before, why would anyone waste their time, money, and resources to set up their own coordinator, spend weeks or months advertising it and enticing people to use it, all so they can run flawed coinjoins, when they can just set up and use JoinMarket in a fraction of the time.

Running your own coordinator is outside the skill set of 99.9% of users and you know it, so maybe ease off on repeating that stupid soundbite.

But you know, keep proving my point that you are not here to learn or discuss in any capacity, and are only here to copy and paste endlessly debunked and utterly moronic soundbites at the behest of your puppet masters.

[Kruw]

The reason you never came up with any explanation

Except the dozens of times I've explained this to you over the last six months:

Still, why would I go through the effort of setting up a coordinator, having zero volume, trying to entice people to my coordinator, all so I can run inferior coinjoins with suffer from address reuse and identifiable outputs, when I can just run JoinMarket instead?

When you were challenged to prove your claim that Wasabi's coinjoins were inferior and created "identifiable outputs", you were exposed as a liar because you failed to trace anything at all:

How are JoinMarket coinjoins superior to WabiSabi coinjoins?

You mean apart from the address reuse and the identifiable outputs? Probably something to do with them not being run by a company which supports mass surveillance of all their users.

I already proved you were lying about being able identify the outputs of a WabiSabi coinjoin, remember?

You don't need to be a "whale" at all in order to receive absolutely zero privacy from a Wasabi coinjoin.

You are just posting nonsense trying to distract from the fact I proved you wrong by posting a non whale non matching output that you were not able to trace: bc1qrmmypw3g2ds4aqgh3nqc59qhdp9qk779x2zlru

So your argument boils down to "I can show you some examples which cannot be deanonymized, therefore all your examples of Wasabi coinjoins failing spectacularly are moot". Seriously?

Hey guys, only 5% of our cars randomly explode and kill the driver, so they are perfectly safe!

Okay then, I'll call your bluff again- Here's 20 non whale non matching outputs from WabiSabi coinjoins, try to identify the inputs owned by even a single one of the 20 outputs (which would be 5%):

01 bc1q032caguldmlrrztmrwhv5wqveyywdu2rtmd740
02 bc1q6vgwhsfkg343mmh27vc6prg3clsd4xu3p68vyd
03 bc1qre8jjpu8p9taw8j44r39z56vfr4sw64d4wyaj4
04 bc1qarharg76gfcrvskfw46f67vtqzd6hxa9pnspp5
05 bc1q4sexgt2p96x3ytnjjttp59w6mkj00kedal3xze
06 bc1qwrf50wpjws5mhdg2rhdu5hy7nqdtl8z94lp75n
07 bc1qz0tal2udfpr20x793fdw6v8lzp2qze7z5zje64
08 bc1qqw2h7fa3n8vyxgqru664fmft2trl9sqh9kz3fp
09 bc1qsud748whmum4gpt2qu52z8gqlgzcjyvhd5w2a5
10 bc1qctvxddyvxupjj8w82m8w5grzn59arstlrnaauw
11 bc1qq2fl05cmmhkr3pzg8elyr859v2fpcltynrk2j5
12 bc1qvwkrd3aecrvql5j8mqkmketvw6g6qwzt4juprq
13 bc1qhc2565fac4lrgyfq6n0mzc0l86jeptfnv2um9x
14 bc1qat6445gutyl3qdz3zhmdng9cdt92mevjlvaljs
15 bc1qk5f3mz0fetccey4nyyjedlrmqstkz2hmun96ha
16 bc1q4tpvm378a9d4n0xcnjtwfwujtr8eatjzvru8dx
17 bc1qd5epyjpj6vuejdppj24wew5n4n5rzepjx2xnay
18 bc1qgafud63me5mffn00g90ch08jjn5h20umzwxd62
19 bc1q5u3f2ldrtqa7ea79a8hcd8kssgw2gmalk4uej9
20 bc1qa6n7g7r4j3nv78gzgzmuvg56em4guppckqpz7r

[Pmalek]

WHY DON'T YOU RUN YOUR OWN COORDINATOR?

And do what, participate in coinjoins with myself? My coordinator would need to be used by other people. It needs traffic and liquidity to make sense and justify its existence. It doesn't do me or anyone any good to have this coordinator if the majority is stuck and using your flawed one. You know, the open-source one that funds a blockchain analysis company, remember?

[Kruw]

And do what, participate in coinjoins with myself? My coordinator would need to be used by other people. It needs traffic and liquidity to make sense and justify its existence. It doesn't do me or anyone any good to have this coordinator if the majority is stuck and using your flawed one. You know, the open-source one that funds a blockchain analysis company, remember?

You don't create coinjoins with yourself, other people can use your coordinator.  People are not stuck using the zkSNACKs coordinator.

[BlackHatCoiner]

o_e_l_e_o - Wasabi coinjoins are flawed.
Kruw - Show me the evidence.
o_e_l_e_o - Here's a bunch of flawed coinjoins.
Kruw - Bu-bu-but, here's a coinjoin which you cannot de-anonymize.

Extreme reasoning there. Wasabi team must be proud of you. Lol, I am now starting to get why Samourai puts their "competitor" in quotation marks every time.

[Kruw]

o_e_l_e_o - Wasabi coinjoins are flawed.
Kruw - Show me the evidence.
o_e_l_e_o - Here's a bunch of flawed coinjoins.
Kruw - Bu-bu-but, here's a coinjoin which you cannot de-anonymize.

Extreme reasoning there. Wasabi team must be proud of you. Lol, I now starting to get why Samourai puts their "competitor" in quotation marks every time.

Where are the flawed coinjoins?  Still waiting for evidence.  o_e_l_e_o never produced any. You never produced any.  You both got caught bluffing.

This is what proof of tracing a coinjoin looks like, you can see how I linked multiple addresses together from Whirlpool:

Instead of enrolling three post-mix inputs as usual the coordinator will now enroll additional post-mix inputs. This makes the coinjoin transactions larger and therefore even harder to break

Why don't they create rounds larger than 5-8 inputs?  zkSNACKs' coordinator creates coinjoins with 150-400 inputs, which provides much greater anonymity per transaction.

These two new inputs are created from an initial transaction called Tx0 which splits the amount of be coinjoined in to the needed denominations to join the chosen pool, along with a few extra sats in to each input to pay the fee for that first coinjoin transaction.

This is an enormous waste of block space and less private compared to skipping tx0 and creating your equal sized denominations directly from the coinjoin transaction itself (like JoinMarket's coinjoins and Wasabi 1.0's ZeroLink implementation).

btw, is there a statistic showing how many coin-join tx whirlpool is running per day? Just curious to see how popular their service has become.

The count of coinjoin transactions is not a good way to measure its popularity since some coinjoin transactions can have more or less inputs/outputs than others and more or less value mixed.  For example, users of the WabiSabi coinjoin protocol mix 3x as much new BTC and remix >10x total BTC compared to Whirlpool despite creating 1/6 of the amount of coinjoin transactions.  This is preferred since it is far more private and block space efficient to create larger sized coinjoins than smaller sized coinjoins.

Regardless of which one you choose, I would spend some time reading about that specific implementation works, how it handles things like toxic change, and the steps you need to take to not mess up and negate the privacy it provides.

Nice dashboard, bookmarked! I might be wrong, but I suppose you're an avid user of coin-join usage. What would be the best method that one could apply to run a coin-join? I suppose using Sparrow Wallet would be the best bet?

Wasabi Wallet, BTCPay Server, or Trezor are your best choices since they support the WabiSabi coinjoin protocol and are prepackaged with Tor enabled by default. Like o_e_l_e_o mentioned, you need to be aware of how toxic change works.  Whirlpool coinjoins create toxic change that can be tracked when it is spent in a future transaction.  WabiSabi coinjoins eliminate toxic change by decomposing your input value into various sized denominations.  Additionally, Whirlpool exposes common input ownership from coins you use in tx0 transactions.  WabiSabi coinjoins also prevent common input ownership association, allowing multiple inputs to be registered privately by a user into a single round.

In terms of privacy to an outside observer, then at the moment it depends on how you use them, but in the future I would say Whirlwind will provide better privacy than Whirlpool. If you coinjoin on Whirlpool, then your privacy is dependent on how many times you let the coins be mixed before you spend them. Assuming 5-input and 5-output coinjoins, then after one mix your backwards looking anonymity set is a maximum of 5. After two mixes, a maximum of 25. After three mixes, a maximum of 125. And so on. I say maximum, because if other people in the coinjoin do something stupid and deanonymize their coins, than that lowers your anonymity set. If you leave your coins in Whirlpool for months and months and end up with 10+ remixes then that's a very good anonymity set, but if you just let them be coinjoined once or twice before you spend them then that's not a very good anonymity set. This same principle applies to any coinjoin implementation. Whirlwind, on the other hand, currently has an anonymity set of 414 as long as you don't deposit huge amounts, and this is only going to grow. In the future, you will be able to get an anonymity set with Whirlwind of 10,000 or more.

Whirlwind scammed their users, what makes you think they didn't also sell their data?

Whirlwind tries to minimize the consequences of this by dividing custody into multiple trustworthy forum members, but it doesn't eliminate it completely, and it's yet to implement this shared custody.

Whirlwind scammed their users, there's no excuse to give up custody of your funds or data.

No, the coins remain under your control in either Samourai (mobile) or Sparrow (desktop), but with the obvious risk that these are hot wallets.

The WabiSabi coinjoin protocol allows you to coinjoin from a hardware wallet.  Trezor already supports this.

The first is the fee to Whirlpool itself, which is a flat fee depending on the pool you are joining.

The flat pool entry fee structure is designed to incentivize worst privacy practices.  Since fees are not collected directly based on volume, it is cheaper to participate in a smaller pool and create more outputs than participate in a larger pool and create less outputs. Additionally, it incentivizes revealing common inputs ownership of premix UTXOs since it is cheaper to consolidate them to enter the pool once than to enter the pool with each UTXO individually.  Samourai has never explained why they purposely chose a fee structure that heavily penalizes the most private usage of their protocol.

Because of this backwards design, you can easily link premix inputs to postmix outputs in many cases.  Notice how this Whirlpool tx0 premix creates 70 outputs for 0.05 BTC - https://mempool.space/tx/63679c9ec82f246811acbab0c04cc0fc77ba050e1b6c23661d78afcfc13cf8aa

Notice how every single input of this Whirlpool exit transaction is a direct descendant of rounds created by the aforementioned premix transaction: https://mempool.space/tx/ce2f84f7c5ff74fb1da103acb7b279bd34f02f5e9e3a2e1b6417ce8b9b7392db

When many inputs used in the postmix exit transaction are created directly from a round that the premix transaction entered, it makes it trivial to trace the user through Whirlpool.  Fortunately, the user abandoned Whirlpool and upgraded to using the WabiSabi coinjoin protocol instead, which made him completely untraceable: https://mempool.space/address/bc1qjjw5gaglkycu2lm5fskl7qhktk0hec4a5me3da

Post the tx ID of any Whirlpool transaction and I will show you the tx0 transaction that was created by each of the new entrants.

Ok, here's one: https://mempool.space/tx/ed3131b544fbf00a71709942e483b55e629312ecb181e6e819409f419ee0d226

Where exactly is the privacy loss for new entrants, splitting a single UTXO in to multiple UTXOs to join the pool?

Okay, here's all the payments that can be tracked from the two new participants of the Whirlpool coinjoin transaction:

Entrant 1: bc1q03c0443ausjjdxl2h6ud5m8c0dux0zyg3dqdj7 created 0.00170417 BTC in unmixed change sent to bc1q3fduld0l3r8nclyt5p3r7ak675tekurstn55tl.  Since this UTXO is not private, the sats were marked as unspendable and have not been recovered by the wallet owner  

Entrant 2: bc1qzc8zku26ej337huw5dlt390cy2r9kgnq7dhtys created 0.00191247 BTC in unmixed change sent to bc1qjlltxr443uy236wl4xhpxlr6dgsu0zltlv3m44. This UTXO was used in a second tx0 transaction, creating a huge trail of transactions that could be traced to each other  

The 2nd tx0 transaction created 0.00076348 BTC unmixed change which was sent to bc1qehd7gy8rza9mnzm9wnfjhgw82rp47wmqt7vpgy

Since this unmixed change is below the .001 pool minimum, it was consolidated in a 3rd tx0 with 3 other addresses owned by the same wallet:
31x8GPqrhzdaxiBJa9N5UisuoxbX1rAnHa
16Gw5WKjbxZmg1zhZQs19Sf61fbV2xGujx
3LZtsJfUjiV5EZkkG1fwGEpTe2QEa7CNeY

The 3rd tx0 transaction created .00200317 in unmixed change which was sent to bc1q2p7gdtyahct8rdjs2khwf0sffl64qe896ya2y5
This was spent in a 0.00190000 payment to 3B8cRYc3W5jHeS3pkepwDePUmePBoEwyp1 (a reused address)

That payment left .00008553 in change that was tracked to 3Dh7R7xoKMVfLCcAtVDyhJ66se82twyZSn and consolidated with two other inputs in a 4th tx0 transaction:
bc1qeuh6sds8exm54yscrupdk03jxphw8qwzdtxgde
3ByChGBFshzGUE5oip8YYVEZDaCP2bcBmZ

This 4th tx0 created .00533406 in unmixed change which was sent to bc1qzh699s75smwukg9jcanwnlkmkn38r79ataagd9 which was consolidated with 3 more addresses into a 5th tx0:
3F2qiWQJKQjF7XFjEo8FUYP3AU5AC6RqX8
3HAYYVKUpYbr2ARMdZJr9yVu8xi8UcxtPz
3GQtwwRK31wwCc22q6WS5sCgixUHsG5KaT

The 5th tx0 created 0.00058494 BTC in unmixed change that was sent to bc1qvh2zjcwwkj9y70xulla2semvlav3lty0p3l3w3
This was spent in a .00047290 payment to bc1qvzg8jq6wqtr5navn4e3ps4qrkk9r6n4h98gjck

That payment left .00008411 in change that was tracked to bc1qg6j0f0wfhpktt2l8uzdn48ct3um2xyur40eyzd and consolidated with another input into a 6th tx0 transaction:
31iZLXWfoywhuMZTPGxTkpzphzh2NXshpP

The 6th tx0 created .00753775 in unmixed change that was tracked to bc1qgfll2apc27yct6h2c8r8wq4kqhxjsfrudhhn5q
This was spent in a .00737000 payment to bc1q5emzer2t0sq5dez0zsrqgh6scvwn0n24xsladp (a reused address)

This payment left 0.00010896 BTC in change which has not been spent yet, but the payment only took place 11 days ago, so I assume it will eventually be spent, allowing the Whirlpool user to be tracked even further.

When you use WabiSabi coinjoins, your addresses are not linked together.  You gain full privacy for every payment with no leftovers.

[BlackHatCoiner]

Where are the flawed coinjoins?  Still waiting for evidence.  o_e_l_e_o never produced any.

Wasabi coinjoins creating outputs which can be 100% linked to a specific input: https://mempool.space/tx/dae13b2d015587a3033d7ab7949a7efa6d6ed7aa782168b0651ab37a2d8390f8
Wasabi coinjoins reusing addresses, leading to users being doxxed: https://nitter.it/ErgoBTC/status/1585671294783311872
Wasabi coinjoins using the same address on both sides of a transaction: https://mempool.space/tx/af50a27691c0f0b7b626cddb74445a0e26bb6ed7b045861067326ea173bc17d0 (address bc1qft2uze947wtdvvhdqtx00c8el954y6ekxjk73h)