Wasabi Wallet - Total Privacy For Bitcoin

[Wind_FURY]

Plus it's probably better to add a layer of privacy by first sending those outputs you want CoinJoined to yourself through the Lightning Network, no?

That's one way of doing it. You can also opt to go the Monero way and avoid coinjoining altogether. If you have someone interested in swapping their monero for your bitcoin or a service that you don't deem to expensive, you can make that swap.

Move that monero around a bit and exchange it back to bitcoin and into a wallet and address not connected to your identity.

I read a post about an update in BISQ, that the developers will add a feature for Atomic Swaps from Bitcoin to Monero, then Monero to Bitcoin. That's going to be very convenient, especially for users who don't want to use centralized services where they could leak information.

But sending a transaction to yourself through the Lightning Network might still be necessary. Your wallet could also be given a "negative rating" by exchanges and other fiat on and off-ramps if you're using BISQ.

[Breukelen]

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

[Kruw]

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

What are you going to do when the government makes Bitcoin illegal? I'm not saying you should embrace Monero, I'm asking how your strategy works in general.

[Breukelen]

What are you going to do when the government makes Bitcoin illegal? I'm not saying you should embrace Monero, I'm asking how your strategy works in general.

Call me naive but I don't expect the government to make Bitcoin illegal. They had their shot to do that but now with the introduction of institutional investors there is why too much pressure to incorporate Bitcoin in the traditional financial pillars. Even where Bitcoin is outlawed I couldn't point to a ban that has been effective. Just pushed users to take a more world view of their holdings.

That said government likes to take their cut from the traditional financial pillars. That is something that needs to be considered as Bitcoin becomes folded in. No one wants governments asking for a handout from 21st century investment strategies. 

[Kruw]

Call me naive but I don't expect the government to make Bitcoin illegal.

Call me a pessimist, but the government made gold illegal.

[Breukelen]

Call me a pessimist, but the government made gold illegal.

Give it time and maybe like Gold bars you will be able to buy Bitcoin at Costco.

[JollyGood]

Call me naive but I don't expect the government to make Bitcoin illegal. 

That is my initial sentiment too however there is a possibility anything (literally anything) could happen when it comes to governments and law (as well as corrupt governments and unfair laws). When you add various anti-crypto traditional financial lobbying groups to the equation then the matter looks bleak but Bitcoin and crypto have survived thus far. Who knows what will happen in the future.

Call me a pessimist, but the government made gold illegal.

I think that was classed as a specific event/special case when the markets collapsed but it still did not justify their actions. In theory they could they do it with Bitcoin but it is highly unlikely as far too many people have invested in crypto.

[Wind_FURY]

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

What are you going to do when the government makes Bitcoin illegal? I'm not saying you should embrace Monero, I'm asking how your strategy works in general.

Philosophically, and if we start considering the technical design and design-decisions made behind Bitcoin, should that actually matter? Because what use would decentralization and censorship-resistance have if a group of old men could simply sign a piece of paper to stop the network?

But as a practical matter, I believe CoinJoin and the Lightning Network - as a layer to hide that you actually used an application to CoinJoin, are needed as a general strategy to disconnect the individual's real identity from his Bitcoins.

[owlcatz]

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

There is absolutely nothing illegal about running a monero node - otherwise we'd have heard more news about such.

https://monero.fail/

[Wind_FURY]

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

There is absolutely nothing illegal about running a monero node - otherwise we'd have heard more news about such.

https://monero.fail/

I believe he was merely talking about making transactions in the Monero blockchain, not actually "using" Monero by running his/her own full node and actually doing everything in the network through that node.

Plus about making it "illegal" to run your own node, I believe that in any part of the world, no nation-state has the legal infrastructure to make it "illegal".

[Kruw]

I plan to create updated video guides for Wasabi, the first one will be on how to use the RPC to make payments directly within coinjoins. If anyone has requests or suggestions for video guides, let me know.

[Kruw]

Wasabi v2.3.1 is out: https://github.com/WalletWasabi/WalletWasabi/releases/tag/v2.3.1

This version is a stability release packed with bug fixes and preparatory changes for upcoming features.

- Bug Fixes
- Settings Layout
- Tor upgraded to v13.5.9
- Buy Anything Button Disabled

[Pmalek]

Wasabi Wallet versions 2.2.1.0 and below are vulnerable to a deanonymization vulnerability in the WabiSabi coinjoin protocol. This vulnerability allows malicious coordinators to deanonymize users and link inputs and outputs.

The vulnerability may or may not have been fixed. Kruw will always tell you how Wasabi is open-source and how you can always inspect the code yourself. He will also say that there is no way that a coordinator operator can recover any private information about their users. As usual, it's a load of crap. Whether or not you consider a person like Kruw who wished death on others and defended zkSNACKs' choice to partner with blockchain analysis companies with a passion to be malicious is up to you. I have recommended you stay away from his honeypot service.

Here is an interesting part worth remembering:

To my knowledge drkgry discovered this independently and disclosed it in good faith, but the members of the team who were present at zkSNACKs during the design phase of Wabisabi were absolutely aware of this issue.

According to this, the team behind Wabisabi and zkSNACKs (the company Kruw worked for and defended until the bitter end) knew about the deanonymization vulnerability. Perhaps it came about by chance or maybe it was left their on purpose...


Sources:
https://www.therage.co/vulnerability-wabisabi-coinjoin/
https://bitcoinmagazine.com/technical/wabisabi-deanonymization-vulnerability-disclosed

[Kruw]

Kruw will always tell you how Wasabi is open-source and how you can always inspect the code yourself.

Yep, that's exactly how this bug was caught and fixed. Having multiple teams implementing the protocol with open source code is a great advantage for hardening software.

[BlackHatCoiner]

The vulnerability has been reported by Ginger in here: https://github.com/GingerPrivacy/GingerWallet/discussions/116. I hadn't ever read about it until yesterday. The steps to reproduce are trivial, as you can see. The coordinator issues a different maxAmountCredentialValue for every round-state request, and he can use it to link input and output registration.

So, everything below v2.2.1.0 is now provably trust-requiring.

Yep, that's exactly how this bug was caught and fixed. Having multiple teams implementing the protocol with open source code is a great advantage for hardening software.

Having multiple teams working on open-source is good, but the numerous poor decisions made by Wasabi developers so far overshadow the greatness of open-source collaboration. I haven't witnessed so many serious vulnerabilities reported in any other privacy software so far...

[JollyGood]

Not being specific to this case as I am not familiar with the situation but in the general sense there is always the dilemma businesses face when they become aware of a problem and then have to make a decision to either announce it in public or to try to suppress it on order to protect themselves from the negativity that would be directed towards them.

If it was something that was left there for nefarious purposes then their plan has failed therefore that is a positive to look at.

According to this, the team behind Wabisabi and zkSNACKs (the company Kruw worked for and defended until the bitter end) knew about the deanonymization vulnerability. Perhaps it came about by chance or maybe it was left their on purpose...


Sources:
https://www.therage.co/vulnerability-wabisabi-coinjoin/
https://bitcoinmagazine.com/technical/wabisabi-deanonymization-vulnerability-disclosed

[Kruw]

If it was something that was left there for nefarious purposes then their plan has failed therefore that is a positive to look at.

Exactly. The ability to test whether a coordinator is exploiting an active vulnerability is somewhat of a silver lining to the existence of the vulnerability. Another example of this was with the inflation bug in Bitcoin that was fixed in 0.16.3. Since this bug wasn't exploited by miners at the time, it provides some circumstantial proof that entities who aren't normally in a position of trust are able to wield a position of trust responsibly once a vulnerability places them in that position.

Obviously, we should always strive for bug free code and incentive aligned protocols, but it's a small advantage that would allow users to reallocate coinjoin liquidity to honest coordinators or miners to reallocate hashrate to honest pools.

[dkbit98]

According to this, the team behind Wabisabi and zkSNACKs (the company Kruw worked for and defended until the bitter end) knew about the deanonymization vulnerability. Perhaps it came about by chance or maybe it was left their on purpose...

''T0tal privacy'' and an0nymous bitcoin my ass  
How convenient that coordinator can deanonymize the user.... sure it can happen because this is centralized control.
After this incidents I have to say that I don't trust WabiSabi protocol and their lead architect Yuval, I am sure there are more hidden ''bugs'' in code.

[Kruw]

''T0tal privacy'' and an0nymous bitcoin my ass  
How convenient that coordinator can deanonymize the user.... sure it can happen because this is centralized control.
After this incidents I have to say that I don't trust WabiSabi protocol and their lead architect Yuval, I am sure there are more hidden ''bugs'' in code.

I'm happy to pay out a bounty for any serious bugs discovered in the code.

[PrivacyG]

Wasabi Wallet versions 2.2.1.0 and below are vulnerable to a deanonymization vulnerability in the WabiSabi coinjoin protocol. This vulnerability allows malicious coordinators to deanonymize users and link inputs and outputs.

MALICIOUS Coordinators?!  But, I thought it is about impossible to fall for such a malicious one considering it would be almost obvious to the consumer if they are targeted!

-----

''T0tal privacy'' and an0nymous bitcoin my ass  

It is your fault, did you not read what Kruw says?  No Trust is required, or did you not check the source code properly before using Wasabi?

-----

How convenient that coordinator can deanonymize the user.... sure it can happen because this is centralized control.

The question JollyGood asked a while ago is more relevant than ever.  And the avoidance in the answer provided by Kruw is even more suspect than ever now,

If you are not buying any data can you confirm if you are selling or sharing or giving away any data from users that use your coordinator?

Users never offer any data to coordinators, my answer doesn't matter since users verify this for themselves.