Make your Bitcoins anonymous | Free coinjoin coordinator

[Kruw]

Live coinjoin round status: https://coinjoin.kruw.io/wabisabi/human-monitor
View coinjoin history: https://wasabist.io/8 , https://wabisator.com , or https://x.com/Liquisabi / npub1u4rl3zlfa2efxslhypf4v6r8va5e0c9smxyr5676pxkyk0chn33s0teswa

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

I am providing a FREE coinjoin coordination service using the WabiSabi protocol. A coinjoin is a privacy enhancing Bitcoin transaction that combines inputs from multiple users. The more users that participate in the coinjoin, the greater privacy all participants receive. Wasabi Wallet and BTCPay Server both support the WabiSabi coinjoin protocol and use Tor by default so the coordinator is not trusted with any information.

Copy this to quick connect to my coordinator in your Wasabi client:

Code:

name=Kruw&network=main&coordinatorUri=https://coinjoin.kruw.io/&coordinationFeeRate=0&readMore=https://kruw.io&absoluteMinInputCount=21

To manually connect, you can add "https://coinjoin.kruw.io" directly to the coordinator info box, then click "Restart Wasabi":

Code:

https://coinjoin.kruw.io/

[Stalker22]

To be honest, with a trust rating like yours, I wouldnt be surprised if this community steered clear of your services altogether.  Regardless of the type of service you offer.

[Kruw]

To be honest, with a trust rating like yours, I wouldnt be surprised if this community steered clear of your services altogether.  Regardless of the type of service you offer.

You mean the trust ratings left by promoters of "mixing site" scams? I wear those proudly as a badge of honor. No one else has defended privacy from these custodial scumbags any more ferociously than I have. It looks like you need to reevaluate who you have on your trust list.

[Stalker22]

To be honest, with a trust rating like yours, I wouldnt be surprised if this community steered clear of your services altogether.  Regardless of the type of service you offer.

You mean the trust ratings left by promoters of "mixing site" scams? I wear those proudly as a badge of honor. No one else has defended privacy from these custodial scumbags any more ferociously than I have. It looks like you need to reevaluate who you have on your trust list.

Even if I ignore the negative tags, there are a dozen neutral tags on your profile, all from reputable and trustworthy forum members, who say that you should not be trusted.  It is hard to imagine that they are all wrong, and it has nothing to do with "mixing sites" promoters or my trust list.  Just stating the obvious...

[Kruw]

Even if I ignore the negative tags, there are a dozen neutral tags on your profile, all from reputable and trustworthy forum members, who say that you should not be trusted.  It is hard to imagine that they are all wrong, and it has nothing to do with "mixing sites" promoters or my trust list.  Just stating the obvious...

Can you point to anyone who has left feedback against me that hasn't promoted a custodial "mixing site"? I'm curious who you say these "trustworthy forum members" are 

[Kruw]

Here are the coinjoin transactions from the first day of the announcement:

2.17 BTC | 38 inputs | 04c5effefd4462b1433892163c72546f43c8d5fc6155d724ec34a9b7826e808a
0.99 BTC | 36 inputs | 8e1e2c544a0550adfd10b6ff7683a091d9453ae43ac7151f9ad3e5cf18866fe9
0.21 BTC | 31 inputs | 8213414a33bc16d864e4da53d8bb79cb3e9c84f8860c2cd30a1f4da211fbc346
2.22 BTC | 28 inputs | 182bcd9c5ec6d6ddbf5f3bff612ef7d256ac1f001b67132d45287d74ec2d7f3a
1.74 BTC | 38 inputs | c306e1d0bc60724ff5a28ecd1bc0b459dad33a7b789a4aa57d0fb8b4ddb577c0
1.07 BTC | 35 inputs | 1f4a527c365c8d4bb7dc25af01507aa54b63a202e610a60c68a31db758f1f26c
0.46 BTC | 55 inputs | 1e2f4ac527c6e11d3a653a5a99d476fce2ecc1b07cfd7a2863838dc61f12870d
1.43 BTC | 44 inputs | 88922d797a3ee124f4fd02f7d3c8be37623ae5e98d1073b42502fa884b0868c8
0.81 BTC | 44 inputs | a52c2b10fd12d8d042ac6164b8f63ce38eefb5f0188efbcd7fb0fc1d3e0f1a01
0.78 BTC | 65 inputs | 1fc3344b9dd7b114a87856d051980adba3a301860b4f327598a977cd9cda508b
2.10 BTC | 73 inputs | d26a197368167f7ed2e57bd7257d9d353131bd5e7a03fcc91c68828edbb2a210
0.58 BTC | 49 inputs | 9fdb56a1c68c6618b3c1c24d9ec0f72f823aa2dc1af3368e8562a4450cd07ebf
1.53 BTC | 46 inputs | dd55e6af593fa0d7fa50b632fd00cb2e1c9cdb6f6a60ae4320eb93e6cea19fc0
1.64 BTC | 49 inputs | d74565e59303a16dfea6098e47a4bcdacf9931b02cdf9698059e1c63e11943db
0.56 BTC | 43 inputs | 12f492a5bf5bdc8bd9da9d7f359f880a30523b2705cd20b98594d98b8780a3a8
1.49 BTC | 49 inputs | 10b8ffef285fb574aa871d73e9848606f28cd8df26982003ce55f38763c89abd
1.19 BTC | 56 inputs | c4b6737305a242b581b2f2d9653045c9dfd050b02f432977f701c1b187d9edc4
0.90 BTC | 51 inputs | 3e74e361b231bd8bb4303d6efc8455e71c0929795bfcd9814080150559a8d179

I have the minimum input count set to 40 now and will continue to raise it as more liquidity joins.

[dkbit98]

OP was literally celebrating when one of the forum members announced that he had terminally illness and that he is leaving the forum.
He was happy about another human being dying just because he didn't agree with him before on different things.
I wouldn't be comfortable trusting him with anything related to human beings, including privacy.
He is also making false claims about magically making bitcoin anonymous, that is impossible.

Bitcoin Is Not Anonymous.

[Kruw]

Bitcoin Is Not Anonymous.

Okay, prove it then. Show me which specific outputs were created from each input of this coinjoin transaction: https://mempool.space/tx/d26a197368167f7ed2e57bd7257d9d353131bd5e7a03fcc91c68828edbb2a210

[DaveF]

Looking up the domain:

btcpay.kruw.io.
    172.67.72.23
btcpay.kruw.io.
    104.26.13.68
btcpay.kruw.io.
    104.26.12.68


172.67.72.23 = cloudflare.com
104.26.13.68 = cloudflare.com
104.26.12.68 = cloudflare.com

So to use your privacy service you have to go though cloudflare.com.
Not a good look.

-Dave

[Kruw]

Looking up the domain:

btcpay.kruw.io.
    172.67.72.23
btcpay.kruw.io.
    104.26.13.68
btcpay.kruw.io.
    104.26.12.68


172.67.72.23 = cloudflare.com
104.26.13.68 = cloudflare.com
104.26.12.68 = cloudflare.com

So to use your privacy service you have to go though cloudflare.com.
Not a good look.

-Dave

What is your specific concern?

[DaveF]

The main point is that cloudflare stores your TLS certificate for traffic inspection, giving them the ability to access your data while transiting their servers.
So any traffic going through them can been monitored by them.

[Note, this is not just them any CDN that is using your certs instead of theirs can do that]


And they also block IPs based on known TOR exit nodes and VPNs so some automated things will not work when all of a sudden your wallet is asked to do the are you a human CAPTCHA

-Dave

[Kruw]

The main point is that cloudflare stores your TLS certificate for traffic inspection, giving them the ability to access your data while transiting their servers.
So any traffic going through them can been monitored by them.

Why does that matter since the coordinator doesn't receive any sensitive data from users?

And they also block IPs based on known TOR exit nodes and VPNs so some automated things will not work when all of a sudden your wallet is asked to do the are you a human CAPTCHA

Yep, I ran into that issue when setting it up, but I added a challenge exception for Tor.

[DaveF]

The main point is that cloudflare stores your TLS certificate for traffic inspection, giving them the ability to access your data while transiting their servers.
So any traffic going through them can been monitored by them.

Why does that matter since the coordinator doesn't receive any sensitive data from users?

And they also block IPs based on known TOR exit nodes and VPNs so some automated things will not work when all of a sudden your wallet is asked to do the are you a human CAPTCHA

Yep, I ran into that issue when setting it up, but I added a challenge exception for Tor.

Sorry working remote and missed a copy & paste from my phone to the PC.

What I was trying to put in was:

The main point is that cloudflare stores your TLS certificate for traffic inspection, giving them the ability to access your data while transiting their servers.
So any traffic going through them can been monitored by them.

And the missing 2nd part:
Also since they DO have your TLS certs AND all your traffic their is nothing stopping them from putting something else in place of what you have it would STILL identify as you.
THEY control your DNS and THEY control your TLS. They can be you and do whatever they want. Want to block all coinjoins they can do it. No, nobody would loose BTC but IMO it's still not worth it.

Ever here with this forum I have to have faith that I am talking to the real bitcointalk.org if it's not there is no way for me to know.

-Dave

[Kruw]

The main point is that cloudflare stores your TLS certificate for traffic inspection, giving them the ability to access your data while transiting their servers.
So any traffic going through them can been monitored by them.

And the missing 2nd part:
Also since they DO have your TLS certs AND all your traffic their is nothing stopping them from putting something else in place of what you have it would STILL identify as you.
THEY control your DNS and THEY control your TLS. They can be you and do whatever they want. Want to block all coinjoins they can do it. No, nobody would loose BTC but IMO it's still not worth it.

Ever here with this forum I have to have faith that I am talking to the real bitcointalk.org if it's not there is no way for me to know.

Isn't this a problem with DNS in general though? Nothing can be verified unless it's digitally signed by a private key that you know.

[BlackHatCoiner]

Isn't this a problem with DNS in general though? Nothing can be verified unless it's digitally signed by a private key that you know.

Why not use a hidden service, though? Sure, "btcpay.kruw.io" is convenient and easier to remember, but you can mitigate this man-in-the-middle easily.

Cloudflare is not the friendliest company when it comes to anonymous communication. Every single time that I've visited a Cloudflare protected website from Tor Browser, I had to wait indefinitely. Plus, you can mitigate any kind of exit node potential attacks. Truly anonymous communication is always through hidden service.

[Kruw]

Why not use a hidden service, though? Sure, "btcpay.kruw.io" is convenient and easier to remember, but you can mitigate this man-in-the-middle easily.

An onion server would have a marginally less stable connection than a clearnet server which would affect the success rate of coinjoin rounds. I'll see if I can add a hidden service as an option, but the privacy benefit I gain from doing that at this point is null.

[DaveF]

The main point is that cloudflare stores your TLS certificate for traffic inspection, giving them the ability to access your data while transiting their servers.
So any traffic going through them can been monitored by them.

And the missing 2nd part:
Also since they DO have your TLS certs AND all your traffic their is nothing stopping them from putting something else in place of what you have it would STILL identify as you.
THEY control your DNS and THEY control your TLS. They can be you and do whatever they want. Want to block all coinjoins they can do it. No, nobody would loose BTC but IMO it's still not worth it.

Ever here with this forum I have to have faith that I am talking to the real bitcointalk.org if it's not there is no way for me to know.

Isn't this a problem with DNS in general though? Nothing can be verified unless it's digitally signed by a private key that you know.

There are 2 issues that you are confusing.

1) As with any DNS provider unless you are running it yourself they can point your site wherever. BUT and this is the important BUT you usually know were your site is. i.e. if I was hosting davef.com I would know that it is at public IP 1.2.3.4 However, since cloudflare does not tell you which front end servers they are using to point back then yo don't know where they are pointing your site.

2) You then combine that with the fact that they have all your TLS certificates they can easily MITM you.

Once again, I am not saying there is any chance of loss of funds but there is a 100% chance of them blocking things from working by running their own coordinator and at random times pointing btcpay.kruw.io to their server instead of yours. It will look like yours (since you were nice enough to give them all your TLS keys) but it would not act like yours. And people would never know. All they would know is that something didn't work.

-Dave

[Kruw]

New coinjoin records over the past couple of days:

- Most inputs (202): https://mempool.space/tx/d786da697369d9b7be5b1315ce9c7195d773357a412cafe33dd28919dd214a9d
- Highest value with no change output (29 BTC): https://mempool.space/tx/952505fb2812c7d1964a9ad659eede09bda1fc3ce38aacca25fed1f4e7581a3d

[Dump3er]

Isn't this a problem with DNS in general though? Nothing can be verified unless it's digitally signed by a private key that you know.

Why not use a hidden service, though? Sure, "btcpay.kruw.io" is convenient and easier to remember, but you can mitigate this man-in-the-middle easily.

Cloudflare is not the friendliest company when it comes to anonymous communication. Every single time that I've visited a Cloudflare protected website from Tor Browser, I had to wait indefinitely. Plus, you can mitigate any kind of exit node potential attacks. Truly anonymous communication is always through hidden service.

This is an interesting post of yours that I wanted to get back to for a while now. Still had it open in my browser.

Is it true that there can be a guaranteed way to stay anonymous? From what I have read about Tor, there are potential attacks even when you have HTTPS encryption covering your traffic. Without HTTPS, there are definitely potential attacks from malicious nodes, is that correct? As the exit node is the node that removes the third (and last) layer of encryption, only HTTPS would have you covered all the way from sender to receiver.

But there could still be correlation attacks despite data being encrypted if someone operates entry and exit nodes and screens patterns, volume, metadata etc. I understand that resources are the bottleneck here for most actors, but resources are very likely not a problem for intelligence agencies.

I have never come to fully understand how probable it is that an organization or any kind of agency is indeed willing to invest tremendous resources in order to be able to draw a picture of what is going on in the Tor network. Has anyone ever read some stuff about that from a reliable source or saw calculations like they can be done for attacks on the bitcoin network?

[Kruw]

Wasabi v2.1.0.0 supports quick magic strings that allow you to configure coordinators quickly. Copy this to your clipboard and your client will automatically pop up with the coordinator details:

Code:

name=Kruw&network=main&coordinatorUri=https://coinjoin.kruw.io/&coordinationFeeRate=0&readMore=https://kruw.io&absoluteMinInputCount=21

New coinjoin records over the past couple of days:

- Most inputs (202): https://mempool.space/tx/d786da697369d9b7be5b1315ce9c7195d773357a412cafe33dd28919dd214a9d
- Highest value with no change output (29 BTC): https://mempool.space/tx/952505fb2812c7d1964a9ad659eede09bda1fc3ce38aacca25fed1f4e7581a3d

More coinjoin records:

- Most inputs (252): https://mempool.space/tx/010ce0d3ba0b756bc0889ac98ed6ca49ed6de4aa347fce432627d7ae593a3978
- Most outputs (288): https://mempool.space/tx/20a41d00bae777eaa3aff91ee7fc52cc5f5ced8630ffa20e8ca2ab1b5afc5e03
- Highest value (47.97 BTC): https://mempool.space/tx/fc36e78a120b15cfe09934512365717f1f3e206a1990f1b2eda1de14f9554a67