5 ms·

> Tumblers still work right? Anything you tumble, you can (provably) de-tumble. It's just expensive and time-consuming (re-building the blockchain state, yadda

by dvt 5y ago

> Tumblers still work right? Anything you tumble, you can (provably) de-tumble. It's just expensive and time-consuming (re-building the blockchain state, yadda yadda). Crypto banking is less anonymous than actual banking, especially if you actually want to pull your money into fiat and need to go through an exchange.

teh_infallible 5y ago
Bitcoin Cash has CashFusion, which does not rely on a central server, and since transactions are less than a cent, you can shuffle your coins as much as you want. https://cashfusion.org/ https://cashfusion.org/
- 3np 5y ago
  Do you know how/if CF differs from JoinMarket (both are two-sided CoinJoin implementations, on two different chains) One-sided JM for BTC include Wasabi and Samourai Whirlpool. Though Samourai are a bit sketch IMO.
- tylersmith 5y ago
  Its anonymity set is basically non-existant, so no real amount of funds can be obfuscated with CashFusion.
  - 3np 5y ago
    I'd love to see an analysis of the real-world numbers, though I suspect you may be right. Note also it's a function of time (ie if you run the maker side yourself you will participate in others' joins and slowly work up your anonymity set). Over several weeks/months it may be viable to obfuscate even significant amounts.
gruez 5y ago
>you can (provably) de-tumble not really? If you have a transaction that has five equally sized inputs A_{1...5} and five equally sized outputs B_{1...5}, then the max extent you can "provably" de-tumble B_1 is saying "there's a 20% chance that it came from A_1, 20% chance it came from A_2, ..."
- dvt 5y ago
  > there's a 20% chance that it came from A_1, 20% chance it came from A_2, ... You can't do this[1], as the blockchain does its best to be perfectly deterministic. Best you can do is get an oracle to get you a random seed (which you'll see publicly in the oracle token), so you'll know exactly "what went where." [1] https://blog.chain.link/random-number-generation-solidity/ https://blog.chain.link/random-number-generation-solidity/
  - drdeca 5y ago
    Is there actually a “which one it came from”? Doesn’t it just need to require that the sum of the inputs is equal to the sum of the outputs?
  - 3np 5y ago
    Explain to me why there would need to be a smart contract with an unpredictable source of randomness for this to work. Coinjoins are running well on Bitcoin, mind you. The transaction chains are generally constructed off-chain. For Ethereum you can do fancier things with zk constructs, like Aztec and Tornado Cash.
3np 5y ago
> Anything you tumble, you can (provably) de-tumble. Source? Enough CoinJoins (Wasabi+Joinmarket) and I don’t think so. Note CJ work a bit different than the oldschool custodial tumblers. Combining CJs with LN (reverse) submarine swap for another layer. With large enough anyonymity sets you should have plausible deniability. This is also a bit time-consuming, more so the larger the amount; there’s no way to do a complete end-to-end transaction of billions of dollars untracably in mere hours without standing out I think. But if you have days/weeks to break the link I think it’s def doable and done. Obviously make one single mistake and you’re out, but that’s in the nature of these things. If I’m wrong I’d very much appreciate something substantial.
- dmitriy_ko 5y ago
  Right, and it doesn't even require actual tumblers. Any service where you can deposit and then withdraw bitcoin can be used as a tumbler: gambling sites, exchanges, bitcoin marketplaces etc. Each time this is done the link is broken, and to de-tumble you need transaction history from each of those services. It's like if you want to deanonymize someone who connects to Internet though 10 VPNs: you need logs for ALL 10 VPNs to deanonymize the user. Criminals can also exchange bitcoin to Monero through anonymous exchanges, let it sit for a while and then exchange back over time.
godelski 5y ago
I'm under the impression that this isn't true if the currency is converted to a privacy coin first and then tumbled. Though of course if not done properly then the chain's state can be determined. Though I'm sure this is even more time consuming and expensive to determine.

by dvt 5y ago

teh_infallible 5y ago

Bitcoin Cash has CashFusion, which does not rely on a central server, and since transactions are less than a cent, you can shuffle your coins as much as you want. https://cashfusion.org/ https://cashfusion.org/

3np 5y ago
Do you know how/if CF differs from JoinMarket (both are two-sided CoinJoin implementations, on two different chains) One-sided JM for BTC include Wasabi and Samourai Whirlpool. Though Samourai are a bit sketch IMO.
tylersmith 5y ago
Its anonymity set is basically non-existant, so no real amount of funds can be obfuscated with CashFusion.
- 3np 5y ago
  I'd love to see an analysis of the real-world numbers, though I suspect you may be right. Note also it's a function of time (ie if you run the maker side yourself you will participate in others' joins and slowly work up your anonymity set). Over several weeks/months it may be viable to obfuscate even significant amounts.

gruez 5y ago

>you can (provably) de-tumble not really? If you have a transaction that has five equally sized inputs A_{1...5} and five equally sized outputs B_{1...5}, then the max extent you can "provably" de-tumble B_1 is saying "there's a 20% chance that it came from A_1, 20% chance it came from A_2, ..."

dvt 5y ago
> there's a 20% chance that it came from A_1, 20% chance it came from A_2, ... You can't do this[1], as the blockchain does its best to be perfectly deterministic. Best you can do is get an oracle to get you a random seed (which you'll see publicly in the oracle token), so you'll know exactly "what went where." [1] https://blog.chain.link/random-number-generation-solidity/ https://blog.chain.link/random-number-generation-solidity/
- drdeca 5y ago
  Is there actually a “which one it came from”? Doesn’t it just need to require that the sum of the inputs is equal to the sum of the outputs?
- 3np 5y ago
  Explain to me why there would need to be a smart contract with an unpredictable source of randomness for this to work. Coinjoins are running well on Bitcoin, mind you. The transaction chains are generally constructed off-chain. For Ethereum you can do fancier things with zk constructs, like Aztec and Tornado Cash.

3np 5y ago

> Anything you tumble, you can (provably) de-tumble. Source? Enough CoinJoins (Wasabi+Joinmarket) and I don’t think so. Note CJ work a bit different than the oldschool custodial tumblers. Combining CJs with LN (reverse) submarine swap for another layer. With large enough anyonymity sets you should have plausible deniability. This is also a bit time-consuming, more so the larger the amount; there’s no way to do a complete end-to-end transaction of billions of dollars untracably in mere hours without standing out I think. But if you have days/weeks to break the link I think it’s def doable and done. Obviously make one single mistake and you’re out, but that’s in the nature of these things. If I’m wrong I’d very much appreciate something substantial.

dmitriy_ko 5y ago
Right, and it doesn't even require actual tumblers. Any service where you can deposit and then withdraw bitcoin can be used as a tumbler: gambling sites, exchanges, bitcoin marketplaces etc. Each time this is done the link is broken, and to de-tumble you need transaction history from each of those services. It's like if you want to deanonymize someone who connects to Internet though 10 VPNs: you need logs for ALL 10 VPNs to deanonymize the user. Criminals can also exchange bitcoin to Monero through anonymous exchanges, let it sit for a while and then exchange back over time.

godelski 5y ago

I'm under the impression that this isn't true if the currency is converted to a privacy coin first and then tumbled. Though of course if not done properly then the chain's state can be determined. Though I'm sure this is even more time consuming and expensive to determine.