Quote from: Dabs on Today at 02:28:22 PM

Quote from: nullius on Today at 01:53:31 PM

Cross-chain analysis trivially links transactions in which people swap Bitcoin → [X] → Bitcoin; and due to subset sum analysis and timing correlations, it is surprisingly difficult to avoid all practical potential of linkage or probabilistic linkage.

Isn't that much more difficult to do for the average, non-government, or non-ciphertrace / chainalysis group?

There is open-source software for this, available to any competent amateur (or organized crime group... or really, any highly-motivated malicious party). I will omit a length explanation, due to haste plus a desire not to put up a “wall of text” diverting attention from the important information below.

Quote from: Dabs on Today at 02:28:22 PM

Of course it can not be "proven" if there is indeed a link since they are cross chain.

This is the same problem as with “plausible deniability” idiot-bait: The real world does not work this way! In the real world, if an investigator gets a 90% probability, or even a 10% probability linking transactions, then that is what is called an “investigative lead” to be pursued and confirmed with other evidence. Or maybe just used in other ways, if someone who wants to get you just isn’t too picky about “proof”.

By the way: Monero peeps, that is the value proposition of CipherTrace for police agencies. If they can get a 90% or even 10% probability linking transactions, then that gives the cops a clue to place you under targeted surveillance, get search warrants, hack your computer, beat you with a proverbial $5 wrench, weave a bullshit story for a prosecutor stack charges and threaten you with 100 years in prison to coerce you to plea-bargain even if you are completely innocent (most specifically in “the Land of the Free”, many innocent people are in prison for exactly this reason!), etc. For someone who is acquainted with reality, it is very irritating to read all the discussions poo-pooing the probabilistic grouping of transactions and partitioning of anonymity sets.

Most Internet-armchair security “experts” have no fucking idea how detectives actually work. Evidence does NOT need to be “proof” to be very, very useful.

Quote from: Dabs on Today at 02:28:22 PM

You mention PayJoin and CoinSwap, are those different from CoinJoin and the other things Wasabi (the wallet) are trying to do, or doing?

Payjoin

Payjoin standard:
https://github.com/bitcoin/bips/blob/master/bip-0078.mediawiki

Wasabi Wallet does Payjoin! This is separate from, and additional to, their CoinJoin implementation.
https://docs.wasabiwallet.io/using-wasabi/PayJoin.html

Works with BTCPay Server on the merchant side:
https://docs.btcpayserver.org/Payjoin/

JoinMarket also does Payjoin:
https://github.com/JoinMarket-Org/joinmarket-clientserver/blob/master/docs/release-notes/release-notes-0.7.0.md#user-content-payjoin-bip78-type-on-command-line-and-gui

Quote from: Kukks (2020-05-10) https://github.com/NicolasDorier/bips/pull/3#discussion_r422641357

CoinSwap

Originally invented here, by (who else?) Greg Maxwell; but it has suffered some implementation difficulty:

CoinSwap: Transaction graph disjoint trustless trading

Quote from: gmaxwell on October 30, 2013, 06:43:42 AM

Alice would like to pay Bob, but doesn't want the whole world (or even Bob) tracing her transactions. Carol offers to receive Alice's coin and pay Bob with unconnected coin, but none of these parties trust each other— and Carol being able to steal coins makes Carol into a systemic risk, since the need for trust means that there can't be many Carols and Carol could be earning income on the side spying on Alices, or could get robbed, etc.

Oh, and they don't want to invoke novel cryptography or change the Bitcoin protocol.

Here I present a protocol where Alice can pay Bob by way of Carol where Carol can not rob them.

Now being implemented! The links in this quote are recommended:

https://bitcoinmagazine.com/articles/the-human-rights-foundation-is-now-funding-bitcoin-privacy-development-starting-with-coinswap

Quote from: Bitcoin Magazine (2020-06-10)

The Human Rights Foundation Is Now Funding Bitcoin Privacy Development, Starting With CoinSwap
by Aaron van Wirdum
June 10, 2020

The Human Rights Foundation (HRF) was already promoting Bitcoin’s privacy features. Now, it will also fund the development of them.

HRF, the New York-based nonprofit that promotes and protects human rights globally, has launched a fund to support Bitcoin developers who make the Bitcoin network more private, decentralized and resilient. The first grant, worth close to $50,000, has been gifted to London-based Bitcoin developer Chris Belcher to realize an implementation of his CoinSwap protocol. A second grant of the same size will be announced soon.

[...]

Belcher, one of the world’s foremost experts in Bitcoin privacy, recently published a detailed outline of how the CoinSwap technique could, in fact, be done right. The developer — who previously authored the Bitcoin privacy guide and helmed development of both JoinMarket and the Electrum Personal Server — addressed a range of potential privacy leaks, and envisioned a JoinMarket-type of liquidity market to mix coins. (Additional solutions include multi-transaction swaps to counter amount correlation, transaction routing to avoid single points of trust for privacy and fidelity bonds to make denial-of-service attacks costly.)

A working CoinSwap implementation would represent another big step forward for Bitcoin privacy. Although tools like CoinJoin are out there, and do offer privacy, these do often still reveal that the tools themselves were used. CoinSwap transactions, in contrast, could be made indistinguishable from regular transactions. This not only benefits CoinSwap users themselves, but everyone else too, as blockchain analysts could no longer safely assume that regular-looking transactions were in fact regular transactions — they might just as well have been CoinSwap transactions.

That last point is important; and it applies to Payjoin, too. If a significant number of people were to use Payjoin and CoinSwap, Chainalysis would get rekt because their heuristics would become generally unreliable. Mass-surveillance would be more difficult, and fungibility would be improved. It would not be perfect—far from it—but this is a huge step in the right direction!