Orwellian “Fungibility”

Quote from: nopara73 on August 07, 2022, 02:46:24 PM

Of course I am more than happy to hear thoughts on this topic, but I hope I demonstrated that my fungibility claims aren't pulled out of my ass, in fact they are the result of years of research on the topic, so I'd appreciate not calling me a liar, because of them.

It will profit you not to make breathtakingly audacious claims in public, and then get huffy and play the victim about people calling you a liar.

This is an exercise in classic Orwellian doublethink:

Divide the set of all bitcoins into two distinguishable subsets, “bitcoins accepted by Wasabi CJ” and “bitcoins rejected by Wasabi CJ”, based on vague, arbitrary, centrally decreed secret criteria derived from blockchain spying (“analysis”). This is a new problem on the input side of a Wasabi mix. By citing your own 2021 essay, you divert people’s attention with (anyway unsound) arguments on the output side.
Declare that Wasabi solves Bitcoin’s fungibility problem, because on the output side of a Wasabi mix, coins within the minuscule anonymity set of one Wasabi mix are indistinguishable from each other (see below!). Perhaps you should better say that it is more or less weakly difficult overall to discriminate between coins in the “bitcoins accepted by Wasabi CJ” subset. (Your argument, quoted below, is poorly stated; I am sorry to fix it for you.)

Accordingly, I propose a new marketing slogan for Wasabi:

Quote from: https://orwell.ru/library/novels/1984/english/en_p_1

WAR IS PEACE
FREEDOM IS SLAVERY
WASABI SOLVES FUNGIBILITY

Happy to help. For the marketing consultant fee, my tip address is in my unpaid signature. Wasabi is a profitable company, currently running a massive paid signature advertising campaign; thus, as I assist them with doubleplusgood truth in advertising, I hope that everyone won’t begrudge me a bit of ruthless mercenary capitalism there.

Misquoting Zooko

Pre-posting edit/insertion: This is one of the dangers of sloppy research. Before making my hereby post, I decided properly to source the anonymous quote in the pity epigraph at the top of nopara73’s 24 May 2021 Medium essay:

Quote from: https://archive.ph/DTBNE#selection-373.0-607.5

Even though Bitcoin is the worst privacy system ever, everyone in the community strongly values privacy [src]

In its current revision, the diyhpluswiki does not identify the speaker or the context. That quote is from Zooko Wilcox, later the founder of Zcash, at Scaling Bitcoin Montreal in 2015. Zooko thereby discussed three privacy technologies: Lightning Network with onion routing, Confidential Transactions, and Zerocash with zk-SNARKs—the antecedent to Zcash.

The so-called “transcript” (apparently copypasted from here) is of very poor quality; it is a paraphrase of what Zooko said, or even some condensed notes approximately recording someone’s interpretation thereof.

Here is are Zooko’s exact words: https://www.youtube.com/watch?v=G6PnLSH40lQ&t=2901s

Back up a bit over half a minute, and see the context:

https://www.youtube.com/watch?v=G6PnLSH40lQ&t=2863s

Zooko worked on Digicash (1996–98), and he now leads Zcash. At both Digicash and Zcash, Zooko’s standard for privacy was and is: Statistical hiding.

(Cited version; current version. Graphic copied from what I had already written below.)

I doubt that he would appreciate his words being used to pump a commercial mixer that it is known Chainalysis can break (use this link from Tor), which is in bed with blockchain spying (“analysis”), which is now promoting an Orwellian doublethink notion of “fungibility”.

Note: I have been yearning for zero-knowledge proof privacy since 2013; I will accept nothing less! I am proud that I am a Zcasher since Sprout. I was pleased to see that Edward Snowden gets it (Tor-friendly link to read Tor-blocking Forbes article). One of my forthcoming essays, off-topic here, will be about how a nonsensical FUD campaign has deprived Bitcoiners of the privacy that Bitcoin deserves. Although Zooko may be unhappy with my opinion against POS, I am fully in agreement with him about blockchain privacy:

Quote from: Zooko Wilcox

1. You can’t add privacy.
Build strong security into the foundation.

2. Decoys don’t solve the problem.
Encryption and Zero-Knowledge Proofs do.

3. You can’t add privacy to money in flight.
Privacy comes from shielded money at rest.

Quote from: nopara73 on August 07, 2022, 02:46:24 PM

Learn more on this here: https://nopara73.medium.com/privacy-fungibility-anonymity-451d029355f7

I hope that you are not mining these discussions for ideas to twist to your audience on Medium, even as you tell people here who have proficiency in the subject to “learn more” from your marketing fluff article that you wrote before Wasabi hopped into bed with blockchain analysis. Roll Eyes

Anyway, let’s take a look. The key quote, the only part that is really relevant here, is this:

All formatting is in the original:

Quote from: https://nopara73.medium.com/privacy-fungibility-anonymity-451d029355f7

Wasabi users k-anonymize their unique UTXOs such that the result of the coinjoin is ideally 100 distinct, yet k-anonymous, outputs, where k = 100. These k-anonymized UTXOs are indistinguishable from each other. This is how anonymization, a mathematical tool, realizes the indistinguishability — also known as homogeneity or fungibility — property of a currency.

That is an attempt to bedazzle your nontechnical audience with jargon. An old marketing adage I heard somewhere: If you can’t convince ’em, confuse ’em.

Those who think in technically precise terms, and who understand the terminology, will understand that you basically just said you give coins “indistinguishability — also known as homogeneity or fungibility” within a set with size k = 100. It is unimpressive.

Loth though I am to fix your fungibility argument for you, I should point out that all coins within the “Wasabi CoinJoin” set have a much weaker sort of practical indistinguishability. I will not hereby reach any attempt rigorously to characterize that. The point here is that you break fungibility between coins accepted to a Wasabi CoinJoin, versus coins refused by a Wasabi CoinJoin. As aforementioned: You now break fungibility on the input side, not the output side, then link to your old 2021 essay to confuse the issues for people who have fuzzy thinking.

Furthermore, all of this appiles only if coins are not traced through a CoinJoin.

Overselling Coinjoin

Your marketing pretends that CoinJoin provides excellent state-of-the-art privacy. This is not true; and your hyped-up overselling of CoinJoin makes me suspicious, when you are working with blockchain analysis.

CoinJoin is a clever workaround for what I have previously called Bitcoin’s “fatal flaw”. I think it was ingenious, when Greg Maxwell invented it in 2013—an invention which, I must add, followed Maxwell’s attempt to confuse early “coin taint” analysis. But I tell you, it is only a workaround. It does not fix the problem.

And this is especially problematic when you assure your too-trusting users that they are safe when you collaborate with blockchain spying, because their privacy is assured by Wasabi’s technology. I find it most worrisome that Wasabi announced it was working with blockchain analysis, just around the time that Chainalysis disclosed they have some secret method to unmix Wasabi CJ:

Quote from: https://www.forbes.com/sites/laurashin/2022/02/22/exclusive-austrian-programmer-and-ex-crypto-ceo-likely-stole-11-billion-of-ether/

[2022-02-22] [Tor-friendly link]

Jumping off from the Coinfirm analysis, blockchain analytics company Chainalysis saw the presumed attacker had sent 50 BTC to a Wasabi Wallet, a private desktop Bitcoin wallet that aims to anonymize transactions by mixing several together in a so-called CoinJoin. Using a capability that is being disclosed here for the first time, Chainalysis de-mixed the Wasabi transactions and tracked their output to four exchanges.

(Note for the sake of correctness: I am not one of the people who assumed that Wasabi was working with Chainalysis itself. All of my posts have consistently described Wasabi as being in bed with unspecified blockchain spying (“analysis”). I was quite careful about this.)

But the vulnerability of CoinJoin in practice is not news. For one of many potential problems with CoinJoin, here is an except of one of my “Newbie” posts (a few days after I started active posting!), illustrated with a figure from [Goldfeder, et al. 2017]:

Quote from: nullius on December 06, 2017, 04:36:54 AM

Quote from: no0dlepunk on December 06, 2017, 02:45:26 AM

I guess they could identify you only once you cashed out. Other than that, your identity is safe (unless you have verified your identify in an online wallet, of course);

WRONG. For but one of a hundred other ways your identities could be linked, even if you mix with CoinJoin, check out this pretty picture from a research paper I referenced in my earlier post on this thread:

Stop giving dangerously bad advice!

I doubt that blockchain analysis companies ever fully disclose their current capabilities to the public. Never mind state-level threats, such as the NSA’s mass-surveillance program against Bitcoiners. The academic literature has years-old attacks for unwinding CoinJoins in realistic scenarios.

Quote from: Goldfeder 2017, op cit., p. 2.

For example, if the victim employs 3 rounds of CoinJoin and the adversary observes two of the victim’s payments, he can link them back to her wallet (despite mixing) with 98% accuracy. Multiple rounds of mixing increase privacy, but those gains are quickly stripped away if the adversary observes more than 2 payments.

Quote from: o_e_l_e_o on August 07, 2022, 06:44:30 PM

Quote from: nopara73 on August 07, 2022, 02:46:24 PM

is it fair to say that Wasabi is making bitcoins fungible?

Maybe you are making some bitcoins fungible, but you are not making Bitcoin fungible. If anything, you are actively working against Bitcoin fungibility by enforcing taint and directly funding blockchain analysis.

Well said. It is merely Orwellian doublethink—or perhaps, a marketing sleight-of-hand to pull the wool over the eyes of nontechnical users who do not think in such precise terms.

On dirty language:

Quote from: o_e_l_e_o on August 07, 2022, 06:44:30 PM

Quote from: nopara73 on August 07, 2022, 02:46:24 PM

That's exactly what Wasabi Wallet coinjoins are doing.

For carefully selected outputs which are already treated as fungible by your blockchain analysis partners. To paraphrase someone from Twitter: What good is a washing machine which only washes clean clothes?

I strongly disagree with that use of terminology. I intended to address that in some drafts that didn’t get done because my time was eaten up by some drama last week. I hadn’t seen that at the time; I found it shortly after I had fixed something in the Bitcoin Wiki that really horrified me (another WIP):

Quote from: https://en.bitcoin.it/w/index.php?title=Zerocoin&diff=69399&oldid=69397

Revision as of 04:55, 31 July 2022

Nullius

(Axe ridiculously wrong, foolish, and repulsive description of Zerocoin as “laundering” coins—including an express description of Zerocoin as a “money laundering pool”. WTF? This whole thing needs to be rewritten.)

That wording was in place for eight years. When I was done vomiting, I changed “money laundering pool” to “shielded value pool”, the terminology that Zcash uses. I then began to write a very long forum post prospectively entitled, “This is why we can’t have good things!” Not yet done due to distractions. It touches on that Twitter question to Wasabi. Here is a rough excerpt:

Quote from: nullius (DRAFT)

That question [“What's the point of a washing machine that only washes clean laundry?”] is logically isomorphic to the “nothing to hide” argument against privacy: Why do you want privacy, if you have nothing to hide? And it dovetails with the mindset that everyone is guilty till proved innocent: Only those with dirty laundry need falsely to prove their innocence, while innocent people with clean laundry can just let themselves be watched, tapped, tracked, traced.

Innocent people need not fear being imprisoned in a global panopticon of perpetual mass-surveillance. Only guilty people don’t want to be imprisoned under the watchful eye of unseen wardens.

Of course, that argument is ridiculous. [...]

What is adequate privacy?

Note: I had intended to cut this down to a briefer summary before posting, because it seemed to diverge too far off-topic. But since nopara73 was kind enough to misquote Zooko without attribution, I will take the liberty of slightly extending this section instead.

Quote from: n0nce on July 31, 2022, 01:32:06 AM

Quote from: nullius on July 29, 2022, 07:18:13 PM

But the problem cannot be fixed, if people can say that one coin is not like another.

Thanks for your elaborate reply, nullius!

So you are convinced that it has to be solved on a technical level. I mean; I'm not against having better on-chain privacy, such as in Monero - effectively removing the very ability to distinguish UTXOs, however I'm not sure like you that it is needed.
In fiat world, people accept bank notes without checking their history through its serial number and they aren't checking them for the anecdotal traces of cocaine (could also check for blood, etc.) - every fiat bank note is not the same, but is universally treated as such, around the world. Whenever they aren't, people get very upset, too, however not so in Bitcoin. I don't really understand why.

I'm looking forward to your project / proposal and willing to help if I can!

Thanks. Pending whatever other topics I create on these subjects, I should note in brief two things:

Fiat cash is no longer so private—not “untraceable”. The automated scanning and logging of serial numbers has been sort of privacy-lore passed about in privacy circles for some time; and I have seen Snowden mention it as a major problem nowadays. But I did not know of any specific, citable information about this. Thus, I spent some hours researching systems that are available on the market today, and presumably in common use. This will be the subject of a new thread.

You have mentioned Monero a few times. Thus although I don’t want to diverge too much into a topic I intend to address in other threads, I want to make it clear for the record that I do not consider Monero adequate.

My own analogy: Any sort of mixer scheme (including Monero mixins) is like stabbing yourself with a rusty fork, and then putting on a bandage. Such schemes leak information onto the blockchain, and try to generate noise covering up the information that is leaked. The true transaction graph is still there, hidden in the noise. This information can sometimes be sussed out with probabilistic attacks, or used for confirmation attacks, or cross-correlated with other information—and it is a rule in security, attacks only improve.

Ultimately, I only deem adequate a technology that leaks no information at all. Instead of stabbing yourself and bandaging the wound, don’t stab yourself.

Digicash (1996–98) had perfect unlinkability—statistical hiding. However, it was unavoidably centralized. The blind bearer note system that I almost built a few years ago would have similar properties (with quite different cryptography). I have remarked before that Satoshi was caught on the horns of a dilemma between privacy and decentralization.

This is both perfectly unlinkable, decentralized—and now, fully trustless [paper now linked above]:

That is not k-anonymity. Rather, statistical zero knowledge provides what Jameson Lopp (2014) properly called “infinite anonymity”. To understand it requires an entirely different mindset. Few people get it; even in the Zcash community, I am frustrated by a widespread lack of comprehension about what zero knowledge really means in practice. There are no “anonymity sets” partioning zero-knowledge shielded coins within a shielded value pool. The concept does not even apply. And within the shielded pool, a public transaction graph does not exist.

(N.b., I am hereby discussing a privacy technology in itself. What I have just said applies to transactions that occur fully within a zero-knowledge shielded value pool. The well-known attacks on the transparent value pool, and on people who have careless opsec at the boundary between pools, are not relevant. In particular, attempting to use a privacy coin as a Bitcoin pseudo-mixer is a well-known footgun; that has nothing to do with the technology.)

Some people get it. I was pleased to learn that Snowden secretly participated in the creation of Zcash, under a pseudonym. In 2021, Snowden declared that “Bitcoin is really failing comprehensively on the privacy angle,” and he called for Bitcoin to be made “private by design”; he made similar remarks in March and in June of 2022. Although I don’t agree with him about everything, Snowden understands the privacy issue; thus, I am unsurprised that in 2016, he was secretly onboard with the same privacy technology as I have been wanting in Bitcoin since 2013.

Like Snowden, I myself have said that “Bitcoin has a fatal flaw... an append-only global public ledger [is] an idea which frankly horrified me.” I now modify what I said there in 2020 about “my proposed solution”. The solution ultimately needs to be on L1, but I clearly understand the state of zero-knowledge proof technology. In 2013, applying NIZK proofs to a blockchain was a research idea; and Turing-complete zk-SNARKs were first invented. In 2016, the first fielded implementation was bleeding-edge new technology. In 2017–early 2018, I myself suffered some severe problems as an early adopter. By late 2018, it was basically usable, albeit with some significant remaining problems—worst of all, the trusted setup. In early 2020, I knew that it was still not yet sufficiently mature for Bitcoin. Only in 2022, after nine years of R&D and a fully-fielded implementation of refinements of the 2019 research breakthrough that got rid of the trusted setup, I am ready to declare that the technology is mature for widespread general adoption.