Instead of enrolling three post-mix inputs as usual the coordinator will now enroll additional post-mix inputs. This makes the coinjoin transactions larger and therefore even harder to break
Why don't they create rounds larger than 5-8 inputs? zkSNACKs' coordinator creates coinjoins with 150-400 inputs, which provides much greater anonymity per transaction.
These two new inputs are created from an initial transaction called Tx0 which splits the amount of be coinjoined in to the needed denominations to join the chosen pool, along with a few extra sats in to each input to pay the fee for that first coinjoin transaction.
This is an enormous waste of block space and less private compared to skipping tx0 and creating your equal sized denominations directly from the coinjoin transaction itself (like JoinMarket's coinjoins and Wasabi 1.0's zerolink implementation).
btw, is there a statistic showing how many coin-join tx whirlpool is running per day? Just curious to see how popular their service has become.
The count of coinjoin transactions is not a good way to measure its popularity since some coinjoin transactions can have more or less inputs/outputs than others and more or less value mixed. For example, users of the WabiSabi coinjoin protocol mix 3x as much new BTC and remix >10x total BTC compared to Whirlpool despite creating 1/6 of the amount of coinjoin transactions. It is far more block space efficient and private to create larger sized coinjoins than smaller sized coinjoins.
Regardless of which one you choose, I would spend some time reading about that specific implementation works, how it handles things like toxic change, and the steps you need to take to not mess up and negate the privacy it provides.
Nice dashboard, bookmarked! I might be wrong, but I suppose you're an avid user of coin-join usage. What would be the best method that one could apply to run a coin-join? I suppose using Sparrow Wallet would be the best bet?
Wasabi Wallet, BTCPay Server, or Trezor are your best choices since they support the WabiSabi coinjoin protocol and are prepackaged with Tor enabled by default. Like o_e_l_e_o mentioned, you need to be aware of how toxic change works. Whirlpool coinjoins create toxic change that can be tracked when it is spent in a future transaction. WabiSabi coinjoins eliminate toxic change by decomposing your input value into various sized denominations. Additionally, Whirlpool exposes common input ownership from coins you use in tx0 transactions. WabiSabi coinjoins prevent common input ownership association, allowing multiple inputs to be registered privately by a user into a single round.
In terms of privacy to an outside observer, then at the moment it depends on how you use them, but in the future I would say Whirlwind will provide better privacy than Whirlpool. If you coinjoin on Whirlpool, then your privacy is dependent on how many times you let the coins be mixed before you spend them. Assuming 5-input and 5-output coinjoins, then after one mix your backwards looking anonymity set is a maximum of 5. After two mixes, a maximum of 25. After three mixes, a maximum of 125. And so on. I say maximum, because if other people in the coinjoin do something stupid and deanonymize their coins, than that lowers your anonymity set. If you leave your coins in Whirlpool for months and months and end up with 10+ remixes then that's a very good anonymity set, but if you just let them be coinjoined once or twice before you spend them then that's not a very good anonymity set. This same principle applies to any coinjoin implementation. Whirlwind, on the other hand, currently has an anonymity set of 414 as long as you don't deposit huge amounts, and this is only going to grow. In the future, you will be able to get an anonymity set with Whirlwind of 10,000 or more.
Whirlwind scammed their users, what makes you think they didn't also sell their data?
Whirlwind tries to minimize the consequences of this by dividing custody into multiple trustworthy forum members, but it doesn't eliminate it completely, and it's yet to implement this shared custody.
Whirlwind scammed their users, there's no excuse to give up custody of your funds or data.
No, the coins remain under your control in either Samourai (mobile) or Sparrow (desktop), but with the obvious risk that these are hot wallets.
The WabiSabi coinjoin protocol allows you to coinjoin from a hardware wallet. Trezor already supports this.
The first is the fee to Whirlpool itself, which is a flat fee depending on the pool you are joining.
The flat pool entry fee structure is designed to incentivize worst privacy practices. Since fees are not collected directly based on volume, it is cheaper to participate in a smaller pool and create more outputs than participate in a larger pool and create less outputs. Additionally, it incentivizes the merging of UTXOs since it is cheaper to enter the pool once than to enter the pool with each UTXO individually. Samourai has never explained why they purposely chose a fee structure that heavily penalizes the most private usage of their protocol.
Because of this backwards design, you can easily link premix inputs to postmix outputs in many cases. Notice how this Whirlpool tx0 premix creates 20 outputs for 0.05 BTC -
https://mempool.space/tx/df17f709588723294d42594d1b6385cb5181aec4a025da42f9a8dc542964cdb8Notice how this Whirlpool exit transaction consumes 20 outputs for 0.05 BTC -
https://mempool.space/tx/03be7a2c294266cf9d71cc3c637603b63549e6512b9f05aa8e4ba7e5d19f6da7Every input used in the exit transaction was created directly from a round that the premix transaction entered, making it trivial to trace the user. Fortunately, the user abandoned Whirlpool and mixed his coins using the WabiSabi coinjoin protocol instead, which made him completely untraceable:
https://mempool.space/address/bc1qxke4kq4aqx7y6920s5cw5fqdky02h0c8fn0e8x