Quote from: zabzob on April 15, 2024, 10:08:24 AM

I think coinjoin is preferable to old-school "mixers" (is anyone still using those??), but I wonder to what extent anonymity can be compromised due to use of centralized servers for coordinating coinjoin mixes. Can these servers connect original coinjoin inputs to the mixed coins you get back? Or is there something in the code that makes that impossible? Whirlpool and WabiSabi protocols are both centralized, but JoinMarket is P2P with no central server. The thing about JoinMarket is it's relatively difficult to use and as a result it has very low liquidity.

Blind signatures enable the ability to coinjoin without the coordinator learning the links between inputs and outputs, which is why mixers have no reason to exist in the Bitcoin ecosystem:

Quote from: gmaxwell

Don't the users learn which inputs match up to which outputs?

In the simplest possible implementation where users meet up on IRC over tor or the like, yes they do. The next simplest implementation is where the users send their input and output information to some meeting point server, and the server creates the transaction and asks people to sign it. The server learns the mapping, but no one else does, and the server still can't steal the coins.

More complicated implementations are possible where even the server doesn't learn the mapping.

E.g. Using chaum blind signatures: The users connect and provide inputs (and change addresses) and a cryptographically-blinded version of the address they want their private coins to go to; the server signs the tokens and returns them. The users anonymously reconnect, unblind their output addresses, and return them to the server. The server can see that all the outputs were signed by it and so all the outputs had to come from valid participants. Later people reconnect and sign.

I opened a discussion thread about tactics for breaking coinjoin privacy: https://bitcointalk.org/index.php?topic=5482818.0