Anon-Planet / thgtoa

The comprehensive guide for online anonymity and OpSec.
https://anonymousplanet.org/
Other
357 stars 40 forks source link

Add Bitcoin specific privacy tools #271

Closed KyleOfTheCorn closed 1 year ago

KyleOfTheCorn commented 1 year ago

When it comes to using cryptocurrencies as a means for anonymous payments, the guide seems to put a lot of stress on using Zcash and Monero, while outright discouraging the use of Bitcoin. However, Zcash is simply not used by enough people to provide an anonymous means of financial transactions, so long as anonymity requires the ability to hide in a crowd as is relevant here. Just last year, Zcash was attacked by an entity filling up blocks, causing the chain size to significantly increase without an increase in transactions, while only costing the attacker approximately $10 a day. Yet Zcash is recommended as the "Extra-Paranoid anonymous option" in "Online anonymous payments using cryptocurrencies". The reasoning stresses that the crypto algorithms would have to be broken in order to harm the anonymity of its users and that isn't true because an anonymity-focused coin that no one uses is not anonymous no matter how secure its algorithms are.

The resources provided in the warning against special tumbling, mixing, coinjoining privacy wallets and services all target centralized and/or custodial mixing services, while making no mention of modern privacy protocols that work on Bitcoin and give users forward-facing on-chain privacy guarantees today.

This PR hopes to clarify the risks of using centralized mixers/tumblers, point readers to tools that are non-custodial and actually do provide users with forward-facing on-chain privacy so that they can use Bitcoin anonymously, and remove recommendations to use Zcash.

Based on a previous comment, there was hesitancy on adding a recommendation before its gotten significant review. Whirlpool is an implementation of ZeroLink which breaks all links between a UTXO and its history. Whirlpool has been used on Bitcoin's mainnet since 2019 beginning with its public beta and has since grown to 6743 BTC in unspent capacity. This should provide a basis for "significant review" to be able to recommend.

nopeitsnothing commented 1 year ago

Aside from the obvious issues with your use of the commit description for the entire post above (bad practice):

the guide seems to put a lot of stress on using Zcash and Monero, while outright discouraging the use of Bitcoin.

Zcash is simply not used by enough people to provide an anonymous means of financial transactions

Correct. It's meant more for privacy, not anonymity, for more reasons than just the amount of active users.

Zcash is recommended as the "Extra-Paranoid anonymous option"

...because it is, for extra paranoid users of crypto wallets. It's meant to break the chain, not to make you completely anonymous with one hop. "Bitcoin is not anonymous." - That's from the official website. And when you buy low and sell high, you have to be liable for at least 10% of that. There's no way to use BTC without risking traceability and linkability (LINDDUN threat modeling) anymore. Maybe ever. That is without mentioning how bad it is for our planet.

In Shojaeenasab et al, it is shown how to link (in real-time, no less) sender and receiver with very little effort. This is why we don't recommend using BTC even (especially) with mixing services and tumblers.

Regarding clients like Sparrow, I've been planning to remove all references and recommendations if any are left. There is no reason to use BTC besides as a meme. It is a completely useless and overvalued cryptocurrency. There is no anonymity or privacy anymore.

nopeitsnothing commented 1 year ago

However, I will leave this PR open for anyone with expertise in blockchain security, and I'll reach out to some sources and research the topic before making any sort of judgement. Whirlpool does seem useful and functional, but I question its "advanced" security or whether it's just marketing speech.

KyleOfTheCorn commented 1 year ago

@sharp-tailed: Removing references and recommendations on how to use Bitcoin would result in a net negative for readers of the guide. Pointing them to a coin which has little usage and can be trivially attacked is harmful practice.

And when you buy low and sell high, you have to be liable for at least 10% of that.

I don't know why you're bringing this into the conversation.

That is without mentioning how bad it is for our planet.

Same with this. There are plenty of articles debunking the "bad for our planet" argument.

In Shojaeenasab et al, it is shown how to link (in real-time, no less) sender and receiver with very little effort. This is why we don't recommend using BTC even (especially) with mixing services and tumblers.

The mixers analyzed in this paper are centralized/custodial services that would not and should not be recommended anyway.

There is no reason to use BTC besides as a meme.

If this were the case, then no one would use it as money. However, people and merchants do use it as money, and therefore people need to be aware of how to use it safely. There are also plenty of articles on this topic as well.