Topic: [ANN] Whirlwind.money | ⚡No Fee⚡ | Ultimate Privacy | Anonymity Mining 12% APR🔥 - page 36. (Read 12755 times)

Changelog

04.04.2023 06:00:00 AM UTC
-Fees were reduced from 0.00015BTC/address to 0.0001BTC/address
-Website is now fully responsive
-All "unclickable" buttons fixed
-Note can now be downloaded in the same way as the Letter of Guarantee
-Tor header added
-HTTP Strict-Transport-Security added
-Captcha can be refreshed
-Clearnet link added to footer
-Added warning on the Withdraw Note/Combine Note pages (Your note will only work after the deposit is fully confirmed.)
-If user doesen't have JS enabled an error will be displayed
-Sliders fixed
-Network fees now adjust automatically based on market conditions so transactions shouldn't get stuck anymore

I saw a review campaign and was ready to participate in, but I see the same thing will be repeated over and over. Even if I could add an adress analysis from a tool used by CEXs to make it a bit different and a website security check.


However, I have a question

The website is missing the HTTP   security header
You know what I mean? The point saying to browsers that Whirlwind should only be accessed with HTTPS, and any connection using HTTP should automatically be converted to HTTPS

However, I believe you configured a 301 redirect on your server (HTTP to HTTPS) , it does almost the same thing but the HTTP connection is still vulnerable to a man-in-the-middle attack

Just for my information, TYVM

By the way: Pretty smart to use Njalla  

I can open the page with no problems. I have to wait 5 seconds for it to load, but otherwise everything is fine. 

---

@whirlwindmoney
It might be good to translate the site into other languages. Even if many people understand English, there are still people who have problems with it and only use a site if it is also offered in their mother tongue. I've noticed this very often, especially with people from Germany, for example. Other mixers often offer the option of changing the language. Maybe that would also be a good suggestion for Whirlwind. 

Exactly, the same here I have been trying to see the content and the features in the site before making proper Review on the site but the website both the onion and clearnet are not working instead one shows "The site can't be reached".👇

Exactly, the same here I have been trying to see the content and the features in the site before making proper Review on the site but the website both the onion and clearnet are not working instead one shows "The site can't be reached".👇

I keep getting a "Backend offline. Please try again later" message and I noticed that the API calls are returning the 500 status. Both clearnet and Tor. DDoS maybe?

I keep getting a "Backend offline. Please try again later" message and I noticed that the API calls are returning the 500 status. Both clearnet and Tor. DDoS maybe?

You are in very safe hands with Hhampuz managing your campaign here.

Welcome to the forum  

You are in very safe hands with Hhampuz managing your campaign here.

Welcome to the forum  

Clearnet link is online, if you encounter any issues while on it please use the Tor version.

More BTC will be added to the reserve in the following days, for technical info concerning the current setup and our future plans please read this thread.

OK, I am interested in testing your service when this new campaign opens, and maybe you could learn from mistakes chipmixer made and make some improvements.
It's not only trust I question, I also wonder if you have enough Bitcoins in reserve to support mixer operating for future, or you are basing Whirlwind future only on earning from fees?
What is maxiumm amount of Bitcoin someone could mix today using Whirlwind.money?

How long do you keep this records (note public key and balance) and do you keep any IP address from users?

Don't get me wrong, nothing personal against you, but I am always a bit suspicious to any new service that shows up.

Welcome to bitcointalk and as a campaign participant I will use my first week's payment to test the site and afterwards give my reviews on the mixing facility of a whirlwind, even though this project came as a replacement to chipmixer it's very important to know what users stands to the gain from using this services.

But I must say that the site is quite friendly and could become the next stop point for many mixer users who may have been disappointed in the seizure of chip mixer site.

We will launch a review campaign shortly with funds held in escrow by minerjones, you'll be able to try out the service safely. It's going to take time to build trust, but we'll be here to prove ourselves.

All funds are stored in the multi-sig, Notes are proof that you are owed BTC from the pool. We only keep the public key of the Note and the balance, nothing else. There is no identifiable information such as deposit address/timestamp, that's why it's so important that you store your Note private key safely, you will need it to withdraw.

Apologies if it's too much info and it's hard to follow, but I want to be as transparent as possible and not leave out important details. It's normal if some are skeptical because the service works differently than what they're used to and because of the latest events, but i'm confident that once we get over the trust issues and users understand how everything works, Whirlwind will become the benchmark in this niche.

We all know what happened with one big mixer recently and reading reports we could see that authorities seized a lot of coins and other data stored on 7TB drives.
There is a lot of competition for remaining mixers and there is certainly demand for bitcoin mixing, but it's hard for me to trust any new mixer.
I know it takes time for this, so I hope you will remain active in bitcointalk forum in future.

My question is, what is Whirlwind.money doing differently that will prevent something like this happening for you in future, and do you store coins in hot or cold wallets?

Since we are using a single aggregate address for all deposits and withdrawals, holding its private key on a server would be a risky move. That is why we decided to use a backend+validator model. The backend’s job will be to interact with end users by generating deposit addresses, processing withdrawals, etc. In the initial design, there will be x validators which will validate all of the backend’s actions (verify funds were received from the deposit address to the main aggregate address, verify submitted credit notes for withdrawals). These x validators will hold the multi-sig keys for the main address and will be hosted on different servers. Whenever a withdraw transaction is being sent, the signatures must be retrieved from all validators which are able to verify the transaction is correct. If an attacker manages to gain access to the backend, it would be pointless, as he will not be able to steal the funds (since the keys are on different servers), and he will not be able to forge proofs in order to withdraw another user’s BTC to his wallet. Using this model, we will be able to further decentralise this service by allowing other trusted members to run their own federated validators so that a single entity will no longer hold all of the multi-sig keys.

When a user deposits BTC using the fast withdraw method, the backend sends the deposit hash to the validators and whitelists the receiving addresses. After the signature is sent to the backend, the validators delete all proofs of those receiving addresses, keeping only the deposit transaction hash so that they would not accept a “duplicate proof”.
When a user deposits BTC using the slow withdraw method, the backend sends the deposit hash to the validators and they assign credit to the note’s public key. When the user wants to withdraw his BTC, he must send a signature to the backend which will process this. This signature will also be sent to the validators which will check it and remove credit from the note’s public key and whitelist the receiving addresses. If an attacker compromises the backend server, he would not be able to forge user note signatures in order to fool a validator to send him funds, because only the users have access to the notes’s private keys. Again, the proofs are deleted after their use.

At the moment, with whirlwindmoney being the sole operator of the site, then they are in control of all 3 keys in a 3-of-3 multi-sig. This provides additional security against a single server being seized or infiltrated, but it still requires complete trust from the end user that whirlwindmoney won't scam them, as it would in a normal single-sig set up.

I see that you are using multisig setup, and I like this approach, but are Notes ever stored anywhere online by you or not?

@whirlwindmoney, Hi.

Just to let you know.
While trying the onion service yesterday, I got a pop up with the message like "sorry, an error occurred".
I have been able to duplicate the message twice but then it was fine on my end.

Reading @RapTarX I suppose the clearnet version is now avalaible? Because I get a timer of 5 seconds and then get HTTP ERROR 500

Welcome to the niche. More mixers there are, better it is.

Reading @RapTarX I suppose the clearnet version is now avalaible? Because I get a timer of 5 seconds and then get HTTP ERROR 500