Wasabi Wallet - Open Source, Noncustodial Coinjoin Software - page 2.

BlackHatCoiner

legendary

Activity: 1512

Merit: 7340

Farewell, Leo

Quote from: Kruw on December 10, 2024, 12:15:45 PM

Since this bug wasn't exploited by miners at the time, it provides some circumstantial proof that entities who aren't normally in a position of trust are able to wield a position of trust responsibly once a vulnerability places them in that position.

Yes, that's the good with being open-source, but I hope you acknowledge how ridiculous it now sounds to claim that it is completely resistant to Sybil attacks and how absolutely invulnerable the client is. All these assertions were just invalidated with this recent report.

And we frankly don't know if this vulnerability has ever been exploited before. We're just guessing.

Quote from: Kruw on December 10, 2024, 05:18:25 PM

I'm happy to pay out a bounty for any serious bugs discovered in the code.

I'd be interested in this. How much are you willing to pay? And define "serious bug".

Quote from: dkbit98 on December 10, 2024, 04:34:12 PM

After this incidents I have to say that I don't trust WabiSabi protocol and their lead architect Yuval, I am sure there are more hidden ''bugs'' in code.

The protocol is pretty decent, if you read the paper. It's theoretically one of the best approaches to implementing coinjoin. It is the team that puts this theory into practice which cannot be trusted, unfortunately, judging by their behavior, as revealed in the past, and their demonstrated lack of competence.

PrivacyG

legendary

Activity: 882

Merit: 1873

Crypto Swap Exchange

Quote from: Pmalek on December 10, 2024, 05:27:58 AM

Wasabi Wallet versions 2.2.1.0 and below are vulnerable to a deanonymization vulnerability in the WabiSabi coinjoin protocol. This vulnerability allows malicious coordinators to deanonymize users and link inputs and outputs.

MALICIOUS Coordinators?! But, I thought it is about impossible to fall for such a malicious one considering it would be almost obvious to the consumer if they are targeted!

-----

Quote from: dkbit98 on December 10, 2024, 04:34:12 PM

''T0tal privacy'' and an0nymous bitcoin my ass Tongue

It is your fault, did you not read what Kruw says? No Trust is required, or did you not check the source code properly before using Wasabi?

-----

Quote from: dkbit98 on December 10, 2024, 04:34:12 PM

How convenient that coordinator can deanonymize the user.... sure it can happen because this is centralized control.

The question JollyGood asked a while ago is more relevant than ever. And the avoidance in the answer provided by Kruw is even more suspect than ever now,

Quote from: Kruw on November 07, 2024, 10:29:47 AM

Quote from: JollyGood on November 07, 2024, 09:52:26 AM

If you are not buying any data can you confirm if you are selling or sharing or giving away any data from users that use your coordinator?

Users never offer any data to coordinators, my answer doesn't matter since users verify this for themselves.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: dkbit98 on December 10, 2024, 04:34:12 PM

''T0tal privacy'' and an0nymous bitcoin my ass Tongue

How convenient that coordinator can deanonymize the user.... sure it can happen because this is centralized control.
After this incidents I have to say that I don't trust WabiSabi protocol and their lead architect Yuval, I am sure there are more hidden ''bugs'' in code.

I'm happy to pay out a bounty for any serious bugs discovered in the code.

dkbit98

legendary

Activity: 2212

Merit: 7064

Quote from: Pmalek on December 10, 2024, 05:27:58 AM

According to this, the team behind Wabisabi and zkSNACKs (the company Kruw worked for and defended until the bitter end) knew about the deanonymization vulnerability. Perhaps it came about by chance or maybe it was left their on purpose...

''T0tal privacy'' and an0nymous bitcoin my ass Tongue

How convenient that coordinator can deanonymize the user.... sure it can happen because this is centralized control.
After this incidents I have to say that I don't trust WabiSabi protocol and their lead architect Yuval, I am sure there are more hidden ''bugs'' in code.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: JollyGood on December 10, 2024, 12:02:56 PM

If it was something that was left there for nefarious purposes then their plan has failed therefore that is a positive to look at.

Exactly. The ability to test whether a coordinator is exploiting an active vulnerability is somewhat of a silver lining to the existence of the vulnerability. Another example of this was with the inflation bug in Bitcoin that was fixed in 0.16.3. Since this bug wasn't exploited by miners at the time, it provides some circumstantial proof that entities who aren't normally in a position of trust are able to wield a position of trust responsibly once a vulnerability places them in that position.

Obviously, we should always strive for bug free code and incentive aligned protocols, but it's a small advantage that would allow users to reallocate coinjoin liquidity to honest coordinators or miners to reallocate hashrate to honest pools.

JollyGood

legendary

Activity: 2534

Merit: 1713

Top Crypto Casino

Not being specific to this case as I am not familiar with the situation but in the general sense there is always the dilemma businesses face when they become aware of a problem and then have to make a decision to either announce it in public or to try to suppress it on order to protect themselves from the negativity that would be directed towards them.

If it was something that was left there for nefarious purposes then their plan has failed therefore that is a positive to look at.

Quote from: Pmalek on December 10, 2024, 05:27:58 AM

According to this, the team behind Wabisabi and zkSNACKs (the company Kruw worked for and defended until the bitter end) knew about the deanonymization vulnerability. Perhaps it came about by chance or maybe it was left their on purpose...

Sources:
https://www.therage.co/vulnerability-wabisabi-coinjoin/
https://bitcoinmagazine.com/technical/wabisabi-deanonymization-vulnerability-disclosed

BlackHatCoiner

legendary

Activity: 1512

Merit: 7340

Farewell, Leo

The vulnerability has been reported by Ginger in here: https://github.com/GingerPrivacy/GingerWallet/discussions/116. I hadn't ever read about it until yesterday. The steps to reproduce are trivial, as you can see. The coordinator issues a different maxAmountCredentialValue for every round-state request, and he can use it to link input and output registration.

So, everything below v2.2.1.0 is now provably trust-requiring.

Quote from: Kruw on December 10, 2024, 09:17:35 AM

Yep, that's exactly how this bug was caught and fixed. Having multiple teams implementing the protocol with open source code is a great advantage for hardening software.

Having multiple teams working on open-source is good, but the numerous poor decisions made by Wasabi developers so far overshadow the greatness of open-source collaboration. I haven't witnessed so many serious vulnerabilities reported in any other privacy software so far...

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: Pmalek on December 10, 2024, 05:27:58 AM

Kruw will always tell you how Wasabi is open-source and how you can always inspect the code yourself.

Yep, that's exactly how this bug was caught and fixed. Having multiple teams implementing the protocol with open source code is a great advantage for hardening software.

Pmalek

legendary

Activity: 2730

Merit: 7065

Wasabi Wallet versions 2.2.1.0 and below are vulnerable to a deanonymization vulnerability in the WabiSabi coinjoin protocol. This vulnerability allows malicious coordinators to deanonymize users and link inputs and outputs.

The vulnerability may or may not have been fixed. Kruw will always tell you how Wasabi is open-source and how you can always inspect the code yourself. He will also say that there is no way that a coordinator operator can recover any private information about their users. As usual, it's a load of crap. Whether or not you consider a person like Kruw who wished death on others and defended zkSNACKs' choice to partner with blockchain analysis companies with a passion to be malicious is up to you. I have recommended you stay away from his honeypot service.

Here is an interesting part worth remembering:

Quote

To my knowledge drkgry discovered this independently and disclosed it in good faith, but the members of the team who were present at zkSNACKs during the design phase of Wabisabi were absolutely aware of this issue.

According to this, the team behind Wabisabi and zkSNACKs (the company Kruw worked for and defended until the bitter end) knew about the deanonymization vulnerability. Perhaps it came about by chance or maybe it was left their on purpose...

Sources:
https://www.therage.co/vulnerability-wabisabi-coinjoin/
https://bitcoinmagazine.com/technical/wabisabi-deanonymization-vulnerability-disclosed

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Wasabi v2.3.1 is out: https://github.com/WalletWasabi/WalletWasabi/releases/tag/v2.3.1

This version is a stability release packed with bug fixes and preparatory changes for upcoming features.

- Bug Fixes
- Settings Layout
- Tor upgraded to v13.5.9
- Buy Anything Button Disabled

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

I plan to create updated video guides for Wasabi, the first one will be on how to use the RPC to make payments directly within coinjoins. If anyone has requests or suggestions for video guides, let me know.

Wind_FURY

legendary

Activity: 2898

Merit: 1823

Quote from: owlcatz on November 24, 2024, 10:30:48 AM

Quote from: ? on November 22, 2024, 12:23:25 PM

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

There is absolutely nothing illegal about running a monero node - otherwise we'd have heard more news about such. Roll Eyes

https://monero.fail/

I believe he was merely talking about making transactions in the Monero blockchain, not actually "using" Monero by running his/her own full node and actually doing everything in the network through that node.

Plus about making it "illegal" to run your own node, I believe that in any part of the world, no nation-state has the legal infrastructure to make it "illegal".

owlcatz

legendary

Activity: 3570

Merit: 1959

Quote from: ? on November 22, 2024, 12:23:25 PM

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

There is absolutely nothing illegal about running a monero node - otherwise we'd have heard more news about such. Roll Eyes

https://monero.fail/

Wind_FURY

legendary

Activity: 2898

Merit: 1823

Quote from: Kruw on November 22, 2024, 12:24:20 PM

Quote from: ? on November 22, 2024, 12:23:25 PM

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

What are you going to do when the government makes Bitcoin illegal? I'm not saying you should embrace Monero, I'm asking how your strategy works in general.

Philosophically, and if we start considering the technical design and design-decisions made behind Bitcoin, should that actually matter? Because what use would decentralization and censorship-resistance have if a group of old men could simply sign a piece of paper to stop the network?

But as a practical matter, I believe CoinJoin and the Lightning Network - as a layer to hide that you actually used an application to CoinJoin, are needed as a general strategy to disconnect the individual's real identity from his Bitcoins.

JollyGood

legendary

Activity: 2534

Merit: 1713

Top Crypto Casino

Quote from: ? on November 22, 2024, 12:35:21 PM

Call me naive but I don't expect the government to make Bitcoin illegal.

That is my initial sentiment too however there is a possibility anything (literally anything) could happen when it comes to governments and law (as well as corrupt governments and unfair laws). When you add various anti-crypto traditional financial lobbying groups to the equation then the matter looks bleak but Bitcoin and crypto have survived thus far. Who knows what will happen in the future.

Quote from: Kruw on November 22, 2024, 12:39:43 PM

Call me a pessimist, but the government made gold illegal.

I think that was classed as a specific event/special case when the markets collapsed but it still did not justify their actions. In theory they could they do it with Bitcoin but it is highly unlikely as far too many people have invested in crypto.

?

Activity: -

Merit: -

Quote from: Kruw on November 22, 2024, 12:39:43 PM

Call me a pessimist, but the government made gold illegal.

Give it time and maybe like Gold bars you will be able to buy Bitcoin at Costco.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: ? on November 22, 2024, 12:35:21 PM

Call me naive but I don't expect the government to make Bitcoin illegal.

Call me a pessimist, but the government made gold illegal.

?

Activity: -

Merit: -

Quote from: Kruw on November 22, 2024, 12:24:20 PM

What are you going to do when the government makes Bitcoin illegal? I'm not saying you should embrace Monero, I'm asking how your strategy works in general.

Call me naive but I don't expect the government to make Bitcoin illegal. They had their shot to do that but now with the introduction of institutional investors there is why too much pressure to incorporate Bitcoin in the traditional financial pillars. Even where Bitcoin is outlawed I couldn't point to a ban that has been effective. Just pushed users to take a more world view of their holdings.

That said government likes to take their cut from the traditional financial pillars. That is something that needs to be considered as Bitcoin becomes folded in. No one wants governments asking for a handout from 21st century investment strategies.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: ? on November 22, 2024, 12:23:25 PM

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

What are you going to do when the government makes Bitcoin illegal? I'm not saying you should embrace Monero, I'm asking how your strategy works in general.

?

Activity: -

Merit: -

I'm very hesitant to touch Monero to me that just screams criminal activity and afraid the spotlight of government agencies will point my way. I'll stick to Bitcoin, sometimes hiding in the light is easier than hiding in the shadows.

Topic: Wasabi Wallet - Open Source, Noncustodial Coinjoin Software - page 2. (Read 11485 times)