State of the transaction privacy work in Bitcoin

[nkaretnikov]

I think there are some inaccuracies in what you said. Please correct me if I’m wrong.

@Kruw

Coinjoin is the only transaction type out of your list that provides full privacy.

“Full privacy” is an overstatement. CoinJoin is a mixing scheme. If the anonymity set is not good, then privacy is not good. It can be vulnerable to amount correlation, post-mix consolidation, address reuse, and timing/Sybil attacks.

@Kruw

Unfortunately, PJ actually introduces a privacy footgun: The receiver shares one of their existing UTXOs with the sender to merge with the payment.

This is a valid observation, but PayJoin still can be used to improve privacy if:

• Bob uses a UTXO that doesn’t deanonymize a different counterparty (e.g., Bob’s own transfer from an exchange)
• Bob uses a UTXO already associated with Charlie.

This breaks the common-input-ownership heuristic, obscures the payment amount, and can mislead change-identification heuristics.

The example you provide is the worst case example. It’s not a PayJoin issue, but rather a UX issue with UTXO management and privacy. But it’s a fair point for real world usage. So I’m glad you pointed it out.

@Kruw

Worse, if Charlie is using an Electrum based mobile wallet to payjoin, Bob’s common input ownership data also gets harvested by third parties.

Not a PayJoin issue, but an important point for real world usage. Appreciate you mentioning this.

@Kruw

Silent Payments just generate new receiver addresses automatically, it’s mainly a UX improvement for donations.

The word “just” makes it seem like a convenience feature. Making it easier to use the same address without linking transactions is huge for privacy. As a side effect, this also reduces public key exposure for unspent outputs. Exposed public keys can become an issue with quantum computers.