This MIT Researcher Has a Plan to Put Privacy in Every Bitcoin Wallet

**Armin Sabouri** (0:00)
Bitcoin users kind of treat CoinJoin as the black box, to like, if I just do this thing, I'm good to go. But if your counterparty is still behaving a certain way, even like wallet fingerprints, then it de-anonymizes yourself.

**Shinobi** (0:11)
Like, if you want privacy, you have to actively maintain it over time. It's not just push a button, and you have privacy, and that's it.
Hello, everybody. I'm Shinobi from Bitcoin Magazine, joined by Armin Sabouri, who is funded by Spiral, OpenSats, Payjoin Dev Kit Foundation. Anyone else I'm missing? But he contributes to the Payjoin Dev Kit project, which is trying to make privacy tooling that's easy for other wallets to integrate. So I guess to start, you want to give the viewers a little bit of the thought process behind why this project was approached this way, rather than like a special purpose wallet or a special tool to use. It's a general development kit aiming for all the other wallets in the space to integrate it.

**Armin Sabouri** (1:14)
Yeah. Part of the thought here is to have privacy be default in every wallet and any kind of spending transaction, and also have it kind of seamlessly flow into how people use Bitcoin today. So the kind of scan and receive invoice style payments people do today and Payjoin lends itself really nicely to that kind of user experience. So, Payjoin Dev Kit is like the problem we're trying to solve is like build the easiest tooling. So, devs don't really have to think about integrating privacy stuff into their wallets. So, today we have a breast library that has bindings to a couple of different languages. We have a bunch of collaborators across the space. It's in two production wallets, Cake Wallet and Bull Bitcoin Mobile.
Then we have like eight or 12 kind of work-in-progress integrations right now.

**Shinobi** (2:11)
Payjoin is kind of I think a well-known name at this point.
But it's a type of coin join, but not the same in the sense of coin join as people think when they hear Samurai or Asabi. So, what's kind of the logic of how a Payjoin transaction improves users' privacy? Importantly, what are the limitations of that compared to a full-blown common denomination coin join?

**Armin Sabouri** (2:40)
Yeah. So, to answer this, we need to understand what chain analysis does. So, chain analysis whole job is to cluster on-chain activity, specifically transaction outputs to common owners. And one of the ways it does that is by applying behavioral heuristics. Mainly, or not mainly, but the most commonly used one is the common input heuristic, which is super simple. It just says, the inputs of a transaction belong to the same person. So, if a transaction with five inputs, slap Bob on that, cluster them together and say, this belongs to some person. Payjoin attempts to introduce positives into this heuristic by having the sender and the recipient collaborate to make the transaction together. The sender sends a fully signed transaction over to the recipient. Recipient contributes their own inputs and outputs and sends it back. Now, we have this transaction with inputs from two different wallets.
But the key thing there is that it's indistinguishable from a normal looking payment, whatever normal looking payment is at that time. So, a chain analysis can distinguish this from a unilateral behavior.
But the drawbacks are, so one, as a sender, you send the recipient to your transaction, they know which inputs come from you, so you don't have counterparty privacy. The coin join, ideally, no one in the coin join knows which inputs belong to other people.
Payjoin, you don't have this luxury. The other problem, I just wrote a blog about this last week, is wallet fingerprints. So, are there any ways to look at a Payjoin and look for artifacts of collaboration via wallet fingerprints? So is there anything specific about one wallet that's different than the other? Maybe that's a tool that chain analysis can use to partition the Payjoin into sender and recipient, and then it's undone some of its privacy. So my claim was that wallet fingerprints are really bad, so this should de-anonymize some Payjoins. In the blog, I took three transactions that I knew were Payjoins, and ran this attack against them, and was able to decompose it, and then recover the payment amounts. But this can be generalized to coin joins as well. Wallet fingerprints are really bad on-chain, collaborative payments that aim to preserve your privacy, can't really do their job.

**Shinobi** (5:09)
So it's really important that separate wallets that implement this really go down to the fine detail and do everything exactly right. Structure their transactions the same way, set and lock time fields the same way, like all those little things.