Major Vulnerability In WabiSabi Coinjoin Protocol \ stacker news ~privacy

pull down to refresh

Major Vulnerability In WabiSabi Coinjoin Protocol www.therage.co/vulnerability-wabisabi-coinjoin/

806 sats \ 26 comments \ @k00b 9 Dec privacy

Wasabi fanboys will say is “FUD”

Why FUD? I see it as a good thing that they found this now and fix it.

Vulnerabilities are always to be found in any software code. Just because an app doesn't have vulnerabilities found it doesn't mean in the future somebody will not find some. When a vulnerability is fixed, it makes that app stronger.

0 sats \ 4 replies \ @Rsync25 9 Dec

Now you’re defending CoinJoin. Oh, what surprises. Everyone knows any software has vulnerabilities.

97 sats \ 3 replies \ @DarthCoin 9 Dec

I am not against coinjoins. In the past I used also coinjoins, but in the pre-LN era. After that I do not see its usefulness for me, that's all. That doesn't mean is not useful for others.

21 sats \ 2 replies \ @Rsync25 9 Dec

You always said that CoinJoin is useless nowadays, due LN. I haven't forgotten that.

105 sats \ 1 reply \ @DarthCoin 9 Dec

good. That doesn't mean we will shit on wasabi devs now. They are the good guys, not like the Lightspark you are shilling every fucking day.

0 sats \ 0 replies \ @Rsync25 9 Dec

LMAO. You have only this excuse? ‘Cause I said my truth to you. Have a nice day. Goodbye!

11 sats \ 9 replies \ @k00b OP 9 Dec

I've never understood the beef really. Bitcoiners just seem to love a good infight.

286 sats \ 1 reply \ @petertodd 10 Dec

There was never a fight between Wasabi and Joinmarket, because both projects are decent coinjoin implementations with advantages and disadvantages relative to each other.

Samourai both made a lot of money, and had known, unfixed, flaws so serious it might have been a fed op. The fight there had both a monetary incentive, and possibly, a fed incentive.

29 sats \ 0 replies \ @Rsync25 10 Dec

There was never a fight between Wasabi and Joinmarket, because both projects are decent coinjoin implementations with advantages and disadvantages relative to each other. Samourai both made a lot of money, and had known, unfixed, flaws so serious it might have been a fed op. The fight there had both a monetary incentive, and possibly, a fed incentiv

True

21 sats \ 1 reply \ @DesertDave 9 Dec

I don't get it. Why would anyone fight about it?Personally, I won't have sushi without it but I can respect others distaste.

Sorry, two time dad here.

110 sats \ 0 replies \ @k00b OP 9 Dec

20 sats \ 0 replies \ @anon 9 Dec

It was all marketing and weaponizing plebs to drive their bottom line. Follow the incentives.

28 sats \ 3 replies \ @Rsync25 9 Dec

I also never had this internal fight. Bitcoiners are wasting their time fighting themselves.

15 sats \ 2 replies \ @kepford 9 Dec

Amen. Some people just like fighting.

0 sats \ 1 reply \ @Rsync25 9 Dec

😁😁

0 sats \ 0 replies \ @kepford 9 Dec

Coupled with the dumb take "toxic is good". I mean I don't think toxic responses are never warranted but for some reason people think being a jerk is some sort of virtue. Its easy to be a jerk actually.

54 sats \ 0 replies \ @Imyourfed 9 Dec

From the article

Yuval Kogman, one of the lead architects of the WabiSabi protocol, points out that he had previously raised concerns about WabiSabi’s tagging attack mitigation, stating that the issue was known among developers. Kogman describes the implemented fixes as partial.

20 sats \ 4 replies \ @denlillaapan 9 Dec

We need serious Samourai-type people clasping the niche market the DOJ took away from us... ...oh, wait there is one! #698748

14 sats \ 2 replies \ @OT 9 Dec

It doesn't do coinjoins.

0 sats \ 1 reply \ @denlillaapan 9 Dec

...yet.

As far as I understand, anyway

71 sats \ 0 replies \ @OT 9 Dec

So for now its Wasabi and Joinmarket.

0 sats \ 0 replies \ @lontivero 13 Dec

Let me translate the vulnerability report here: wasabi coinjoin client implementation had a bug that made it trust on the coordinator as samourai whirlpool does. The difference is that in Wasabi is was because a bug while in whirlpool it is by design.

57 sats \ 1 reply \ @WhatIsBitcoin 9 Dec

@kruw You heard about this?

573 sats \ 0 replies \ @kruw 9 Dec

Yep, the writing of the article is a bit sloppy, a few corrections:

There's no vulnerability in the protocol itself, rather, it's a bug in the clients implementing the protocol.
I wouldn't categorize this as a "Major" vulnerability since clients can detect a malicious coordinator performing this sort of attack.

Overall, it's good that there's multiple teams implementing the protocol in open source projects, allowing these sorts of issues to be caught.

11 sats \ 0 replies \ @DesertDave 9 Dec

Good to know. Thank you.