State of the transaction privacy work in Bitcoin

The discussion highlights several key points about the limitations and vulnerabilities of privacy in cryptocurrency transactions, particularly focusing on CoinJoin and PayJoin. CoinJoin, described as a mixing scheme, is noted for its shortcomings if the anonymity set is not robust. Factors such as amount correlation, post-mix consolidation, address reuse, and timing or Sybil attacks can compromise privacy. However, these issues can be mitigated by employing the WabiSabi coinjoin protocol. Studies related to CoinJoin suggest that the anonymity set tends to increase over time due to remixes, indicating a gradual improvement in privacy.

On the other hand, PayJoin offers a different approach to enhancing transaction privacy. It effectively breaks the common-input-ownership heuristic and obscures payment amounts, which can confuse change-identification heuristics. This method involves Bob using a UTXO that does not compromise the privacy of any other counterparty, such as a direct transfer from an exchange or one already associated with another individual, Charlie. Despite these benefits, it's important to note that PayJoin's effectiveness is limited under conventional threat models where Bob could consolidate UTXOs without additional information leakage.

The email also critiques the concept of "silent payments," noting that they do not offer privacy advantages over manually generated new addresses for each transaction. Silent payments are mainly a convenience feature allowing for address reuse under specific scenarios such as receiving non-public donations or multiple payments from the same entity. This feature minimizes public key exposure, which is significant given potential future threats from quantum computers. However, it’s clarified that silent payment outputs, which use Taproot keys, are still exposed onchain, thus dispelling some misconceptions about their privacy capabilities.