{ "episodeId": "SLP309", "speakers": { "stephan": { "name": "Stephan Livera", "role": "host", "tag": "STEPHAN" }, "craig_raw": { "name": "Craig Raw", "role": "guest", "tag": "CRAIG" } }, "segments": [ { "speaker": "stephan", "time": "00:09", "start": 8.55, "text": "Hi, you're listening to Stephan Livera podcast, a show about Bitcoin. Are you interested in Bitcoin privacy and CoinJoin, but maybe you haven't gotten started yet because it was a little bit complicated and involved? Well, now with Sparrow Wallet integrating CoinJoin, this is a great opportunity for people to get started with that. So I invited Craig Raw on to talk about it, some of the latest updates, how it works, as well as other various ideas like using StoneWall spends in Sparrow and the implications of having multiple Whirlpool clients, as well as wallet business models Models. Now, this show is brought to you by Swan Bitcoin, and I'm working at Swan Bitcoin as part of the team. We are helping onboard people to purchase Bitcoin, whether that is to start out with a lump sum and then to establish a Bitcoin savings plan. And remember, Swan is available internationally, so you can sign up and you can wire in funds that way. Swan also offers Swan Private. This is a team dedicated to helping high net worth individuals and entities such as corporates and businesses who want to start stacking Bitcoin, and the benefit to them is Is that they will get handholding and guidance on the pathway and a dedicated Bitcoin account expert who is available for one-on-one calls. So sign up at swanbitcoin dot com slash livera and you'll get ten dollars of free Bitcoin dropped in your account as a gift for new members. Lend at HoddleHoddle is a peer-to-peer Bitcoin-backed lending platform where you can borrow or lend out stablecoins globally and anonymously using Bitcoin as collateral. So with Lend at HoddleHoddle, you no longer need to sell your Bitcoin to get some short-term liquidity, you can borrow stable against your bitcoins and control your collateral in escrow throughout the whole deal. Stablecoin owners can earn some extra interest by lending their stablecoins out and defining the terms and the APR for their deals. So the Hoddle Hoddle lending platform is currently going through a major upgrade and there'll be improvements available soon, so go and sign up at lend dot hoddlehoddle dot com. Are you interested in Bitcoin mining? Compass Mining are making it easy for everyone to get started with Bitcoin mining. For many people, residential power rates might not be appropriate or offer a good profitability for them, but with CompuS, you can select a mining machine and have that shipped to a vetted facility that has industrial power rates, and so this might tip the odds more in your favor and give you that accessibility that you might have been looking for. So over at CompuSmining.io, you can select your equipment, what's miner and ant miner equipment is available, you select a hosting facility, you join a mining pool, and you start receiving Bitcoin. So if you're interested, go to compassmining dot io. And now onto the show with Craig. Craig, welcome back to the show. Thanks, Stefan. It's great to be here again. Yeah, Craig. So I've seen you've done some really cool things with the Sparrow wallet, and I wanted to get you back on to talk about what's happening with CoinJoin being available in Sparrow wallet, which is, I think, a big improvement in the overall user experience, and there's a lot to get into and talk about. So maybe if you wanna just offer a little bit of changed in Sparrow Wallet since we last spoke on the show?" }, { "speaker": "craig_raw", "time": "03:12", "start": 191.87, "text": "Sure. so I'm not sure of the exact list of everything that's changed, but certainly adding CoinJoin has been one of the major features that has been added. So we've been working on that for, you know, about, about a month now. It's, was launched last week, so that was, I think, probably the most major feature addition that Sparrow has seen for a while. Yeah, and" }, { "speaker": "stephan", "time": "03:32", "start": 211.98, "text": "definitely I'm, I think this is actually really cool because it hits a certain combination that wasn't possible or easily available before, because previously If you wanted to mix with Samurai Wallet, it was pretty much you needed to do it off a mobile. And then on the other hand, if you wanted to do something like CoinJoin, well, it, it just wasn't accessible as much for somebody who's trying to learn about privacy or trying to learn how to do CoinJoin. So I think this actually does change the game a little bit because Sparrow does hit a nice balance there in that because you're able to get started if you're a total new coiner and still do some mixing as well. So can you tell us a little bit about your Selecting the Samurai Wallet Whirlpool as the way you wanted to do this." }, { "speaker": "craig_raw", "time": "04:16", "start": 256.12, "text": "Sure. So, you know, Sparrow has always had a focus on trying to be private. You know, when it was first launched, you could actually only connect to your private Electrum server. However, that said, job one, and was and and still remains, you know, keeping your funds secure. So, you know, that's what we covered when we last had our chat. I think that good security in Sparrow now is now relatively simple and easy to it To achieve. So it was time for me to start looking back to the privacy angle again. You know, if we just take a step back for a second, you know, the, you know, despite the fact that Bitcoin is pseudonymous, the privacy it, it kind of offers is actually pretty poor. If you've obtained Bitcoin from an exchange and you've provided your details, that Bitcoin is going to be linked to your identity, your identity. And in other words, there's a good chance that the ownership of funds can be tracked through the- transaction graph of normal Bitcoin transactions. So to improve on this, we need to look at specific types of transactions that can either confuse the heuristic analysis or dramatically reduce its probabilities. One of the first, privacy specific features that Sparrow added was actually CoinJoin, and that's really the pay-to-end point or the BIP seventy-eight variety of CoinJoin. And CoinJoin is great, it's got this steganographic quality. So So it looks like other transactions on chain, and it breaks, the common in-input ownership heuristic, and it also hides the, the payment amount. So it's got some really great features to it, but unfortunately, it has this big down, downside. Pay to endpoint basically means that the protocol needs to have a server endpoint, which is most likely a server run by a merchant, and, for that merchant, you know, they have to run a hot wallet on that server in order to participate in a CoinJoin. So when it's simple for that merchant to run a watch-only wallet, running a hot wallet is a significant additional risk for them to take, and that means that few do it, and that means that finding a merchant who supports this kind of payjoin is actually quite rare. So even though I liked the technique from a technical point of view, I wasn't seeing that it was creating a lot of privacy for Sparrow users. So that kind of led me to CoinJoin. And I think CoinJoin has now emerged as the de facto privacy tool for the most common use of Bitcoin, which is hodling or stacking Sats, as we like, like to say. You know, it has no less than three well-known implementations at this point. It's been well-researched, tested for many years, and I think done, you know, if it's implemented well, it offers excellent forward privacy by introducing entropy into the transaction graph and breaking those deterministic links. So one of the best things about CoinJoin is that it's actually relatively simple, you know, unlike privacy on Lightning, which is a much, much more complex topic, and I think you talked about this back in, SLP at two hundred and seventy-six Which was a great show. Yeah. So, you know, CoinJoin has this clear on-chain footprint, which is both a good and a bad thing. Most of the conversation so far has focused on the bad, that, you know, services might block UTXOs with some kind of a history that leads back to a CoinJoin. But there's also a good side, side to it, you know, it's clear to everyone that the ownership of funds cannot be traced through a CoinJoin. There's just simply no useful History, and that makes it just very clear, and you know what you have. So that kind of leads me on to the sort of question that you asked, is why Will-Willpool? So I don't wanna get into a debate around the different CoinJoin implementations, mainly because I think others are much more qualified to have that debate. But I-- what I will say is the way Samurai implemented Willpool displays a really good understanding of incentive centers. So CoinJoin works best for everyone when there are many users, in other words, there's high Creditity, that's true for all CoinJoin, and ideally you want users to keep their coins mixing to increase the size of the crowd that you're in, so that improves everyone's forward looking and, and on a num-num-creditity set. And Whirlpool encourages this by asking users to pay once to enter the pool, and then once the funds are in the pool, you don't pay again no matter how many CoinJoin cycles you want to partake in, so that liquidity tends to grow over time, which increases the size of the crowd. And I think taking incentives into account is what makes the design of Bitcoin itself so unique and successful. So we, we need, we kind of needed the same thinking in CoinJoin, and I think that Whirlpool really demonstrates that well." }, { "speaker": "stephan", "time": "09:00", "start": 539.74, "text": "Yeah, that's a great comment there, and I think, there's a few interesting features there around Whirlpool as well. So this is what the Samurai Wallet guys will talk about as well, this idea of trying to go for the maximum possible entropy, not mixing with yourself, not mixing previously seen coins together, no deterministic links between the inputs and the outputs, and no address reuse. And so the interesting thing there is, I suppose, the Whirlpool coordinator, which is run by the Samurai Wallet team, is the one enforcing those rules before you're allowed into a round, correct? But Sparrow is a way that you can participate in the Whirlpool CoinJoin." }, { "speaker": "craig_raw", "time": "09:33", "start": 573.34, "text": "Yeah, that, that's right. So, you know, actually what Sparrow uses is the exact same code, that the, the sort of Whirlpool client code that the, the sam, the Samurai wallet uses, and in fact, the CLI tool that you get with the Ronin Dojo node. So, it's all actually the same code, and that's one of the reasons why it was relatively easy for me to actually build this in. And that also, I think, should give people's Actually, just the same code. It's not like this code has had to be rewritten. So, you know, it is, as you say, really the coordinator that enforces these, these rules. The client is re-really just, just there to sort of connect to it. And, you know, if you don't play by, by the rules, you're gonna get your sort of UTXOs banned. So, you know, that's, I think, very important that everyone knows that there's a level sort of playing field." }, { "speaker": "stephan", "time": "10:24", "start": 623.9, "text": "Yeah. And I think this is really interesting because there might To do CoinJoin with, and if they weren't particularly interested in using Wasabi, well, then this is probably the easiest one for them to use, and so they could even start with a small amount and just spin up a hot wallet on Sparrow and use that as their little intermediary wallet that they receive. So let's say they're purchasing coins or mining coins or earning in some way, let's say they have an online store, they can earn those coins and then use Sparrow to run them through a mix and then, and actually we'll get into this later, but around mixing to the cold storage worthwhile for users and it kind of opens it up a lot more because I think historically you had to have a mobile to do it, so it was just, it was maybe a little bit a harder experience from that. But I think it'd be good to talk through the process and how it works and what it looks like in a desktop interface. So could you just talk us through that? What does it look like? What is the user going to see when they use Sparrow to do CoinJoins?" }, { "speaker": "craig_raw", "time": "11:21", "start": 680.98, "text": "Yeah, sure. So, you know, it's, as I said, it's relatively easy to use. So what you need to do, as you just mentioned, is first create, or if you re-really, really have one, to load a, a normal hot wallet. So what do I mean by a hot wallet? I mean a bit-- thirty, thirty-nine, so a standard set of seed, seed words, you know? And it needs to be a hot wallet as opposed to, for example, a wallet connected to a hardware wallet like a Coldcard, in order for the Whirl The mix transactions as and when a mix occurs. So if you think about it, if you had to then get involved, you would delay the mix for everyone, and that is a potential denial of service attack. So, you know, that's the reason that we need to have a hot wallet here. So once you've created that hot wallet, and, and there's a quick start guide on the Sparrow Wallet site which can help with that, then what you need to do is to go to the UTXOs tab, and there's a button there called Mix Selected, and you just select the UTX to mix, and then there's a dialogue which will then take you through the process. So what happens in that process is that, an additional three wallets get effectively added To your hot wallet. Now those wallets appear as tabs on the right, and then so you're gonna now have four tabs on the right, your original wallet, and then you'll have what we call a premix wallet, a postmix wallet, and your bad bank wallet. And how that sort of works is what you do when you mix with W-Wilpool is that you first create a premix transaction with the, with the UTXOs that you want to mix, and that, that effectively does a bit of housekeeping and splits those those input UTXOs into equal out outputs ready for your first coin join mix, and your first coin join mix then takes it from the premix wallet, so the premix tran-transaction moves it into the premix wallet, and then your first coin join transaction takes it out of the premix wallet and then mixes it into the post mix wallet. Any change from the premix transaction goes into your bad bank wallet, and that's called bad bank because it basically contains UTXOs that may be linked to any of the previous identity that you're now trying to remove, so you need to be quite careful with those. Once those mixed UTXOs have entered the post-mix wallet, they then can sit there and be remixed, and the more you remix, the more your, the size of the crowd grows for you. So what you really have, have there is this idea that you can just leave them there for, for a while, or you can move them out, and to move them out, you can then mix them to any other wallet, usually a cold storage wallet, such as one that might be, you know, have the private keys on a hard, hardware wallet, wallet. So that's kind of the basics of it. as I say, most of the stuff actually happens and is done by the Whirlpool client, so you don't have to do anything beyond sending that pre-mixed transaction" }, { "speaker": "stephan", "time": "14:22", "start": 861.78, "text": "Yeah. And so for listeners who aren't familiar, there's a certain structure of how the Samurai Wallet whirlpool style works, and obviously Sparrow is taking that same style. And so you might have that account zero, or that, that's that first wallet that you create in Sparrow, and then, as you said, we create those additional tabs, and those represent-- So just as an example, just to walk that through. So let's say you spin up a Sparrow wallet, and it's a hot wallet on the computer, the keys are live or hot on the computer, and you- You have point oh seven Bitcoin that you wanna run through the mix, as an example. And so then you would select that UTXO or multiple UTXOs or pieces of Bitcoin, and you would select a mix, and then that would run that wizard, and that would show you the fees and show you, okay, it's gonna cost this much and so on. And then in that example, it, it would split down to, let's say, seven point oh one Bitcoin UTXOs that would end up in the premix. and in truth, it's a bit more than Toxic change or doxic change goes into the bad bank, and then that's where the user has to be a bit more careful about how they deal with that aspect of it. But then at the end of the day, they'll have that point oh seven, or point oh one, and seven of those point ones in the post mix, that's as an example, right? And so then the other interesting feature I noticed from reading your website is that you've actually also got stonewall in the wallet as well. Can you tell us a little bit about that?" }, { "speaker": "craig_raw", "time": "15:45", "start": 945.06, "text": "Yeah, sure So let's say that you and me decided to create a coin join together, right? So we would bas basically both take, we would decide on a certain equal output amount, and we would both take UTXOs from our wallets, and we would create a single transaction that paid us both the equal amount that we've chosen plus any change that we might have left over from the UTXOs that we have each selected from our wallet. So we might have be, be putting unequal amounts Into this particular transa-trans-action, but we're getting one output, which is the same for us both, and then plus any change also going to each of us. And that's really all that Stonewall is. This basically looks like this two-person CoinJoin. Now, What the implementation of Stonewall, is in Samurai wallet and Sparrow, Sparrow wallet, wallet is basically doing that, but doing it as a fake one. So you're basically creating a transaction which looks just like the one I described, but it's only you creating it. To the outside world, however, no one has any idea. So you are, you, you can pay somebody with one of those equal out, outputs, the other output comes back to you, but it looks to the outside- world like you've done a two-person coin join, so nobody really knows what's going on, and it, it, it really confuses the transaction graph and makes it very difficult to see, you know, has a payment been made or is this just people sending money effectively to themselves?" }, { "speaker": "stephan", "time": "17:26", "start": 1045.63, "text": "Yeah. And just another note for listeners who are new, if you're still learning about coin join and privacy, one of the ways, at least as I understand the samurai wallet style, is that they're trying to think about it as a holistic flow. It's not just like a one-off coin join And then you're done. The idea is make every spend a coin join. And so the idea is, you might have received some coins, you run that through a coin join, and then in, now in your post mix wallet, after you've done the coin join, you still want to make sure the spends going out of there look like coin joins. And so in Samurai wallet, that's using Stonewall, or Stonewall X2, or Stowaway as examples. And so it's, really interesting then that you are replicating that in the desktop on Sparrow wallet. And And so that's a really interesting and important element just to highlight there for new listeners, make sure you're aware about that. That's also a really cool thing to see that this is now becoming accessible on the desktop also. Also, I wanted to talk about how, I mean, some of this does go into the Bitcoin Twitter privacy debate stuff, but one of the elements we've seen is this idea that, oh, see, Samurai Wallet is bad because unless you're running Dojo, Samurai Wallet knows everyone in the mix. But now that model is changing because now it could be a Samurai wallet user or it could be a Sparrow wallet user, and the Sparrow wallet users aren't calling out to the Samurai server. They are now calling out to, depending on how they've configured Sparrow wallet, they're calling out to the predefined ones that are set there, people like Luke Charles and Blockstream and a few others, or they're calling out to their own Electrum server. So I think that actually does change things a little bit in terms of Samurai wallet overall as a CoinJoin tool, as Obviously, as adoption happens, more and more people will start using it in that way, and so then it actually might make it-- it, it might just be like a really cool mutual benefit thing that now it's harder for people to be deanonymized in that theoretical attack. What do you think?" }, { "speaker": "craig_raw", "time": "19:20", "start": 1160.5, "text": "Yeah, I think that that's a great, great point, and certainly one of the key design goals that I had was to ensure that, you know, the, the privacy that you have with your wallet in Sparrow before the release was exactly the same as the privacy you have with your wallet after the, the, the, the release. So no matter where you stand on the whole CoinJoin debate, you know, Sparrow remains the same, right? If you start to CoinJoin, all of the UTXO information is coming from the same source that it always was. Always did. Nothing goes to sparrows, to, sorry, to samurai servers. the only UTXO information you send is to the coordinator, and that's done according to the zero link protocol, which basically ensures that your identity changes In the middle of the mix, so you can, you, you, in, in other words, the, coordinator doesn't know the identity of the client for the final mix transaction that goes out, because the identity will actually change via Tor. We create a new Tor circuit in the middle of the mix to ensure that there's a break in the way that the coordinator can see things. So there's really, you know, and, and that's, you know, been well researched and well understood. So that- I think that that's a very important part of things is to ensure that the privacy of your UTXOs remains the same." }, { "speaker": "stephan", "time": "20:46", "start": 1246.18, "text": "Yeah, that's a really good point to say, and I think maybe just to spell out that point as well, what I was saying with what I was saying earlier as well is that historically, or at least re-up until recently, the debate was, \"Oh, see, if you're not running Dojo, Samurai will know all of your coins because there's a Samurai backing server that's got their thing, and there's a separately the Samurai Whirlpool coordinator, and so The argument was that, oh look, see, there's not that many people using Dojo, therefore most people are just using the Samurai one, and, those, even those people using Dojo would get, figured out by the process of elimination. But now with, with Samurai Wallet and increasing the accessibility, it's now available on the desktop, just as a desktop wallet, and the default setup now will, will be not using the Samurai Wallet's servers in terms of wallet information, like UTXO information, but rather only coordinating with the Whirlpool coordinator over Tor, over the Tor circuits, as, as you mentioned. And so that's a really interesting element there. And I wanted to talk, to talk a little bit about the backing server aspect of it. So what are the, if you could just- Just spell out the three main ways that a user can have their backing server for Sparrow Wallet. So, if you could just spell those out for listeners so they understand what are the differences there and what should they be using?" }, { "speaker": "craig_raw", "time": "22:02", "start": 1321.67, "text": "Yes, sure. So basically the default, and, you know, when you first install, is to use, a public server. So what I've done is, is basically chosen a few well-known, individuals or companies with a good privacy track record. This is different from the Electrum wallet, which chooses a Electrum server from a very large list on a peer-to-peer network that anyone can join. So you could potentially be connected to a malicious- Just server that's trying to learn more about your wallet. But with Sparrow, you only get a choice of these five, and, you know, as I say, there's no guarantees here, but at least you can be reasonably sure that, you know, you're not connecting to some random server that, you know, was begun just a few days ago for the purpose of trying to harvest your information. So that's the first way in which you can connect. Now, obviously, if you want to improve your privacy, you want to be running your own node, and that's the second way. So Running your own Bitcoin Core node, you can kind of connect directly to it, and that's relatively easy. The only downside with that approach is that Bitcoin Core itself, it, it basically Sparrow needs to create a wallet within Bitcoin Core itself, and that wallet within Bitcoin Core, all of those addresses are stored in plain text. So if somebody gets access to the machine your node is running on, then they could potentially learn more about your wallet. So that leads us to the final, the, the third way you can- can connect and that's using a private Electrum server. The most common, implementation of an Electrum server is an implementation called Electrus, which has actually today just released a, a new version which is, really well worth it. And that approach is, is the best because every request you make to that server, it doesn't leave any kind of trace, there's no information left behind. The server just gets the information out of its index, sends it to You and you're done. So that's, you know, the, the sort of, best method that I know of to retrieve that UTXO information is by using a private server like Elect-Electreus." }, { "speaker": "stephan", "time": "24:13", "start": 1453.08, "text": "Yeah. And so for listeners who are curious about the best way or an easy way to do that, some of, many of the node package solutions or implementations, they offer that. So, right, Umbrel, Mineo, Raspiblitz, and so on, they offer that Electreus. So It makes it easy for you then, if you wanted to do this in a way that's more private, you can set up your own Electras and then point your Sparrow wallet to that Electra so that way now you're not trusting anybody else's node, you're using your own. So that's a few tips there for listeners. And also wanted to talk about this feature, Mix to Cold Storage. So can you tell us a bit about that? I mean, it-- to me, it reminds me a little bit of a feature I think I've seen in Join Market as well, but it's" }, { "speaker": "craig_raw", "time": "24:55", "start": 1494.85, "text": "Yeah, sure. So, you know, obviously if you're running a hot wallet, you are, you should be somewhat, you know, concerned about ensuring that the seed that is sitting in that hot, hot wallet remains secure. And, and of course, we have a, a large and important industry in the hardware wallet market which is precisely designed to try and keep seeds off your desktop PC. So, you know, I think that there is a, a strong reasoning there to say that you shouldn't keep all of your funds in a Hot wallet. And what we gen- generally do is c- is create, a wallet with a hard hardware wal-wal-wallet, so Sparrow is effectively acting as a, as, as a watcher for that hard hardware wallet for the keys it contains. And, you know, that's where your, the majority of your funds should eventually end up. So that's what we would call a cold storage wallet. Now, in order to mix, as we discussed earlier, you need a hot wallet. So the ability to mix out to your cold storage wallet is an important factor, and that's, I think, you know, relatively new in the world. I, I don't, I don't think it's, it's sort of been a big thing yet, but it was very important for me because I think Sparrow has, you know, i-i-it's sort of, its primary use case is really to, allow its users to save, and to save obviously means to ensure your funds are secure. So therefore, mixing out to a cold storage wallet was important. It's relatively easy to do. You basically back on the UTXOs tab, tab again, and when you're in the post-mix wallet, which is where all your post-mix UTXOs end up, there's a Mix 2 button. If you click that, you get a little dial-dialogue, and That needs to be open in order to ensure that there's no address reuse. So for example, if you received a different transaction or to a different address, and that wallet, wallet, wallet Sparrow obviously needs to know about that so it doesn't send the post-mix UTXO to that address. And it's important to know also that when you mix out to a cold storage wallet, you're actually just mixing out the output of a CoinJoin transa-transactions. So it's a normal mix that's being sent out. It's not like you co- you, you are, breaking your links or create-- or, or, you know, you're, you're not sort of doing anything that in some way damages the privacy that you have. So yeah, that's, I think, was an important feature to add." }, { "speaker": "stephan", "time": "27:18", "start": 1638.17, "text": "Back to the show in a moment. Have you thought about upgrading your Bitcoin security to multi-signature with Unchained Capital? Don't leave your security to chance, don't leave your coins on an exchange or a custodian or potentially even single-signature wallets if you're talking about a large enough amount of coins. So with Unchained, you can create a collaborative custody vault where you hold two keys and they hold one, and so they can walk you through this process to make it easy for you. They've got a concierge package. Which is getting quite popular right now. So they will ship you some hardware wallets, they'll do a video call with you, and deposit some Bitcoin in that vault. And this is available and suitable even for people who've never held their own private keys before. So if you're interested, go to Unchained dot com, select the concierge onboarding package, and use the code Livera for a discount. And if we're talking about security, don't forget to use a specialized Bitcoin hardware wallet. My favorite is the Coldcard, created by CoinKite dot com. The Coldcard is real market In the space, they were the first to use PSBT, partially signed Bitcoin transactions, and they've got all sorts of features like the ability to use it completely airgapped, the ability to use seed XOR, which is a way of hiding your secrets in multiple parts that look and behave just like the original secret, and you can check out my recent episode with NVK, episode two ninety, if you'd like to hear more about that. But the Coldcard is a very versatile device, you can use it in a single signature or multi-signature. setup and it's a very popular device, so I think it's well worth the time to learn how to use a cold card. So go to coinjoin dot com and order yours, use the code livera for a discount. And finally, don't forget backing up your coins. Cyphersafe dot io are producing metal backup seed products like the Cypher Wheel and the new one coming out, the Cypher Grid. This one is gonna be the best value in the industry. You get everything you need for fifty nine dollars. It has two plates for all twenty four seed words, and those two plates are default, you can lock it with a padlock, you get a tamper evidence seal provided so you can know if it's been opened, and you get an automatic center punch which you can use to stamp in your twenty-four seed words. And just like all CipherSafe products, it's fireproof, rustproof, and waterproof. So go to ciphersafe dot io to order yours and use the code Livera to get a discount on your CipherGrid. Now back to the show. Yeah, that's a really cool feature because those people who want to, yeah, I mean, for whatever reason, you want to stack it into your hardware wallet or into your multisig setup, ideally. So in this example with Sparrow, you could have both wallets open, so the hot wallet that you're using for doing the mixing, and then your hardware wallet or your multisig setup that you're using for cold storage stacking. Now, historically, if somebody wanted to do this using Samurai Wallet, they had to use like multiple StoneWall X2s or StoneWalls to be able to slowly spend To do like one UTXO by UTXO, so this is actually a really time saving and arguably even cost saving feature, and accessibility as well. The accessibility is much easier for it, so the ease of use is there. So I think that's also a very cool feature for people to think about and consider, and then on top of that, I mean, there are other ways that you could use Sparrow Wallet. Okay, so here's an example, you might say have your BTC Pay and you might take the zPub out of that, so that's like your master key With Andrew Chow for some discussion on that, but you could take that out and put that into your Sparrow wallet and use that, couldn't you? And that might be another way that you could-- or maybe you might, you might generate it in Sparrow wallet and take the Zpub out and paste that into your BTC Pay, so that way when you receive new money, it hits and you can manage it inside your Sparrow wallet. And then it's, it's kind of taking one step out instead of having to have a BTC Pay wallet, a Sparrow co-injourn wallet, and, cold storage hardware wallet or multisig. Now you can just kind of have the Sparrow hot wallet and then the Sparrow cold wallet, and BTC Pay, which is also running as your merchant solution, can generate new addresses for you that will then hit inside your Sparrow wallet, right?" }, { "speaker": "craig_raw", "time": "31:21", "start": 1881.45, "text": "Yeah, I mean, I, I think, yeah, that's, that's quite right. You know, you can link these, these thing, things up, and I think that's really the benefit of building to a standard, you know, is that if, if, if we all kind of work to We end up with the solutions that are able to play together in such harmonious ways, and that's really exciting, exciting, exciting for me and why Sparrow has always been keen to go for a standards based, based, based approach. So, yeah, you know, one other thing I, I didn't mention about the mix to cold storage is that you can set up the number of mixes, or at least the minimum number of mixes that need to occur before that mix out to the cold storage happens. it's, it's actually not a determined number because we don't want to enable Kind of pattern analysis and say, \"Oh, well, you know, somebody set up, you know, seven mixes and we can see that, you know, seven mixes occurred.\" So it's only a minimum num-number and then there's a chance that you might mix out after that." }, { "speaker": "stephan", "time": "32:19", "start": 1938.99, "text": "Right. Yeah, that's really cool. And so while we're on that topic of remixing, so this is a big thing, a lot of the samurai guys talk about this, the benefit of remixing because that helps maintain that overall samurai liquidity pool and gives everyone, it kind of gives privacy to the flock Herd, if you will, so how is that being done in Sparrow? Is it running? Can it run in the background? Can it minimize to the tray? Can you tell us a little bit about that?" }, { "speaker": "craig_raw", "time": "32:45", "start": 1965.27, "text": "Yeah, sure. So Sparrow does need to be run, running. You can minimize to the tray in Windows and OS X. Unfortunately, Linux doesn't have the concept of a tray, But actually, I think what, what, you know, a future release will have is the ability to lock a wallet so that you can actually do that, that, that too, just to kind of give you some degree of being able to hide that information while it's actually there. But cer-certainly Sparrow needs to run, it ne- needs to have that Whirlpool client going. So, it's also important to ensure that your computer doesn't go to sleep, because if it goes to sleep, obviously the Whirlpool client doesn't run either. So, you know Apps that you can install, which I've linked to on the Whirlpool doc site on Sparrowwallet dot, dot com." }, { "speaker": "stephan", "time": "33:33", "start": 2012.74, "text": "Excellent. And I presume then that people could even just have this on their computer while they're working, because the idea is this is your hot wallet, it's not meant to store everything, and you could just have it on in the background while you're working and just mix it, remixing is going on, and then periodically you're just flushing it out into your cold, right? Or you're mixing to cold, right?" }, { "speaker": "craig_raw", "time": "33:52", "start": 2031.94, "text": "That's right, yes." }, { "speaker": "craig_raw", "time": "33:56", "start": 2036.22, "text": "Time, you know, you actually don't want to mix everything at once because then it would be pretty obvious. so you want to have this idea of there's time between individual blocks that you have funds in, and so, you know, people kind of want their mixing to happen very fast, but actually that's not really what you want. What you're actually seeking is mixing to happen over time, and if it happens over time, then obviously you'll be much more hidden. So, you know, that's some, some, something that you need to kind of set yourself up for that Into a mix, you should really leave your coins there for a while, and I'm talking at least many, many days, but it could, could be weeks or even months, just to ensure that you ha-- you have a, a good period of time for those transactions to occur and to appear in many different, different blocks, which have some indeterminate amount of time between, between them." }, { "speaker": "stephan", "time": "34:46", "start": 2085.87, "text": "I'm also curious, are there any other on-chain footprints that might be different or the same with, say, Samurai Wallet spends? And is that something you're intending to do, or is it just it's not a huge deal either way. So what I'm referring to here, just for listeners who aren't familiar, when your Bitcoin wallet composes a transaction, there are certain fingerprints that might be, possible based on how that transaction was constructed. It might be certain values or things like end block time, sequence numbers, and things. And so there are different thoughts and approaches around this. So Craig, I'm wondering what's your view on that? Like, are you trying to make Sparrow have the same fingerprint as Samurai Wallet, or is there a different way you're thinking about it" }, { "speaker": "craig_raw", "time": "35:26", "start": 2126.18, "text": "Question, you know, I think, you know, what Sparrow tries to do is to kind of follow, you know, as broadly as it can the sort of the, what, what, what most others are doing, or at least most of the sort of more evolved wallets are doing. I actually need to do more research, if I'm very honest, into exactly what Sam, Samurai is doing. but, you know, one of the things that Sparrow does is it, it implements what we call anti-fee sniping, which is a fifth, you know, That could try and steal transac-actions, and in effect gain the sort of mining market, and the way in, in which we deal with that is to basically just set the lock time to the current block height whenever we set, set a transac-action. Also, all, all, transactions that Sparrow creates have RBF enabled, you know, it's a useful fe-feature, and I think that one that we would want to have here Have on. So, you know, that's, I think, a pretty standard kind of setup. I think it matches what Electrum does by default. But as, as I, I say, I think I need to do a little bit more research into it just to try and ensure that those Stonewall spins look the same, and then there's a bigger crowd in which we can hide." }, { "speaker": "stephan", "time": "36:44", "start": 2203.78, "text": "Yeah, right. Yeah, very interesting stuff, and there's definitely different, philosophies and thoughts on this. So for example, Laurent MT from OXC, who is part, OXC is part of the Samurai Wallet team, and his philosophy on this idea is that it should be like drunk wallets, that wallets would sort of change their fingerprints and things, rather than trying to mandate that all the wallets all align, it's this idea that they would use different slightly different, values and things in their aspects that can be, that can give off a fingerprint. But, There are competing priorities here. So for example, as you said, to have RBF enabled, you've got to have certain things on. To have anti-feesniping, you've, well, you've got to do certain things with the locktime. and then, I know, Chris Belcher, and maybe this is also relating to the anti-feesniping part, Chris Belcher, I think, came out with some possible ways to configure the transaction so that they help look the same as in the Taproot world when Taproot is coming. So there's all these different" }, { "speaker": "stephan", "time": "37:43", "start": 2263.4, "text": "Sure, and things like that. Is that, I suppose that, that might, that was that also part of your motivation around the anti-fee sniping?" }, { "speaker": "craig_raw", "time": "37:49", "start": 2269.4, "text": "Yeah, so it's actually interesting that you mentioned that, particular contribution by Chris. so Sparrow actually implemented that, suggestion that he had in the most recent version. and, you know, what that basically does is it sort of just, it does the anti-fee sniping, but it does it in a way that's a bit random. So sometimes it uses absolute lock time to do it, and sometimes Sequence based lock time to do it. And it has the same effect. and what we're trying to do there is that we are hoping that all of the layer two solutions move to Taproot pretty soon. And what we're, we're, we're actually hoping to do there is to provide them with some cover so that when we get there, you know, we have all of these various layer two solutions doing their thing, but we don't know whether, for example, it's a channel close or whether it's actually just a Sparrow user. We, you know, there's, there's Probably using the wrong example here, but there's a certain amount of, you know, confusion that we can add into the graph by ensuring that Sparrow is doing things that a Layer 2 solution would also do, and that's the, the sort of idea of what he put forward. So, it was quite important to me to kind of work on that, you know, those are the sort of more unseen things, but I think it's important to get those in early before Taproot really starts to take, take root, so we have this confusion in there right From the very start." }, { "speaker": "stephan", "time": "39:15", "start": 2355.18, "text": "Right, right. And so for listeners who aren't familiar, the point there is that once we are in a Taproot world, the idea is that channel open and channel close transactions, or in the collaborative close case, will look the same as a single per-- single signature, or a single person Taproot spend. And so the point then is that there's a bigger and bigger crowd to hide in that- the individual users who are using wallets that support Taproot are now also in the same anonymity set as those users using, say, Lightning or other Layer Two's, things like DLTs and so on, that it might be all giving that same fingerprint. But I suppose that this is also the other interesting question is that, so part of that argument I was talking about before of having multiple users of the whirlpool System, if you will, like Samurai Wallet and Sparrow, part of that argument would be that if they are having the same fingerprint, because otherwise the counter argument could be that the chain surveillance companies of the world could just look at, \"Oh, okay, we figured out based on the later spend that this customer or user did, we can tell, oh, that was a Sparrow user and this other one was a Samurai Wallet user,\" and then again, we're back to that same problem of having, a thread to draw on that helps them distinguish between the different wallets that are using Welpool" }, { "speaker": "craig_raw", "time": "40:29", "start": 2428.51, "text": "I think that that's a great point, Stefan, and certainly one that I'll ne-need to spend some more time. you know, i-i-it's important to, to say though that all of the, transactions which are done within the Whirlpool client, so all of the, the kind of the premix transaction, the premix to postmix, and all of the postmix ones, those are all done by the same Whirlpool client code that Samurai, you know, has. So it's-- those trans-transactions will not look any different, they will look exact Gotcha." }, { "speaker": "stephan", "time": "40:59", "start": 2458.62, "text": "Yeah. And that's, great to see that you've really got that focus there. I'm also curious, what are your thoughts or ideas around future directions with CoinJoin and privacy? Would you be looking at things like coin swaps or even, like having something like a Stonewall X2 or what, what are your thoughts there?" }, { "speaker": "craig_raw", "time": "41:16", "start": 2475.88, "text": "Yeah. So one of the, the great benefits, of doing the work that I had to do for Worldcoin was that, so actually I was able to bring in quite a lot of the code that some, Samurai uses for the various other techniques that they have. So certainly I'll be looking at Stonewall, you know, X, X2, as you say, I think that that's fairly important because we don't just want to fake things, right? We want to have, you know, real chances of it actually being a two-person coin, coin join. That's kind of, That's very, very much, I think, something that's gonna happen, and in fact, with that same code import that I described, all of the Soroban code comes as well. So, you know, hopefully being able to leverage that enables us to, to do a CoinJoin, like I described earlier, but without requiring that en-end point. So basically be have two users who are able to talk to each other without having some kind of a server endpoint and then be able to construct these collaborative- Transa- actions which could be a coin join, there could be a pay join, you know, many different, different kinds. The idea is really the more of that that we can bring into the Bitcoin coin world, the more the chain, just, just fails. So, you know, doing all of that is very much on the cards, that's, that's kind of key, I, I think, in order to take, take this, this forward. In terms of coin swap, you know, I think it's, it's- It's a really interesting, you know, tech. I think it's still quite young, I think it, it, you know, the, the, the biggest concern as I see it in the sort of early days is that with CoinJoin, you end up with effectively no history. I mean, there is obviously a UTXO hist-history, but it has so many, different possibilities that in effect, you can say that each one of them is so small, you don't really know which one, one it is. The difference is that with CoinSwap, you're effectively swapping your Or UTXO history with someone else, and you don't know whose UTXO history you're gonna, gonna get. That's kind of, kind of the point. So you might end up with a UTXO his-history that you don't ide- ide-ideally want, you know? And the trouble is that, you know, and, and this, you know, has been used against CoinJoin as, as well, you know, in the sort of early days, is that, you know, in those first few coins, coin swaps, you might swap with somebody who really" }, { "speaker": "craig_raw", "time": "43:46", "start": 2625.68, "text": "UTXO his-history has some element to it that you, that you don't want. So I think that that's a concern and that's kind of the sort of zero to one issue that CoinSwap has to overcome. But I certainly hope, hope it does, I'm keen for it. I think it has a place, perhaps right now as a post mix tool." }, { "speaker": "stephan", "time": "44:06", "start": 2645.78, "text": "There's also been some chatter about reproducible builds, recently as well. So I, I know this is something you have, tried to take more seriously with Sparrow Wallet as well. So what's the Sparrow Wallet, wallet approach there?" }, { "speaker": "craig_raw", "time": "44:19", "start": 2659.01, "text": "Yeah, so I mean, it's a hard thing to get sort of right. So, you know, I, I don't think, you know, I, I think it's first of all important to say that, you know, there are many different risks and this is just one of them. So it's, it's not the be all and end all. It's, it's a really nice thing, thing to have, and it's certainly very important for Bitcoin Core itself. But, you know, I, I think it's a journey, I think that one has to kind of start off with an intermediate build stage and kind of work your way up Where Sparrow is right now is that you're able to reproduce the binaries pre-the install installers, so, you know, there's a Windows installer, so I haven't got to that point, point yet, but, and, and also pre, the sort of Signing. So with OS X, in order for the application to be able to run at all, you actually have to sign with a key provided by Apple, and that also introduces a step. Obviously, if you're reproducing the build, you don't have that private key. So there are ways in which one can deal with that, but that's also a step. So, you know, what you can do today is reproduce the binary, certainly for the Linux build that everyone uses. So if you run it on- On the Linux, you can build that bin-binary yourself and it'll be, it'll be bit for bit the exact same one as you download from the site. And I think that that, that's sort of kind of where I am, am now, and I'm certainly hoping to take things forward with, with it. But it's an important step, it, it, at least shows that this project can be reproduced, so yeah, that's, that's kind of where we're at with that." }, { "speaker": "stephan", "time": "46:02", "start": 2762.11, "text": "Yeah. So just for listeners who aren't familiar, basically the point there is that we are helping make sure that we know the code we're running doesn't have malicious bugs or vulnerabilities inserted into it. And so the idea being that you could take the source code and that you could take it yourself and independently reproduce that same binary or installer, so in this, in this example. So that's for listeners who aren't unfamiliar, maybe if you're new, just a bit of an explainer there. And then, yeah Time for Bitcoin wallets, they're, they're all changing and shifting, and I'm also curious your thoughts around wallet business models. Has, has anything changed there in terms of Sparrow? Or also, I'm curious, does the, is there any sort of revenue share thing going on with the, like the Whirlpool aspect of it?" }, { "speaker": "craig_raw", "time": "46:44", "start": 2804.01, "text": "So what I can share there, Stephano, what I can suggest rather, rather, rather is that any wallet developer who's thinking about, about CoinJoin, thinking about building a Whirlpool client in, should really go and talk to this Samurai guys, you know, it's been great to work, work with them. you know, I, I think that it will work out well for you if you do so. And yeah, I would really just, you know, the more, sort of CoinJoin clients that we have, I think, think the better. I think we're, we're on a pathway here where CoinJoin becomes, you know, if not the norm, then certainly something that's so widely done, it's no longer a niche product. It's, it's no-" }, { "speaker": "craig_raw", "time": "47:32", "start": 2851.69, "text": "No," }, { "speaker": "craig_raw", "time": "47:38", "start": 2857.97, "text": "no" }, { "speaker": "craig_raw", "time": "47:49", "start": 2869.17, "text": "So, you know, certainly more wallets should think about building this in. It is a way for them to be able to earn something for, for, for their, their, their sort of work, and I would love, love to sort of see it. I cert-certainly hope that it happens." }, { "speaker": "stephan", "time": "48:02", "start": 2882.04, "text": "Right. Yeah. Because I think historically we've seen in the space where wallets that were popular were ended up having to have some kind of cross-subsidy model, where maybe, as an example, it was, or it was like some well-known company running the wallet, like a blockchain dot info or Where they ran the wallets that became very well known. And so it is an interesting thing because obviously this space has such a strong focus on open source, everything open source, and then that can present a challenge for the developers who are trying to make a sustainable business and make a, make a wallet that actually innovates along with time and really stays up to pace, because or, or changing the game if they can, because otherwise they end up having to rely on donations or rely on like a benefactor or- Rely on the skilled work and the person already having enough money that they are just happy to just work on it in their own time. And so as this space grows and matures further, it's a good thing to see that more wallets will have a business model that is actually sustainable for them." }, { "speaker": "craig_raw", "time": "49:05", "start": 2944.51, "text": "Yeah, sure. And, you know, I think it's also important to say that that Wil-Wil-Wilpool has been designed really for this kind of idea from the very s-start. So, you know, it's, it was clear, clear to me that they had thought about how to make this, this sort of happen and always had this kind of idea that multiple wallets might be involved. and I think they're, to be honest, just really happy that it's now finally beginning to happen. So, as I say, you know, if you're think-thinking about," }, { "speaker": "craig_raw", "time": "49:35", "start": 2974.61, "text": "because we kind of need to make this just a, a very standard option, I think." }, { "speaker": "stephan", "time": "49:40", "start": 2980.1, "text": "Yeah. Well, maybe it's like, I'm just thinking of that video with the, the guy crazy dancing and, and then the first follower, and they're all-- and then after that, all the other people come along, so who knows, maybe, Yeah, sure, sure. Maybe you're the first follower, Craig. Yeah," }, { "speaker": "craig_raw", "time": "49:56", "start": 2995.87, "text": "yeah. But you-- Yeah, but you, you know, I mean, again, you know, I think it's, it's, I have to say, here's a, here's a sort of UTXO with some kind of a CoinJoin history, and that's, that's really just the norm. It's not a big, it's not stigmatized to use CoinJoin, right? That's," }, { "speaker": "stephan", "time": "50:15", "start": 3015.3, "text": "that's the idea that we're going for, because currently it can happen where exchanges, the compliance department in the exchange will stop someone's account or things like that if there is CoinJoin history pre or post that exchange for that customer. So that's something people have to think about, but also you have to think I'm trying to achieve a whole new money and there's gonna be some challenges on the way, so I think that's the way I'm, I'm thinking about it at least. So I guess maybe the last question would just be any tips for somebody who is new and learning about Bitcoin, learning about how to secure their coins and learning about privacy and CoinJoin. Do you have any tips for them or things that they should keep in mind as they're using, say, Sparrow Wallet?" }, { "speaker": "craig_raw", "time": "50:57", "start": 3056.83, "text": "Yeah, I, I think, you know, you know, it's kind of quite easy to get sort there's, there's lots to sort of learn. I think it's important just to kind of start small. One of the best tips that I can give, and, you know, this might sound a little odd because most people don't actually do it, but using testnet is just such an incredible resource to understand how Bitcoin works without risking any funds. So what you, you can do is basically, you know, start Sparrow as a testnet wallet. So just, it's fairly easy to do, and you can see how to do it on on the web website and just start playing around with sending amounts to different, different wallets, try different things. that's one of, I think, the biggest tips. Beyond that, you know, don't be afraid of creating many different wallets. You know, some, some people think, \"Well, I have my one wallet and that's kind of it,\" and, you know, try and create small wallets, do different, different things, you know, Play around with, with it, because the idea is that the more you try, the more you learn, and you might make a few mistakes, you might lose a little, little bit of funds if you do something wrong, but, you know, the best thing about that is, is that you learn very fast from those errors that you might, might make, and rather make those errors when there's a small amount, you know, just a few dollars at play, rather than when your entire cold storage is at play. You know, that's, I think, the, the most important thing. Just try and read up, there's plenty of good guides, video tutor-tutorials, you know, the amount of information out there has just changed hugely since a few years, years, years ago. So, you know, really I, I think that anybody getting into the space now is in a great place to be able to learn." }, { "speaker": "stephan", "time": "52:48", "start": 3167.87, "text": "Yeah, and also curious, are there any Sparrow wallet communities? Like, is there a Telegram channel or anything else that people should know about?" }, { "speaker": "craig_raw", "time": "52:56", "start": 3176.25, "text": "Yeah, so if you go to the, basically Sparrow Wallet Group, basically t dot me slash Sparrow Wallet, that's the sort of group. There's lots of users there and lots, lots of people who can offer help, not just, in Sparrow Wallet, but certainly on the Will, Willpool side, side of things as well. so yeah, that's, that's, I think, think the main place, place to go." }, { "speaker": "stephan", "time": "53:18", "start": 3197.78, "text": "Excellent. Alright, Craig. Well, I think that's pretty much it for this one, but, where can people" }, { "speaker": "craig_raw", "time": "53:25", "start": 3205.39, "text": "Sure. So I'm on Twitter at craig raw, all one, one word. Sparrow Wallet is also on Twitter, Sparrow Wallet, and then sparrowwallet dot com, you can go and get the wallet itself and find various docs." }, { "speaker": "stephan", "time": "53:39", "start": 3219.06, "text": "Fantastic. Well, I'd encourage listeners to give it a try because I think it's a really good wallet. a lot of really cool features are in there now, and so it actually makes sense for a person starting out with Sparrow Wallet to give that a try and then you can ramp up from there. So Craig, thanks very And, I hope look forward to chatting again soon." }, { "speaker": "craig_raw", "time": "53:58", "start": 3237.55, "text": "Excellent, thanks. It's been great, Stefan." }, { "speaker": "stephan", "time": "54:02", "start": 3241.61, "text": "So I hope you enjoyed that show. I think Sparrow Wallet might make a lot of sense as a good recommendation for new coiners because they can come in just using the default servers over Tor and they have access to CoinJoin and single signature and multi-signature, and then later they can upgrade that security over time. So I think it really makes a lot of sense. So go and check it out. Go and, let me know what you guys think as well. And of course The show notes on my website at stephanlivera dot com slash three o nine. If you're enjoying the show, make sure you share it with your family and friends so they can also learn about Bitcoin. That's it from me, thanks, and I'll see you in the citadels." } ] }