Walletwasabi: Throw warning notification to randomize sending amounts

[MaxHillebrand]

Problem

Currently the value of the destination output is entirely up to user choice. This means that based on human bias, most likely he will choose a rounded amount, and the change will be a non-rounded amount. Thus it is easy to de-anonymize which of the outputs is the destination and which is the change.

Solution

We agree there should not be a button or right click menu to automatically randomize the amounts.
But we should add a red box notification that sending round amounts is bad for privacy. Something like Sending round amounts indicates the receiving output, which is bad for privacy.

[lontivero]

I am not sure about the proposal because many services expect the exact amount (or at least no less than that).

[MaxHillebrand]

Agreed @lontivero , many services do expect the exact amount, and thus at most this should be an optional checkmark in the Send tab.
However, there are many payment reasons where there is no need for exact amounts, and for those the feature would definitely increase privacy a lot.

[Transisto]

Fror anyone sending more than 0.1 it;s pretty obvious which one is the change.

I was thinking in the future there could be a randomizer button for the parameters that are not used - cared about, For example random nlockstimes or heightlocked, fill non-specified decimals, RBF of NOT.

[MaxHillebrand]

@Transisto RBF is already randomly signaled, #2501 is doing this for nlocktime too, but we need more research on exactly what range it should randomly pick...

So the only thing I think is missing is randomization of the sending amount [point of this feature request] and the fee level #2570.

So I think a button with Randomize next to the amount field would be nice, but it might clutter UX - thus it can also be hidden in the right click menu.

[molnard]

This would be an unexpected behavior for the users and endangers the functionality when sending exact amounts. Pro users can do it manually if needed. I cannot see how could this feature be implemented in an easy and trivial manner.

[yahiheb]

Another solution would be to warn/notify the user when there is a round number (either the sent amount or the change) which can lead to finding the change address.
We can also consider to check if it is a round number when converted to USD. https://en.bitcoin.it/wiki/Privacy#Round_numbers

[MaxHillebrand]

Yes agreed @yahiheb, at a minimum there should be a red notification as soon as a round number is entered into the amount field, or as soon as the password is typed in, whenever it can be caught.

But I think having a Randomize button or right click menu would be invaluable to ensure this best practice is used.

[MaxHillebrand]

So we agree that it's not necessary to have the button to randomize the amounts.
But still we should have at least a warning notification in a red box, so I changed the title of the issue accordingly.

[nopara73]

NACK (for notifications too.) It's annoying, confusing and it's just one small wallet fingerprinting technique. Microoptimizing for annoying insignificant features is not the Wasabi way. There's another wallet that's taking this path already, so no need for redundancy in the space.

[lontivero]

NACK.

[MaxHillebrand]

I would like to bring this back to attention, cause I just saw a user making this mistake again.

We give a warning notification Don't merged mixed and unmixed coins - because this is an often done user mistake and reveals common input ownership.

I propose to give a warning notification Don't send a precise amount - because this is an often done user mistake and reveals common ownership of input and change. In fact, the precise amount is the most important heuristic of identifying change.

We should try to help users not shoot themselves in the foot with common mistakes. I think a notification as we have it already for the coin consolidation is a good way of doing this.

[nopara73]

NACK. If this would be the correct way to use money then Bitcoin is dead to begin with.