Thread by @sethforprivacy

Glad to see some more nuanced discussion of privacy issues in #Lightning at #Bitcoin2022!

The keys are:

1) Receive privacy is poor
2) Routing cross-network makes privacy of channels poor
3) L1 privacy issues cascade onto L2 to great detrimental effect

invidious.sethforprivacy.com/watch?app=desk…

One of the biggest paradoxes of Lightning is that cross-network routing *requires* public knowledge of nodes, channels, and channel UTXOs/balances, but LN is being relied upon to "fix" all of the privacy issues of L1.

These problems are not easy to solve, maybe impossible.

If you reduce the information available about nodes/channels/UTXOs, you necessarily exacerbate an already serious issue -- routing payments gets much harder or even impossible without routing hubs.

Do you want to "easily" route payments, or do you want privacy?

I'm closely following proposals like route blinding, trampoline routing, and BOLT12, but all are very experimental today and the privacy/UX tradeoffs of each aren't clear ATM.

Keep an eye out for more info on those moving forward.

While building out an L2 like Lightning for Monero would greatly benefit from the on-chain privacy, it wouldn't solve the fundamental issues of cross-network routing without revealing important info.

This is why I advocate for a p2p/customer-to-merchant channel-based L2.

With Monero's base layer not being intentionally crippled in scaling or privacy and being usable for day to day payments, we can offload the high-volume payments (or those between parties who trust each other) to L2 and gain ephemerality and reduce load/bloat on-chain.

Focusing on the use-case of direct channels between trusted parties or merchants you commonly shop at, you can gain the benefits of payment channels and ephemerality without the routing headaches -- allowing for a much more private L2 design from the ground up.

This ephemerality brings great privacy benefits if done well (no passive observation is possible), and as Monero's L1 does not rely on fees alone long-term for security offloading those transactions does not pose a security budget risk.

For those times you shop somewhere you don't have a channel with or one-off payments to untrusted parties, you can simply transact on-chain with relatively low fees, immense privacy guarantees, and higher security/finality.

This seems the ideal balance long-term.

But thankfully Monero does not need to rely on L2 for privacy or fee-reduction due to different approaches on-chain from Bitcoin, so we aren't shoehorning in approaches today that may not be ideal.

We can take it slowly, learn from Bitcoin/LN, and assess the best fit for Monero.

* One thing I forgot that is a big plus in LN:

Sender privacy is solid as long as you run your own node/channels and use proper on-chain privacy tools like @SamouraiWallet to open channels/mix channel-close funds.

If you do that right you do get strong sender privacy.

More on LN privacy in these resources as well for those who are curious:

https://twitter.com/sethforprivacy/status/1513916418261143560

Interesting metrics in here, they gathered "private data from several participants" in LN to get transaction count and amount metrics, as well as source/dest info.

Shows how easy gathering this data can be, but good to see LN usage growing!

https://twitter.com/Cointelegraph/status/1514617476528582675?t=5u9tCYj1V3N9d2FpKFXulg&s=19