The seven deadly sins of crypto privacy

The lack of privacy protection is the Original Sin of all public blockchains – from Satoshi’s original Bitcoin whitepaper down to the most cutting-edge, modular, and parallelized network that does 100 million transactions per second with a zeptosecond finality time.

Generally speaking, user privacy goes against the nature of public blockchains: For a public ledger to function, some transaction data must be shared with nodes and network participants. The shortcut to quickly getting these systems online is simply to just make everything public by default.

However, that ultimate transparency exposes users to surveillance, coercion, and unintended consequences like trade signal leakage. This is commercially unviable and corrosive of the right to determine one’s destiny. True self-custody cannot exist if users don’t control their data; privacy is about reinstating users’ freedom to select what they do and don’t reveal to the outside world.

Here are seven fatal flaws that are common in crypto privacy tools:

In a decentralized world, centralization is sloth. It’s easier (faster and cheaper) to run a ledger on a bank’s internal SQL database than sending transactions on even the most performant blockchains. 

However, decentralization equates to resilience. It’s the reason crypto has any market value. Without it, users would be better off with centralized institutions’ speed and cost savings.

This is even more important for privacy protocols, where centralization means developers are giving themselves privileged access to users’ data.

Protocol creators should never give themselves admin keys that can freeze or deanonymize users. (RAILGUN uses mechanisms like Viewing Keys to provide non-discriminatory, user-controlled transparency where needed.) 

Another centralization vector is threshold multi-sigs, particularly for protocols seeking to bypass insecure bridges. Even when set up “properly,” a 3 of 5 multi-sig is arguably worse regarding trust assumptions than your neighborhood bank.

And when the multi-sig isn’t configured correctly….  

Privacy tools should take every measure to ensure no tracking of user activity, particularly personally identifiable data such as IP addresses and browsing activity.

Privacy protocols should be designed with an all-encompassing philosophy that only uses a momentary lack of judgment to deanonymize users.

For example, Railway Wallet (which has integrated RAILGUN privacy tech) proxies RPC calls by default for all users so that even if someone isn’t using a VPN (which they should