i made strong technical claims about the inability cashu to provide real privacy due to browser fingerprinting. these criticisms are based on the parts of my career involving web security, but we don't trust, we verify. here's a demonstration of the problem:
even cloudflare knows who you are. they are not your browser, or the page that you think you're visiting. they wouldn't see amounts, but wallets frequently make change before sending funds, and swap after receiving them. if a mint is behind cloudflare, they will have fingerprinted both the sender and receiver, and recorded the time proximity and ordering. since they are cloudflare, they also know who you are from everything else you do on the internet
this is the cost of using web browsers, and there's very little anyone can do about it at this point. the best we can do is design distributed systems with intermediate layers, but this breaks branding and discovery
Cloudflare Turnstile requiring fingerprintable WebGL
