Setting up a coordinator doesn't cost any Coral, a coordinator just sends messages back and forth to coinjoin participants. How would you be able to see where every tx came from or where they went?  Did you read gmaxwell's explanation about Chaumian blind signatures? Quote from: gmaxwellDon't the users learn which inputs match up to which outputs? In the simplest possible implementation where users meet up on IRC over tor or the like, yes they do. The next simplest implementation is where the users send their input and output information to some meeting point server, and the server creates the transaction and asks people to sign it. The server learns the mapping, but no one else does, and the server still can't steal the coins. More complicated implementations are possible where even the server doesn't learn the mapping. E.g. Using chaum blind signatures: The users connect and provide inputs (and change addresses) and a cryptographically-blinded version of the address they want their private coins to go to; the server signs the tokens and returns them. The users anonymously reconnect, unblind their output addresses, and return them to the server. The server can see that all the outputs were signed by it and so all the outputs had to come from valid participants. Later people reconnect and sign.
Setting up a coordinator doesn't cost any Coral, a coordinator just sends messages back and forth to coinjoin participants. How would you be able to see where every tx came from or where they went?  Did you read gmaxwell's explanation about Chaumian blind signatures? Quote from: gmaxwellDon't the users learn which inputs match up to which outputs? In the simplest possible implementation where users meet up on IRC over tor or the like, yes they do. The next simplest implementation is where the users send their input and output information to some meeting point server, and the server creates the transaction and asks people to sign it. The server learns the mapping, but no one else does, and the server still can't steal the coins. More complicated implementations are possible where even the server doesn't learn the mapping. E.g. Using chaum blind signatures: The users connect and provide inputs (and change addresses) and a cryptographically-blinded version of the address they want their private coins to go to; the server signs the tokens and returns them. The users anonymously reconnect, unblind their output addresses, and return them to the server. The server can see that all the outputs were signed by it and so all the outputs had to come from valid participants. Later people reconnect and sign.

Setting up a coordinator doesn't cost any Coral, a coordinator just sends messages back and forth to coinjoin participants. How would you be able to see where every tx came from or where they went?  Did you read gmaxwell's explanation about Chaumian blind signatures? Quote from: gmaxwellDon't the users learn which inputs match up to which outputs? In the simplest possible implementation where users meet up on IRC over tor or the like, yes they do. The next simplest implementation is where the users send their input and output information to some meeting point server, and the server creates the transaction and asks people to sign it. The server learns the mapping, but no one else does, and the server still can't steal the coins. More complicated implementations are possible where even the server doesn't learn the mapping. E.g. Using chaum blind signatures: The users connect and provide inputs (and change addresses) and a cryptographically-blinded version of the address they want their private coins to go to; the server signs the tokens and returns them. The users anonymously reconnect, unblind their output addresses, and return them to the server. The server can see that all the outputs were signed by it and so all the outputs had to come from valid participants. Later people reconnect and sign.

Setting up a coordinator doesn't cost any Coral, a coordinator just sends messages back and forth to coinjoin participants. How would you be able to see where every tx came from or where they went?  Did you read gmaxwell's explanation about Chaumian blind signatures? Quote from: gmaxwellDon't the users learn which inputs match up to which outputs? In the simplest possible implementation where users meet up on IRC over tor or the like, yes they do. The next simplest implementation is where the users send their input and output information to some meeting point server, and the server creates the transaction and asks people to sign it. The server learns the mapping, but no one else does, and the server still can't steal the coins. More complicated implementations are possible where even the server doesn't learn the mapping. E.g. Using chaum blind signatures: The users connect and provide inputs (and change addresses) and a cryptographically-blinded version of the address they want their private coins to go to; the server signs the tokens and returns them. The users anonymously reconnect, unblind their output addresses, and return them to the server. The server can see that all the outputs were signed by it and so all the outputs had to come from valid participants. Later people reconnect and sign.