It is already possible to make a number of purchases with the help of real Lightning payments, such as a VPN router from the TorGuard provider, virtual Starblocks coffee, goods in the online Blockstream Store, and even top up a mobile phone account. Yesterday, the programmer Laszlo Hanyecz, who in 2010 bought two pizzas for 10,000 BTC, announced the purchase of pizza using the Bitcoin Lightning Network. As Hanyecz wrote, "pizza/bitcoin atomic swap software is yet unavailable." So his friend became an intermediary in making the payment. This does not, however, negate the significance of the transaction as, according to Hanyecz, it "demonstrates at a basic level how the technology works for everyday transactions" and the pizzeria can accept Lightning payments directly, provided it has its own node in the Lightning network.
Despite the fact that the first attempts at Lightning payments were successful, the developers report an unresolved privacy issue, which can behave in the Lightning network even worse than in Bitcoin. "Bitcoin is the Twitter of your bank account. All of the information is available to everyone," said Jan Myers, co-founder of the anonymous Zcash cryptocurrency.
Although Lightning also offers an off-chain scalability solution, that is, part of information about transactions will be stored outside the main blockchain, no "distributed Lightning" registry exists, and all payments will still be scattered across the nodes of the network. In addition, in order to "route" a transaction, the user must trust other network members, who assist in the transaction. That is, each user can spy on the details of the transaction, as well as sell them to the government or advertisers. "Perhaps Lightning will not improve, but significantly worsen privacy for the average user," says Myers.
The forthcoming release of Lightning includes several solutions for privacy protection, and the most important of them is the "onion-routing" principle, which was suggested by the lead Lightning developer and co-founder of Lightning Labs Laolu Osuntokun, and is part of the "Basis of Lightning Technology" (BOLT). In the "onion," payments will be transmitted over a variety of channels while revealing a minimum of information. When receiving an encrypted payment, the node will know only where the payment came from, and to which node it should be transferred. According to Osuntokun, the importance of this scheme is that the nodes cannot work selectively, "nodes should not arbitrarily select certain payments or 'blacklist' certain recipients." The presence of this function will allow the Lightning network to become similar to the Darknet browser Tor and make it "a darknet for Bitcoin payments."
Osuntokun said that this function is insufficiently tested at this stage and has a number of vulnerabilities, "as with Tor, there is a likelihood of 'timing attacks' and a number of active attacks." Some developers also suggest that the "onion" can be manipulated, especially at an early stage of the Lightning network's development, which again leads to a lack of privacy. For example, the last node of the payment route and the sender of this payment will know the details of the transaction, and, theoretically, the nodes can enter into a secret conspiracy, connecting all payment steps to see the full picture.
In addition, there is the threat of "a universal enemy who can simultaneously monitor all channels of the network," Osuntokun said. This vulnerability is caused by a fixed identifier repeated throughout the route: "This means that if the enemy owns two non-contiguous route nodes, they can bind the payment flow." Among the most successful solutions, Osuntokun considers integrating Schnorr signatures into the Bitcoin network, and "a more difficult decision" is the zero-knowledge proof concept. This, however, "will significantly increase the amount of information that must be transferred for a payment to go through," says Osuntokun.
Another problem is the threat of centralization as the developers recognize that Lightning can turn into a centralized network with a star topology, where a large company will act as a hub. According to Kristov Atlas, a researcher of privacy, in the worst case scenario, malicious "leeches" will suck into the hubs and "vampire" to pump out the data. The developer of Blocksteam Christian Decker said that the team was considering countermeasures. If the system opens channels randomly, it will "avoid the possibility that hubs will monitor traffic" and in general "will increase the network's resistance to single points of failure." The developer also noted that randomness would complicate the routing of payments, making it less predictable, but at the same time increase fees.
Developers are working to further improve the Lightning network. Last week, Laolu Osuntokun announced the creation of "watchtowers" which will maintain the security of the network and alert users in case of threats. Meanwhile, Mimblewimble, one of the most ambitious projects aimed at increasing privacy and prohibiting the blockchain from "spilling out information," has already announced preparing test versions with the implementation of the Lightning Network.